'''
# IAM Floyd

[![Source](https://img.shields.io/github/stars/udondan/iam-floyd?logo=github&label=GitHub%20Stars)](https://github.com/udondan/iam-floyd)
[![iam-floyd](https://img.shields.io/github/v/release/udondan/iam-floyd)](https://github.com/udondan/iam-floyd)
[![Twitter](https://badgen.net/twitter/follow/heyiamfloyd?icon=twitter)](https://twitter.com/heyiamfloyd)
[![libraries.io](https://img.shields.io/badge/packages-libraries.io-yellow)](https://libraries.io/search?q=iam-floyd)
[![Documentation](https://img.shields.io/badge/Documentation-Read%20the%20Docs-orange)](https://iam-floyd.readthedocs.io/en/latest/)
[![CDKio](https://img.shields.io/badge/awscdk.io-cdk--iam--floyd-orange)](https://awscdk.io/packages/cdk-iam-floyd@0.161.0)
[![GitHub](https://img.shields.io/github/license/udondan/iam-floyd)](https://github.com/udondan/iam-floyd/blob/main/LICENSE)
[![Maintainability](https://api.codeclimate.com/v1/badges/cdb84b5646c6805b1a23/maintainability)](https://codeclimate.com/github/udondan/iam-floyd/maintainability)

<!-- put back - when we actually have tests
[![Test Coverage](https://api.codeclimate.com/v1/badges/cdb84b5646c6805b1a23/test_coverage)](https://codeclimate.com/github/udondan/iam-floyd/test_coverage)
-->

**AWS [IAM policy statement](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_statement.html) generator with fluent interface.**

<!-- stats -->

Support for:

* 264 Services
* 9714 Actions
* 1025 Resource Types
* 1039 Condition keys

<!-- /stats -->

![EXPERIMENTAL](https://img.shields.io/badge/stability-experimantal-orange?style=for-the-badge)**<br>This is an early version of the package. The API will change while I implement new features. Therefore make sure you use an exact version in your `package.json` before it reaches 1.0.0.**

## Documentation

Find the documentation at [Read the Docs](https://iam-floyd.readthedocs.io/en/latest/).

[![Auto completion demo](https://raw.githubusercontent.com/udondan/iam-floyd/main/docs/movie-preview.png)](https://www.youtube.com/watch?v=4dHY8qPHbKA)

## Packages

There are two different package variants available:

* **iam-floyd**: Can be used in AWS SDK, Boto 3 or for whatever you need an IAM policy statement for <br>[![npm](https://img.shields.io/npm/dt/iam-floyd?label=npm&color=blueviolet)](https://www.npmjs.com/package/iam-floyd)
  [![PyPI](https://img.shields.io/pypi/dm/iam-floyd?label=pypi&color=blueviolet)](https://pypi.org/project/iam-floyd/)
  [![NuGet](https://img.shields.io/nuget/dt/IAM.Floyd?label=nuget&color=blueviolet)](https://www.nuget.org/packages/IAM.Floyd/)
* **cdk-iam-floyd**: Integrates into [AWS CDK](https://aws.amazon.com/cdk/) and extends [`iam.PolicyStatement`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-iam.PolicyStatement.html)<br>[![npm](https://img.shields.io/npm/dt/cdk-iam-floyd?label=npm&color=orange)](https://www.npmjs.com/package/cdk-iam-floyd)
  [![PyPI](https://img.shields.io/pypi/dm/cdk-iam-floyd?label=pypi&color=orange)](https://pypi.org/project/cdk-iam-floyd/)
  [![NuGet](https://img.shields.io/nuget/dt/CDK.IAM.Floyd?label=nuget&color=orange)](https://www.nuget.org/packages/CDK.IAM.Floyd/)

Find them all on [libraries.io](https://libraries.io/search?q=iam-floyd).

---


## Legal

The code contained in the [lib/generated](https://github.com/udondan/iam-floyd/tree/main/lib/generated) folder is generated from the [AWS documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_actions-resources-contextkeys.html). The class- and function-names and their description therefore are property of AWS.

AWS and their services are trademarks, registered trademarks or trade dress of AWS in the U.S. and/or other countries.

This project is not affiliated, funded, or in any way associated with AWS.

IAM Floyd is licensed under [Apache License 2.0](https://github.com/udondan/iam-floyd/blob/main/LICENSE). Dependencies might be released under different licenses. Especially the bundled packages [regex-parser](https://www.npmjs.com/package/regex-parser) and [common-substrings](https://www.npmjs.com/package/common-substrings) are released under the MIT License.
'''
import abc
import builtins
import datetime
import enum
import typing

import jsii
import publication
import typing_extensions

from ._jsii import *


@jsii.data_type(
    jsii_type="iam-floyd.AccessLevelList",
    jsii_struct_bases=[],
    name_mapping={},
)
class AccessLevelList:
    def __init__(self) -> None:
        '''
        :stability: experimental
        '''
        self._values: typing.Dict[str, typing.Any] = {}

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "AccessLevelList(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


class Collection(metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Collection"):
    '''
    :stability: experimental
    '''

    def __init__(self) -> None:
        '''
        :stability: experimental
        '''
        jsii.create(Collection, self, [])

    @jsii.member(jsii_name="allowEc2InstanceDeleteByOwner")
    def allow_ec2_instance_delete_by_owner(self) -> typing.List["Ec2"]:
        '''
        :stability: experimental
        '''
        return typing.cast(typing.List["Ec2"], jsii.invoke(self, "allowEc2InstanceDeleteByOwner", []))


@jsii.data_type(
    jsii_type="iam-floyd.Conditions",
    jsii_struct_bases=[],
    name_mapping={},
)
class Conditions:
    def __init__(self) -> None:
        '''(experimental) A collection of Condition's.

        :stability: experimental
        '''
        self._values: typing.Dict[str, typing.Any] = {}

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "Conditions(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.enum(jsii_type="iam-floyd.Effect")
class Effect(enum.Enum):
    '''(experimental) Policy effects.

    :stability: experimental
    '''

    ALLOW = "ALLOW"
    '''
    :stability: experimental
    '''
    DENY = "DENY"
    '''
    :stability: experimental
    '''


class Operator(metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Operator"):
    '''(experimental) Use condition operators in the ``Condition`` element to match the condition key and value in the policy against values in the request context.

    For more information about the ``Condition`` element, see `IAM JSON Policy Elements: Condition <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html>`_.

    The condition operator that you can use in a policy depends on the condition key you choose. You can choose a global condition key or a service-specific condition key. To learn which condition operator you can use for a global condition key, see `AWS Global Condition Context Keys <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html>`_. To learn which condition operator you can use for a service-specific condition key, see `Actions, Resources, and Condition Keys for AWS Services <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_actions-resources-contextkeys.html>`_ and choose the service that you want to view.

    https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html

    :stability: experimental
    '''

    def __init__(self) -> None:
        '''
        :stability: experimental
        '''
        jsii.create(Operator, self, [])

    @jsii.member(jsii_name="arnEquals")
    def arn_equals(self) -> "Operator":
        '''(experimental) Match of the ARN, case sensitive.

        Each of the six colon-delimited components of the ARN is checked separately and each can include a multi-character match wildcard (``*``) or a single-character match wildcard (``?``).

        ``ArnEquals`` and ``ArnLike`` behave identical.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "arnEquals", []))

    @jsii.member(jsii_name="arnLike")
    def arn_like(self) -> "Operator":
        '''(experimental) Match of the ARN, case sensitive.

        Each of the six colon-delimited components of the ARN is checked separately and each can include a multi-character match wildcard (``*``) or a single-character match wildcard (``?``).

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "arnLike", []))

    @jsii.member(jsii_name="arnNotEquals")
    def arn_not_equals(self) -> "Operator":
        '''(experimental) Negated match of the ARN, case sensitive.

        Each of the six colon-delimited components of the ARN is checked separately and each can include a multi-character match wildcard (``*``) or a single-character match wildcard (``?``).

        ``ArnNotEquals`` and ``ArnNotLike`` behave identical.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "arnNotEquals", []))

    @jsii.member(jsii_name="arnNotLike")
    def arn_not_like(self) -> "Operator":
        '''(experimental) Negated match of the ARN, case sensitive.

        Each of the six colon-delimited components of the ARN is checked separately and each can include a multi-character match wildcard (``*``) or a single-character match wildcard (``?``).

        ``ArnNotEquals`` and ``ArnNotLike`` behave identical.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "arnNotLike", []))

    @jsii.member(jsii_name="binaryEquals")
    def binary_equals(self) -> "Operator":
        '''(experimental) The BinaryEquals condition operator lets you construct Condition elements that test key values that are in binary format.

        It compares the value of the specified key byte for byte against a `base-64 <https://en.wikipedia.org/wiki/Base64>`_ encoded representation of the binary value in the policy.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "binaryEquals", []))

    @jsii.member(jsii_name="bool")
    def bool(self) -> "Operator":
        '''(experimental) Boolean match.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "bool", []))

    @jsii.member(jsii_name="dateEquals")
    def date_equals(self) -> "Operator":
        '''(experimental) Match a specific date: ``=``.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "dateEquals", []))

    @jsii.member(jsii_name="dateGreaterThan")
    def date_greater_than(self) -> "Operator":
        '''(experimental) Match after a specific a date and time: ``>``.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "dateGreaterThan", []))

    @jsii.member(jsii_name="dateGreaterThanEquals")
    def date_greater_than_equals(self) -> "Operator":
        '''(experimental) Match at or after a specific date and time: ``>=``.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "dateGreaterThanEquals", []))

    @jsii.member(jsii_name="dateLessThan")
    def date_less_than(self) -> "Operator":
        '''(experimental) Match before a specific date and time: ``<``.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "dateLessThan", []))

    @jsii.member(jsii_name="dateLessThanEquals")
    def date_less_than_equals(self) -> "Operator":
        '''(experimental) Match at or before a specific date and time: ``<=``.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "dateLessThanEquals", []))

    @jsii.member(jsii_name="dateNotEquals")
    def date_not_equals(self) -> "Operator":
        '''(experimental) Negated match for a specific date: ``!=``.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "dateNotEquals", []))

    @jsii.member(jsii_name="forAllValues")
    def for_all_values(self) -> "Operator":
        '''(experimental) Tests whether the value of every member of the request set is a subset of the condition key set.

        The condition returns true if every key value in the request matches at least one value in the policy. It also returns true if there are no keys in the request, or if the key values resolve to a null data set, such as an empty string.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "forAllValues", []))

    @jsii.member(jsii_name="forAnyValue")
    def for_any_value(self) -> "Operator":
        '''(experimental) Tests whether at least one member of the set of request values matches at least one member of the set of condition key values.

        The condition returns true if any one of the key values in the request matches any one of the condition values in the policy. For no matching key or a null dataset, the condition returns false.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "forAnyValue", []))

    @jsii.member(jsii_name="ifExists")
    def if_exists(self) -> "Operator":
        '''(experimental) You can add ``IfExists`` to the end of any condition operator name except the ``Null`` condition.

        For example, ``StringLikeIfExists``. You do this to say "If the policy key is present in the context of the request, process the key as specified in the policy. If the key is not present, evaluate the condition element as true." Other condition elements in the statement can still result in a nonmatch, but not a missing key when checked with ``...IfExists``.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "ifExists", []))

    @jsii.member(jsii_name="ipAddress")
    def ip_address(self) -> "Operator":
        '''(experimental) Match an IP address or range: ``=``.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "ipAddress", []))

    @jsii.member(jsii_name="notIpAddress")
    def not_ip_address(self) -> "Operator":
        '''(experimental) All IP addresses except the specified IP address or range ``!=``.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "notIpAddress", []))

    @jsii.member(jsii_name="null")
    def null(self) -> "Operator":
        '''(experimental) Check if a key is present at the time of authorization.

        In the policy statement, use either true (the key doesn't exist — it is null) or false (the key exists and its value is not null).

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "null", []))

    @jsii.member(jsii_name="numericEquals")
    def numeric_equals(self) -> "Operator":
        '''(experimental) Exact match.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "numericEquals", []))

    @jsii.member(jsii_name="numericGreaterThan")
    def numeric_greater_than(self) -> "Operator":
        '''(experimental) Match numbers higher than value: ``>``.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "numericGreaterThan", []))

    @jsii.member(jsii_name="numericGreaterThanEquals")
    def numeric_greater_than_equals(self) -> "Operator":
        '''(experimental) Match numbers higher or equal value: ``>=``.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "numericGreaterThanEquals", []))

    @jsii.member(jsii_name="numericLessThan")
    def numeric_less_than(self) -> "Operator":
        '''(experimental) Match numbers lower than value: ``<``.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "numericLessThan", []))

    @jsii.member(jsii_name="numericLessThanEquals")
    def numeric_less_than_equals(self) -> "Operator":
        '''(experimental) Match numbers lower or equal to value: ``<=``.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "numericLessThanEquals", []))

    @jsii.member(jsii_name="numericNotEquals")
    def numeric_not_equals(self) -> "Operator":
        '''(experimental) Negated exact match.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "numericNotEquals", []))

    @jsii.member(jsii_name="stringEquals")
    def string_equals(self) -> "Operator":
        '''(experimental) Exact match, case sensitive.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "stringEquals", []))

    @jsii.member(jsii_name="stringEqualsIgnoreCase")
    def string_equals_ignore_case(self) -> "Operator":
        '''(experimental) Exact match, ignore case.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "stringEqualsIgnoreCase", []))

    @jsii.member(jsii_name="stringLike")
    def string_like(self) -> "Operator":
        '''(experimental) Case-sensitive match.

        The values can include a multi-character match wildcard (``*``) or a single-character match wildcard (``?``) anywhere in the string.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "stringLike", []))

    @jsii.member(jsii_name="stringNotEquals")
    def string_not_equals(self) -> "Operator":
        '''(experimental) Negated exact match, case sensitive.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "stringNotEquals", []))

    @jsii.member(jsii_name="stringNotEqualsIgnoreCase")
    def string_not_equals_ignore_case(self) -> "Operator":
        '''(experimental) Exact exact match, ignore case.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "stringNotEqualsIgnoreCase", []))

    @jsii.member(jsii_name="stringNotLike")
    def string_not_like(self) -> "Operator":
        '''(experimental) Negated case-sensitive matching.

        The values can include a multi-character match wildcard (``*``) or a single-character match wildcard (``?``) anywhere in the string.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "stringNotLike", []))

    @jsii.member(jsii_name="toString")
    def to_string(self) -> builtins.str:
        '''
        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.invoke(self, "toString", []))


class PolicyStatementBase(
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.PolicyStatementBase",
):
    '''(experimental) Base class for the Policy Statement.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''
        :param sid: -

        :stability: experimental
        '''
        jsii.create(PolicyStatementBase, self, [sid])

    @jsii.member(jsii_name="toJSON")
    def to_json(self) -> typing.Any:
        '''(experimental) JSON-ify the policy statement.

        Used when JSON.stringify() is called

        :stability: experimental
        '''
        return typing.cast(typing.Any, jsii.invoke(self, "toJSON", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="sid")
    def sid(self) -> builtins.str:
        '''
        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "sid"))

    @sid.setter
    def sid(self, value: builtins.str) -> None:
        jsii.set(self, "sid", value)


class PolicyStatementWithCondition(
    PolicyStatementBase,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.PolicyStatementWithCondition",
):
    '''(experimental) Adds "condition" functionality to the Policy Statement.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''
        :param sid: -

        :stability: experimental
        '''
        jsii.create(PolicyStatementWithCondition, self, [sid])

    @jsii.member(jsii_name="hasConditions")
    def has_conditions(self) -> builtins.bool:
        '''(experimental) Checks weather a condition was applied to the policy.

        :stability: experimental
        '''
        return typing.cast(builtins.bool, jsii.invoke(self, "hasConditions", []))

    @jsii.member(jsii_name="if")
    def if_(
        self,
        key: builtins.str,
        value: typing.Any,
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Adds a condition to the statement.

        :param key: The key of the condition.
        :param value: The value(s) to check for.
        :param operator: `Operator <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html>`_ of the condition. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "if", [key, value, operator]))

    @jsii.member(jsii_name="ifAwsCalledVia")
    def if_aws_called_via(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the services with the services that made requests on behalf of the IAM principal (user or role).

        When a principal makes a request to an AWS service, that service might use the principal's credentials to make subsequent requests to other services.

        The ``aws:CalledVia`` key contains an ordered list of each service in the chain that made requests on the principal's behalf.

        **Availability:** This key is present in the request when a service that supports aws:CalledVia uses the credentials of an IAM principal to make a request to another service. This key is not present if the service uses a `service role <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-role>`_ or `service-linked role <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-linked-role>`_ to make a call on the principal's behalf. This key is also not present when the principal makes the call directly.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-calledvia

        :param value: The service(s) to check for.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``ForAnyValue:StringEquals``.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsCalledVia", [value, operator]))

    @jsii.member(jsii_name="ifAwsCalledViaFirst")
    def if_aws_called_via_first(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the services with the first service that made a request on behalf of the IAM principal (user or role).

        For more information, see `aws:CalledVia <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-calledvia>`_.

        **Availability:** This key is present in the request when a service that supports aws:CalledVia uses the credentials of an IAM principal to make a request to another service. This key is not present if the service uses a `service role <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-role>`_ or `service-linked role <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-linked-role>`_ to make a call on the principal's behalf. This key is also not present when the principal makes the call directly.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-calledviafirst

        :param value: The service(s) to check for.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsCalledViaFirst", [value, operator]))

    @jsii.member(jsii_name="ifAwsCalledViaLast")
    def if_aws_called_via_last(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the services with the last service that made a request on behalf of the IAM principal (user or role).

        For more information, see `aws:CalledVia <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-calledvia>`_.

        **Availability:** This key is present in the request when a service that supports aws:CalledVia uses the credentials of an IAM principal to make a request to another service. This key is not present if the service uses a `service role <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-role>`_ or `service-linked role <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-linked-role>`_ to make a call on the principal's behalf. This key is also not present when the principal makes the call directly.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-calledvialast

        :param value: The service(s) to check for.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsCalledViaLast", [value, operator]))

    @jsii.member(jsii_name="ifAwsCurrentTime")
    def if_aws_current_time(
        self,
        value: typing.Union[builtins.str, datetime.datetime, typing.Sequence[typing.Union[builtins.str, datetime.datetime]]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the date and time of the request with the date and time that you specify.

        To view an example policy that uses this condition key, see `AWS: Allows Access Within Specific Dates <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_aws-dates.html>`_.

        **Availability:** This key is always included in the request context.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-currenttime

        :param value: The date and time to check for. Can be a string in one of the `W3C implementations of the ISO 8601 date <https://www.w3.org/TR/NOTE-datetime>`_ (e.g. ``2020-04-01T00:00:00Z``) or in epoch (UNIX) time or a ``Date()`` object (JavaScript only)
        :param operator: Works with `date operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Date>`_. **Default:** ``DateLessThanEquals``.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsCurrentTime", [value, operator]))

    @jsii.member(jsii_name="ifAwsEpochTime")
    def if_aws_epoch_time(
        self,
        value: typing.Union[builtins.str, jsii.Number, datetime.datetime, typing.Sequence[typing.Union[builtins.str, jsii.Number, datetime.datetime]]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the date and time of the request in epoch or Unix time with the value that you specify.

        This key also accepts the number of seconds since January 1, 1970.

        **Availability:** This key is always included in the request context.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-epochtime

        :param value: The date and time to check for. Can be a string in one of the `W3C implementations of the ISO 8601 date <https://www.w3.org/TR/NOTE-datetime>`_ (e.g. ``2020-04-01T00:00:00Z``) or in epoch (UNIX) time or a ``Date()`` object (JavaScript only)
        :param operator: Works with `date <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Date>`_ and `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``DateLessThanEquals``.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsEpochTime", [value, operator]))

    @jsii.member(jsii_name="ifAwsMultiFactorAuthAge")
    def if_aws_multi_factor_auth_age(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the number of seconds since the requesting principal was authorized using MFA with the number that you specify.

        For more information about MFA, see `Using Multi-Factor Authentication (MFA) in AWS <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html>`_.

        **Availability:** This key is included in the request context only if the principal was authenticated using MFA. If MFA was not used, this key is not present.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-multifactorauthage

        :param value: Number of seconds.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericLessThan``.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsMultiFactorAuthAge", [value, operator]))

    @jsii.member(jsii_name="ifAwsMultiFactorAuthPresent")
    def if_aws_multi_factor_auth_present(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Check whether multi-factor authentication (MFA) was used to validate the temporary security credentials that made the request.

        **Availability:** This key is included in the request context only when the principal uses temporary credentials to make the request. The key is not present in AWS CLI, AWS API, or AWS SDK requests that are made using long-term credentials.

        Temporary credentials are used to authenticate IAM roles, federated users, IAM users with temporary tokens from ``sts:GetSessionToken``, and users of the AWS Management Console. IAM users in the AWS Management Console unknowingly use temporary credentials. Users sign into the console using their user name and password, which are long-term credentials. However, in the background, the console generates temporary credentials on behalf of the user. To learn which services support using temporary credentials, see `AWS Services That Work with IAM <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html>`_.

        The ``aws:MultiFactorAuthPresent`` key is not present when an API or CLI command is called with long-term credentials, such as user access key pairs. Therefore we recommend that when you check for this key that you use the `...IfExists <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_IfExists>`_ versions of the condition operators.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-multifactorauthpresent

        :param value: Weather the MFA should be present or absent. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsMultiFactorAuthPresent", [value]))

    @jsii.member(jsii_name="ifAwsPrincipalAccount")
    def if_aws_principal_account(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the account to which the requesting principal belongs with the account identifier that you specify.

        **Availability:** This key is always included in the request context.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-principalaccount

        :param value: Account identifier(s).
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsPrincipalAccount", [value, operator]))

    @jsii.member(jsii_name="ifAwsPrincipalArn")
    def if_aws_principal_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the `Amazon Resource Name <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-arns>`_ (ARN) of the principal that made the request with the ARN that you specify.

        For IAM roles, the request context returns the ARN of the role, not the ARN of the user that assumed the role. To learn which types of principals you can specify in this condition key, see `Specifying a Principal <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#Principal_specifying>`_.

        **Availability:** This key is always included in the request context.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-principalarn

        :param value: Principle ARN(s).
        :param operator: Works with `ARN operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_ and `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsPrincipalArn", [value, operator]))

    @jsii.member(jsii_name="ifAwsPrincipalOrgID")
    def if_aws_principal_org_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the identifier of the organization in AWS Organizations to which the requesting principal belongs with the identifier you specify.

        **Availability:** This key is included in the request context only if the principal is a member of an organization.

        This global key provides an alternative to listing all the account IDs for all AWS accounts in an organization. You can use this condition key to simplify specifying the ``Principal`` element in a resource-based policy. You can specify the organization ID in the condition element. When you add and remove accounts, policies that include the ``aws:PrincipalOrgID`` key automatically include the correct accounts and don't require manual updating.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-principalorgid

        :param value: Organization ID(s) in format ``o-xxxxxxxxxxx``.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsPrincipalOrgID", [value, operator]))

    @jsii.member(jsii_name="ifAwsPrincipalOrgPaths")
    def if_aws_principal_org_paths(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the AWS Organizations path for the principal who is making the request to the path you provide.

        That principal can be an IAM user, IAM role, federated user, or AWS account root user.

        This condition ensures that the requester is an account member within the specified organization root or organizational units (OUs) in AWS Organizations. An AWS Organizations path is a text representation of the structure of an Organizations entity. For more information about using and understanding paths, see Understand the `AWS Organizations Entity Path <https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_access-advisor-view-data-orgs.html#access_policies_access-advisor-viewing-orgs-entity-path>`_.

        **Availability:** This key is included in the request context only if the principal is a member of an organization.

        **Note:** Organization IDs are globally unique but OU IDs and root IDs are unique only within an organization. This means that no two organizations share the same organization ID. However, another organization might have an OU or root with the same ID as yours. We recommend that you always include the organization ID when you specify an OU or root.

        ``aws:PrincipalOrgPaths`` is a multivalued condition key. Multivalued keys include one or more values in a list format. The result is a logical ``OR``. When you use multiple values with the ``ForAnyValue:`` condition operator, the principal's path must match one of the paths provided. For policies that include multiple values for a single key, you must enclose the conditions within brackets like an array (``"Key":["Value1", "Value2"]``). You should also include these brackets when there is a single value. For more information about multivalued condition keys, see `Creating a Condition with Multiple Keys or Values <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_multi-value-conditions.html>`_.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-principalorgpaths

        :param value: Organization path(s) in the format of ``o-xxxxxxxxxxx/r-xxxxxxxxxx/ou-xxxx-xxxxxxxx/ou-xxxx-xxxxxxxx/``.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringEquals``.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsPrincipalOrgPaths", [value, operator]))

    @jsii.member(jsii_name="ifAwsPrincipalTag")
    def if_aws_principal_tag(
        self,
        key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the tag attached to the principal making the request with the tag that you specify.

        If the principal has more than one tag attached, the request context includes one aws:PrincipalTag key for each attached tag key.

        **Availability:** This key is included in the request context if the principal is using an IAM user with attached tags. It is included for a principal using an IAM role with attached tags or `session tags <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html>`_.

        You can add custom attributes to a user or role in the form of a key-value pair. For more information about IAM tags, see `Tagging IAM Users and Roles <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_tags.html>`_. You can use ``aws:PrincipalTag`` to `control access <https://docs.aws.amazon.com/IAM/latest/UserGuide/access_iam-tags.html#access_iam-tags_control-resources>`_ for AWS principals.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-principaltag

        :param key: The tag key to check.
        :param value: The tag value(s) to check against.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsPrincipalTag", [key, value, operator]))

    @jsii.member(jsii_name="ifAwsPrincipalType")
    def if_aws_principal_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the type of principal making the request with the principal type that you specify.

        For details about how the information appears in the request context for different principals, see `Specifying a Principal <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#Principal_specifying>`_.

        **Availability:** This key is always included in the request context.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-principaltype

        :param value: The principal type(s). Any of ``Account``, ``User``, ``FederatedUser``, ``AssumedRole``, ``Anonymous``
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringEquals``.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsPrincipalType", [value, operator]))

    @jsii.member(jsii_name="ifAwsReferer")
    def if_aws_referer(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare who referred the request in the client browser with the referer that you specify.

        The ``aws:referer`` request context value is provided by the caller in an HTTP header.

        **Availability:** This key is included in the request context only if the request was invoked using a URL in the browser.

        For example, you can call `Amazon S3 API operations directly using a web browser <https://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies.html#example-bucket-policies-use-case-4>`_. This means that you can view S3 objects, such as images and documents, directly through a web browser. The ``aws:referer`` condition allows you to restrict access to specific values in the HTTP or HTTPS request based on the value of the referrer header.

        **Warning:** This condition should be used carefully. It is dangerous to include a publicly known referer header value. Unauthorized parties can use modified or custom browsers to provide any ``aws:referer`` value that they choose. As a result, ``aws:referer`` should not be used to prevent unauthorized parties from making direct AWS requests. It is offered only to allow customers to protect their digital content, such as content stored in Amazon S3, from being referenced on unauthorized third-party sites.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-referer

        :param value: The referer url(s).
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsReferer", [value, operator]))

    @jsii.member(jsii_name="ifAwsRequestedRegion")
    def if_aws_requested_region(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the AWS Region that was called in the request with the Region that you specify.

        You can use this global condition key to control which Regions can be requested. To view the AWS Regions for each service, see `Service endpoints and quotas <https://docs.aws.amazon.com/general/latest/gr/aws-service-information.html>`_ in the Amazon Web Services General Reference.

        **Availability:** This key is always included in the request context.

        Some global services, such as IAM, have a single endpoint. Because this endpoint is physically located in the US East (N. Virginia) Region, IAM calls are always made to the us-east-1 Region. For example, if you create a policy that denies access to all services if the requested Region is not us-west-2, then IAM calls always fail. To view an example of how to work around this, see `NotAction with Deny <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_notaction.html>`_.

        **Note:** The ``aws:RequestedRegion`` condition key allows you to control which endpoint of a service is invoked but does not control the impact of the operation. Some services have cross-Region impacts. For example, Amazon S3 has API operations that control cross-Region replication. You can invoke ``s3:PutBucketReplication`` in one Region (which is affected by the ``aws:RequestedRegion`` condition key), but other Regions are affected based on the replications configuration settings.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-requestedregion

        :param value: The region(s).
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringEquals``.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsRequestedRegion", [value, operator]))

    @jsii.member(jsii_name="ifAwsRequestTag")
    def if_aws_request_tag(
        self,
        key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the tag key-value pair that was passed in the request with the tag pair that you specify.

        For example, you could check whether the request includes the tag key ``Dept`` and that it has the value ``Accounting``. For more information, see `Controlling Access During AWS Requests <https://docs.aws.amazon.com/IAM/latest/UserGuide/access_tags.html#access_tags_control-requests>`_.

        **Availability:** This key is included in the request context when tags are passed in the request. When multiple tags are passed in the request, there is one context key for each tag key-value pair.

        Because you can include multiple tag key-value pairs in a request, the request content could be a multivalued request. In this case, you should consider using the ``ForAllValues`` or ``ForAnyValue`` set operators. For more information, see `Using Multiple Keys and Values <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_multi-value-conditions.html#reference_policies_multi-key-or-value-conditions>`_.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-requesttag

        :param key: The tag key to check.
        :param value: The tag value(s) to check against.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsRequestTag", [key, value, operator]))

    @jsii.member(jsii_name="ifAwsResourceTag")
    def if_aws_resource_tag(
        self,
        key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the tag key-value pair that you specify with the key-value pair that is attached to the resource.

        For example, you could require that access to a resource is allowed only if the resource has the attached tag key ``Dept`` with the value ``Marketing``. For more information, see `Controlling Access to AWS Resources <https://docs.aws.amazon.com/IAM/latest/UserGuide/access_tags.html#access_tags_control-resources>`_.

        **Availability:** This key is included in the request context when the requested resource already has attached tags. This key is returned only for resources that `support authorization based on tags <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html>`_. There is one context key for each tag key-value pair.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourcetag

        :param key: The tag key to check.
        :param value: The tag value(s) to check against.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsResourceTag", [key, value, operator]))

    @jsii.member(jsii_name="ifAwsSecureTransport")
    def if_aws_secure_transport(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Check whether the request was sent using SSL.

        The request context returns ``true`` or ``false``. In a policy, you can allow specific actions only if the request is sent using SSL.

        **Availability:** This key is always included in the request context.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-securetransport

        :param value: Weather request was sent using SSL. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsSecureTransport", [value]))

    @jsii.member(jsii_name="ifAwsSourceAccount")
    def if_aws_source_account(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the account ID of the resource making a service-to-service request with the account ID that you specify.

        **Availability:** This key is included in the request context only if accessing a resource triggers an AWS service to call another service on behalf of the resource owner. The calling service must pass the resource ARN of the source to the called service. This ARN includes the source account ID.

        You can use this condition key to check that Amazon S3 is not being used as a `confused deputy <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html#confused-deputy>`_. For example, when an Amazon S3 bucket update triggers an Amazon SNS topic post, the Amazon S3 service invokes the ``sns:Publish`` API operation. The bucket is considered the source of the SNS request and the value of the key is the account ID from the bucket's ARN.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourceaccount

        :param value: The account ID(s).
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsSourceAccount", [value, operator]))

    @jsii.member(jsii_name="ifAwsSourceArn")
    def if_aws_source_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the `Amazon Resource Name (ARN) <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-arns>`_ of the resource making a service-to-service request with the ARN that you specify.

        This key does not work with the ARN of the principal making the request. Instead, use `aws:PrincipalArn <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-principalarn>`_. The source's ARN includes the account ID, so it is not necessary to use ``aws:SourceAccount`` with ``aws:SourceArn``.

        **Availability:** This key is included in the request context only if accessing a resource triggers an AWS service to call another service on behalf of the resource owner. The calling service must pass the ARN of the original resource to the called service.

        You can use this condition key to check that Amazon S3 is not being used as a `confused deputy <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html#confused-deputy>`_. For example, when an Amazon S3 bucket update triggers an Amazon SNS topic post, the Amazon S3 service invokes the ``sns:Publish`` API operation. The bucket is considered the source of the SNS request and the value of the key is the bucket's ARN.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourcearn

        :param value: The source ARN(s).
        :param operator: Works with `ARN operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_ and `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsSourceArn", [value, operator]))

    @jsii.member(jsii_name="ifAwsSourceIp")
    def if_aws_source_ip(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the requester's IP address with the IP address that you specify.

        **Availability:** This key is included in the request context, except when the requester uses a VPC endpoint to make the request.

        The ``aws:SourceIp`` condition key can be used in a policy to allow principals to make requests only from within a specified IP range. However, this policy denies access if an AWS service makes calls on the principal's behalf. In this case, you can use ``aws:SourceIp`` with the `aws:ViaAWSService <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-viaawsservice>`_ key to ensure that the source IP restriction applies only to requests made directly by a principal.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourceip

        :param value: The source IP(s).
        :param operator: Works with IP `address operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_IPAddress>`_. **Default:** ``IpAddress``.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsSourceIp", [value, operator]))

    @jsii.member(jsii_name="ifAwsSourceVpc")
    def if_aws_source_vpc(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Check whether the request comes from the VPC that you specify.

        In a policy, you can use this condition to allow access to only a specific VPC. For more information, see `Restricting Access to a Specific VPC <https://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies-vpc-endpoint.html#example-bucket-policies-restrict-access-vpc>`_ in the *Amazon Simple Storage Service Developer Guide*.

        **Availability:** This key is included in the request context only if the requester uses a VPC endpoint to make the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourcevpc

        :param value: The VPS ID(s).
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringEquals``.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsSourceVpc", [value, operator]))

    @jsii.member(jsii_name="ifAwsSourceVpce")
    def if_aws_source_vpce(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the VPC endpoint identifier of the request with the endpoint ID that you specify.

        In a policy, you can use this condition to restrict access to a specific VPC endpoint. For more information, see `Restricting Access to a Specific VPC Endpoint <https://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies-vpc-endpoint.html#example-bucket-policies-restrict-access-vpc-endpoint>`_ in the *Amazon Simple Storage Service Developer Guide*.

        **Availability:** This key is included in the request context only if the requester uses a VPC endpoint to make the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourcevpce

        :param value: The VPC Endpoint ID(s).
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsSourceVpce", [value, operator]))

    @jsii.member(jsii_name="ifAwsTagKeys")
    def if_aws_tag_keys(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the tag keys in a request with the keys that you specify.

        As a best practice when you use policies to control access using tags, use the ``aws:TagKeys`` condition key to define what tag keys are allowed. For example policies and more information, see `Controlling Access Based on Tag Keys <https://docs.aws.amazon.com/IAM/latest/UserGuide/access_tags.html#access_tags_control-tag-keys>`_.

        **Availability:** This key is included in the request context only if the operation supports attaching tags to resources.

        Because you can include multiple tag key-value pairs in a request, the request content could be a `multivalued <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_multi-value-conditions.html>`_ request. In this case, you should consider using the ``ForAllValues`` or ``ForAnyValue`` set operators. For more information, see Using Multiple Keys and Values.

        Some services support tagging with resource operations, such as creating, modifying, or deleting a resource. To allow tagging and operations as a single call, you must create a policy that includes both the tagging action and the resource-modifying action. You can then use the ``aws:TagKeys`` condition key to enforce using specific tag keys in the request. For example, to limit tags when someone creates an Amazon EC2 snapshot, you must include the ``ec2:CreateSnapshot`` creation action ***and*** the ``ec2:CreateTags`` tagging action in the policy. To view a policy for this scenario that uses ``aws:TagKeys``, see `Creating a Snapshot with Tags <https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ExamplePolicies_EC2.html#iam-creating-snapshot-with-tags>`_ in the *Amazon EC2 User Guide for Linux Instances*.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-tagkeys

        :param value: The tag key(s).
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsTagKeys", [value, operator]))

    @jsii.member(jsii_name="ifAwsTokenIssueTime")
    def if_aws_token_issue_time(
        self,
        value: typing.Union[builtins.str, datetime.datetime],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the date and time that temporary security credentials were issued with the date and time that you specify.

        **Availability:** This key is included in the request context only when the principal uses temporary credentials to make the request. They key is not present in AWS CLI, AWS API, or AWS SDK requests that are made using access keys.

        To learn which services support using temporary credentials, see `AWS Services That Work with IAM <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html>`_.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-tokenissuetime

        :param value: The date and time to check for. Can be a string in one of the `W3C implementations of the ISO 8601 date <https://www.w3.org/TR/NOTE-datetime>`_ (e.g. ``2020-04-01T00:00:00Z``) or in epoch (UNIX) time or a ``Date()`` object (JavaScript only)
        :param operator: Works with `date operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Date>`_. **Default:** ``DateGreaterThanEquals``.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsTokenIssueTime", [value, operator]))

    @jsii.member(jsii_name="ifAwsUserAgent")
    def if_aws_user_agent(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the requester's client application with the application that you specify.

        **Availability:** This key is always included in the request context.

        **Warning:** This key should be used carefully. Since the ``aws:UserAgent`` value is provided by the caller in an HTTP header, unauthorized parties can use modified or custom browsers to provide any ``aws:UserAgent`` value that they choose. As a result, ``aws:UserAgent`` should not be used to prevent unauthorized parties from making direct AWS requests. You can use it to allow only specific client applications, and only after testing your policy.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-useragent

        :param value: The User Agent string(s).
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsUserAgent", [value, operator]))

    @jsii.member(jsii_name="ifAwsUserid")
    def if_aws_userid(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the requester's principal identifier with the ID that you specify.

        For IAM users, the request context value is the user ID. For IAM roles, this value format can vary. For details about how the information appears for different principals, see `Specifying a Principal <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#Principal_specifying>`_.

        **Availability:** This key is included in the request context for all signed requests. Anonymous requests do not include this key.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-userid

        :param value: The principal identifier(s).
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsUserid", [value, operator]))

    @jsii.member(jsii_name="ifAwsUsername")
    def if_aws_username(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the requester's user name with the user name that you specify.

        For details about how the information appears for different principals, see `Specifying a Principal <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#Principal_specifying>`_.

        **Availability:** This key is always included in the request context for IAM users. Anonymous requests and requests that are made using the AWS account root user or IAM roles do not include this key.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-username

        :param value: The user name(s).
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsUsername", [value, operator]))

    @jsii.member(jsii_name="ifAwsViaAWSService")
    def if_aws_via_aws_service(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Check whether an AWS service makes a request to another service on your behalf.

        The request context key returns ``true`` when a service uses the credentials of an IAM principal to make a request on behalf of the principal. The context key returns ``false`` if the service uses a `service role <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-role>`_ or `service-linked role <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-linked-role>`_ to make a call on the principal's behalf. The request context key also returns ``false`` when the principal makes the call directly.

        **Availability:** This key is always included in the request context for most services.

        The following services do not currently support ``aws:ViaAWSService``:

        - Amazon EC2
        - AWS Glue
        - AWS Lake Formation
        - AWS OpsWorks

        You can use this condition key to allow or deny access based on whether a request was made by a service. To view an example policy, see `AWS: Denies Access to AWS Based on the Source IP <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_aws_deny-ip.html>`_.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-viaawsservice

        :param value: Whether a request was made by a service. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsViaAWSService", [value]))

    @jsii.member(jsii_name="ifAwsVpcSourceIp")
    def if_aws_vpc_source_ip(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the IP address from which a request was made with the IP address that you specify.

        In a policy, the key matches only if the request originates from the specified IP address and it goes through a VPC endpoint.

        **Availability:** This key is included in the request context only if the request is made using a VPC endpoint.

        For more information, see `Controlling Access to Services with VPC Endpoints <https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints-access.html>`_ in the *Amazon VPC User Guide*.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-vpcsourceip

        :param value: The VPC source IP(s).
        :param operator: Works with IP `address operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_IPAddress>`_. **Default:** ``IpAddress``.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsVpcSourceIp", [value, operator]))

    @jsii.member(jsii_name="toJSON")
    def to_json(self) -> typing.Any:
        '''(experimental) Injects conditions into the statement.

        Only relevant for the main package. In CDK mode this only calls super.

        :stability: experimental
        '''
        return typing.cast(typing.Any, jsii.invoke(self, "toJSON", []))

    @jsii.member(jsii_name="toStatementJson")
    def to_statement_json(self) -> typing.Any:
        '''
        :stability: experimental
        '''
        return typing.cast(typing.Any, jsii.invoke(self, "toStatementJson", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="conditions")
    def _conditions(self) -> Conditions:
        '''
        :stability: experimental
        '''
        return typing.cast(Conditions, jsii.get(self, "conditions"))

    @_conditions.setter
    def _conditions(self, value: Conditions) -> None:
        jsii.set(self, "conditions", value)


@jsii.data_type(
    jsii_type="iam-floyd.Principals",
    jsii_struct_bases=[],
    name_mapping={},
)
class Principals:
    def __init__(self) -> None:
        '''(experimental) A collection of Principal's.

        :stability: experimental
        '''
        self._values: typing.Dict[str, typing.Any] = {}

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "Principals(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.data_type(
    jsii_type="iam-floyd.ResourceTypes",
    jsii_struct_bases=[],
    name_mapping={},
)
class ResourceTypes:
    def __init__(self) -> None:
        '''
        :stability: experimental
        '''
        self._values: typing.Dict[str, typing.Any] = {}

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "ResourceTypes(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


class PolicyStatementWithActions(
    PolicyStatementWithCondition,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.PolicyStatementWithActions",
):
    '''(experimental) Adds "action" functionality to the Policy Statement.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''
        :param sid: -

        :stability: experimental
        '''
        jsii.create(PolicyStatementWithActions, self, [sid])

    @jsii.member(jsii_name="allActions")
    def all_actions(self) -> "PolicyStatementWithActions":
        '''(experimental) Adds all actions of the statement provider to the statement, e.g. ``actions: 'ec2:*'``.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithActions", jsii.invoke(self, "allActions", []))

    @jsii.member(jsii_name="allListActions")
    def all_list_actions(self) -> "PolicyStatementWithActions":
        '''(experimental) Adds all actions with `access level <https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_understand-policy-summary-access-level-summaries.html#access_policies_access-level>`_ LIST to the statement.

        Permission to list resources within the service to determine whether an object exists.

        Actions with this level of access can list objects but cannot see the contents of a resource.

        For example, the Amazon S3 action ``ListBucket`` has the List access level.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithActions", jsii.invoke(self, "allListActions", []))

    @jsii.member(jsii_name="allMatchingActions")
    def all_matching_actions(
        self,
        *expressions: builtins.str,
    ) -> "PolicyStatementWithActions":
        '''(experimental) Adds all actions that match one of the given regular expressions.

        :param expressions: One or more regular expressions. The regular expressions need to be in `Perl/JavaScript literal style <https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions>`_ and need to be passed as strings, For example:: allMatchingActions('/vpn/i')

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithActions", jsii.invoke(self, "allMatchingActions", [*expressions]))

    @jsii.member(jsii_name="allPermissionManagementActions")
    def all_permission_management_actions(self) -> "PolicyStatementWithActions":
        '''(experimental) Adds all actions with `access level <https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_understand-policy-summary-access-level-summaries.html#access_policies_access-level>`_ PERMISSION MANAGEMENT to the statement.

        Permission to grant or modify resource permissions in the service.

        For example, most IAM and AWS Organizations actions, as well as actions like the Amazon S3 actions ``PutBucketPolicy`` and ``DeleteBucketPolicy`` have the Permissions management access level.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithActions", jsii.invoke(self, "allPermissionManagementActions", []))

    @jsii.member(jsii_name="allReadActions")
    def all_read_actions(self) -> "PolicyStatementWithActions":
        '''(experimental) Adds all actions with `access level <https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_understand-policy-summary-access-level-summaries.html#access_policies_access-level>`_ READ to the statement.

        Permission to read but not edit the contents and attributes of resources in the service.

        For example, the Amazon S3 actions ``GetObject`` and ``GetBucketLocation`` have the Read access level.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithActions", jsii.invoke(self, "allReadActions", []))

    @jsii.member(jsii_name="allTaggingActions")
    def all_tagging_actions(self) -> "PolicyStatementWithActions":
        '''(experimental) Adds all actions with `access level <https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_understand-policy-summary-access-level-summaries.html#access_policies_access-level>`_ TAGGING to the statement.

        Permission to perform actions that only change the state of resource tags.

        For example, the IAM actions ``TagRole`` and ``UntagRole`` have the Tagging access level because they allow only tagging or untagging a role. However, the ``CreateRole`` action allows tagging a role resource when you create that role. Because the action does not only add a tag, it has the Write access level.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithActions", jsii.invoke(self, "allTaggingActions", []))

    @jsii.member(jsii_name="allWriteActions")
    def all_write_actions(self) -> "PolicyStatementWithActions":
        '''(experimental) Adds all actions with `access level <https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_understand-policy-summary-access-level-summaries.html#access_policies_access-level>`_ WRITE to the statement.

        Permission to create, delete, or modify resources in the service.

        For example, the Amazon S3 actions ``CreateBucket``, ``DeleteBucket`` and ``PutObject`` have the Write access level.

        Write actions might also allow modifying a resource tag. However, an action that allows only changes to tags has the Tagging access level.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithActions", jsii.invoke(self, "allWriteActions", []))

    @jsii.member(jsii_name="compact")
    def compact(self) -> "PolicyStatementWithActions":
        '''(experimental) Condense action list down to a list of patterns.

        Using this method can help to reduce the policy size.

        For example, all actions with access level ``list`` could be reduced to a small pattern ``List*``.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithActions", jsii.invoke(self, "compact", []))

    @jsii.member(jsii_name="hasActions")
    def has_actions(self) -> builtins.bool:
        '''(experimental) Checks weather actions have been applied to the policy.

        :stability: experimental
        '''
        return typing.cast(builtins.bool, jsii.invoke(self, "hasActions", []))

    @jsii.member(jsii_name="notActions")
    def not_actions(self) -> "PolicyStatementWithActions":
        '''(experimental) Switches the statement to use ```NotAction`` <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_notaction.html>`_.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithActions", jsii.invoke(self, "notActions", []))

    @jsii.member(jsii_name="to")
    def to(self, action: builtins.str) -> "PolicyStatementWithActions":
        '''(experimental) Adds actions by name.

        Depending on the "mode", actions will be either added to the list of ```Actions`` <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_action.html>`_ or ```NotActions`` <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_notaction.html>`_.

        The mode can be switched by calling ``notActions()``.

        If the action does not contain a colon, the action will be prefixed with the service prefix of the class, e.g. ``ec2:``

        :param action: Actions that will be added to the statement.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithActions", jsii.invoke(self, "to", [action]))

    @jsii.member(jsii_name="toJSON")
    def to_json(self) -> typing.Any:
        '''(experimental) Injects actions into the statement.

        Only relevant for the main package. In CDK mode this only calls super.

        :stability: experimental
        '''
        return typing.cast(typing.Any, jsii.invoke(self, "toJSON", []))

    @jsii.member(jsii_name="toStatementJson")
    def to_statement_json(self) -> typing.Any:
        '''
        :stability: experimental
        '''
        return typing.cast(typing.Any, jsii.invoke(self, "toStatementJson", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="actions")
    def _actions(self) -> typing.List[builtins.str]:
        '''
        :stability: experimental
        '''
        return typing.cast(typing.List[builtins.str], jsii.get(self, "actions"))

    @_actions.setter
    def _actions(self, value: typing.List[builtins.str]) -> None:
        jsii.set(self, "actions", value)


class PolicyStatementWithResources(
    PolicyStatementWithActions,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.PolicyStatementWithResources",
):
    '''(experimental) Adds "resource" functionality to the Policy Statement.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''
        :param sid: -

        :stability: experimental
        '''
        jsii.create(PolicyStatementWithResources, self, [sid])

    @jsii.member(jsii_name="hasPrincipals")
    def has_principals(self) -> builtins.bool:
        '''(experimental) Dummy method. Will be overridden by 6-principal.ts.

        We just need it here so we can reference it in method ``ensureResource``

        :stability: experimental
        '''
        return typing.cast(builtins.bool, jsii.invoke(self, "hasPrincipals", []))

    @jsii.member(jsii_name="hasResources")
    def has_resources(self) -> builtins.bool:
        '''(experimental) Checks weather any resource was applied to the policy.

        :stability: experimental
        '''
        return typing.cast(builtins.bool, jsii.invoke(self, "hasResources", []))

    @jsii.member(jsii_name="notResources")
    def not_resources(self) -> "PolicyStatementWithResources":
        '''(experimental) Switches the statement to use ```NotResource`` <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_notresource.html>`_.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithResources", jsii.invoke(self, "notResources", []))

    @jsii.member(jsii_name="on")
    def on(self, *arns: builtins.str) -> "PolicyStatementWithResources":
        '''(experimental) Limit statement to specified resources.

        To allow all resources, pass ``*``

        :param arns: -

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithResources", jsii.invoke(self, "on", [*arns]))

    @jsii.member(jsii_name="onAllResources")
    def on_all_resources(self) -> "PolicyStatementWithResources":
        '''(experimental) Add all resources (``*``) to the statement.

        This is the default behavior, unless the statement has principals.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithResources", jsii.invoke(self, "onAllResources", []))

    @jsii.member(jsii_name="toJSON")
    def to_json(self) -> typing.Any:
        '''(experimental) Injects resources into the statement.

        Only relevant for the main package. In CDK mode this only calls super.

        :stability: experimental
        '''
        return typing.cast(typing.Any, jsii.invoke(self, "toJSON", []))

    @jsii.member(jsii_name="toStatementJson")
    def to_statement_json(self) -> typing.Any:
        '''
        :stability: experimental
        '''
        return typing.cast(typing.Any, jsii.invoke(self, "toStatementJson", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="resources")
    def _resources(self) -> typing.List[builtins.str]:
        '''
        :stability: experimental
        '''
        return typing.cast(typing.List[builtins.str], jsii.get(self, "resources"))

    @_resources.setter
    def _resources(self, value: typing.List[builtins.str]) -> None:
        jsii.set(self, "resources", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="skipAutoResource")
    def _skip_auto_resource(self) -> builtins.bool:
        '''
        :stability: experimental
        '''
        return typing.cast(builtins.bool, jsii.get(self, "skipAutoResource"))

    @_skip_auto_resource.setter
    def _skip_auto_resource(self, value: builtins.bool) -> None:
        jsii.set(self, "skipAutoResource", value)


class PolicyStatementWithEffect(
    PolicyStatementWithResources,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.PolicyStatementWithEffect",
):
    '''(experimental) Adds "effect" functionality to the Policy Statement.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''
        :param sid: -

        :stability: experimental
        '''
        jsii.create(PolicyStatementWithEffect, self, [sid])

    @jsii.member(jsii_name="allow")
    def allow(self) -> "PolicyStatementWithEffect":
        '''(experimental) Allow the actions in this statement.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithEffect", jsii.invoke(self, "allow", []))

    @jsii.member(jsii_name="deny")
    def deny(self) -> "PolicyStatementWithEffect":
        '''(experimental) Deny the actions in this statement.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithEffect", jsii.invoke(self, "deny", []))

    @jsii.member(jsii_name="toJSON")
    def to_json(self) -> typing.Any:
        '''(experimental) Injects effect into the statement.

        Only relevant for the main package. In CDK mode this only calls super.

        :stability: experimental
        '''
        return typing.cast(typing.Any, jsii.invoke(self, "toJSON", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="effect")
    def effect(self) -> Effect:
        '''
        :stability: experimental
        '''
        return typing.cast(Effect, jsii.get(self, "effect"))

    @effect.setter
    def effect(self, value: Effect) -> None:
        jsii.set(self, "effect", value)


class PolicyStatementWithPrincipal(
    PolicyStatementWithEffect,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.PolicyStatementWithPrincipal",
):
    '''(experimental) Adds "principal" functionality to the Policy Statement.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''
        :param sid: -

        :stability: experimental
        '''
        jsii.create(PolicyStatementWithPrincipal, self, [sid])

    @jsii.member(jsii_name="addPrincipal")
    def _add_principal(
        self,
        prefix: builtins.str,
        principal: builtins.str,
    ) -> "PolicyStatementWithPrincipal":
        '''(experimental) Adds a principal to the statement.

        :param prefix: One of **AWS**, **Federated**, **CanonicalUser** or **Service**.
        :param principal: The principal string.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithPrincipal", jsii.invoke(self, "addPrincipal", [prefix, principal]))

    @jsii.member(jsii_name="cdkApplyPrincipals")
    def _cdk_apply_principals(self) -> None:
        '''
        :stability: experimental
        '''
        return typing.cast(None, jsii.invoke(self, "cdkApplyPrincipals", []))

    @jsii.member(jsii_name="for")
    def for_(
        self,
        arn: builtins.str,
        prefix: typing.Optional[builtins.str] = None,
    ) -> "PolicyStatementWithPrincipal":
        '''(experimental) Adds any principal to the statement.

        :param arn: The ARN of the principal.
        :param prefix: One of **AWS**, **Federated**, **CanonicalUser** or **Service** - Default: **AWS**.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithPrincipal", jsii.invoke(self, "for", [arn, prefix]))

    @jsii.member(jsii_name="forAccount")
    def for_account(self, account: builtins.str) -> "PolicyStatementWithPrincipal":
        '''(experimental) Adds an account principal to the statement.

        :param account: ID of the AWS account.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithPrincipal", jsii.invoke(self, "forAccount", [account]))

    @jsii.member(jsii_name="forAssumedRoleSession")
    def for_assumed_role_session(
        self,
        account: builtins.str,
        role_name: builtins.str,
        session_name: builtins.str,
    ) -> "PolicyStatementWithPrincipal":
        '''(experimental) Adds a specific assumed role session principal to the statement.

        :param account: ID of the AWS account.
        :param role_name: Name of the IAM role.
        :param session_name: Name of the session. You cannot use a wildcard (``*``) to mean *all sessions*. Principals must always name a specific session

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithPrincipal", jsii.invoke(self, "forAssumedRoleSession", [account, role_name, session_name]))

    @jsii.member(jsii_name="forCanonicalUser")
    def for_canonical_user(
        self,
        user_id: builtins.str,
    ) -> "PolicyStatementWithPrincipal":
        '''(experimental) Adds a canonical user principal to the statement.

        :param user_id: The user ID. You can `find the canonical user ID <https://docs.aws.amazon.com/general/latest/gr/acct-identifiers.html#FindingCanonicalId>`_ for your AWS account in the AWS Management Console. The canonical user ID for an AWS account is specific to the account. You can retrieve the canonical user ID for your AWS account as either the root user or an IAM user.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithPrincipal", jsii.invoke(self, "forCanonicalUser", [user_id]))

    @jsii.member(jsii_name="forFederated")
    def for_federated(self, provider: builtins.str) -> "PolicyStatementWithPrincipal":
        '''(experimental) Adds a `federated <https://aws.amazon.com/identity/federation/>`_ (web identity) principal to the statement.

        :param provider: ID of the AWS account.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithPrincipal", jsii.invoke(self, "forFederated", [provider]))

    @jsii.member(jsii_name="forFederatedAmazon")
    def for_federated_amazon(self) -> "PolicyStatementWithPrincipal":
        '''(experimental) Adds a federated `Amazon <https://login.amazon.com/>`_ principal to the statement.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithPrincipal", jsii.invoke(self, "forFederatedAmazon", []))

    @jsii.member(jsii_name="forFederatedCognito")
    def for_federated_cognito(self) -> "PolicyStatementWithPrincipal":
        '''(experimental) Adds a federated `AWS Cognito <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc_cognito.html>`_ principal to the statement.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithPrincipal", jsii.invoke(self, "forFederatedCognito", []))

    @jsii.member(jsii_name="forFederatedFacebook")
    def for_federated_facebook(self) -> "PolicyStatementWithPrincipal":
        '''(experimental) Adds a federated `Facebook <https://developers.facebook.com/docs/facebook-login>`_ principal to the statement.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithPrincipal", jsii.invoke(self, "forFederatedFacebook", []))

    @jsii.member(jsii_name="forFederatedGoogle")
    def for_federated_google(self) -> "PolicyStatementWithPrincipal":
        '''(experimental) Adds a federated `Google <https://developers.google.com/identity/protocols/oauth2/openid-connect>`_ principal to the statement.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithPrincipal", jsii.invoke(self, "forFederatedGoogle", []))

    @jsii.member(jsii_name="forPublic")
    def for_public(self) -> "PolicyStatementWithPrincipal":
        '''(experimental) Grants public asses.

        **EVERYONE IN THE WORLD HAS ACCESS**

        We strongly recommend that you do not use a wildcard in the Principal element in a role's trust policy unless you otherwise restrict access through a Condition element in the policy. Otherwise, any IAM user in any account in your partition can access the role.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithPrincipal", jsii.invoke(self, "forPublic", []))

    @jsii.member(jsii_name="forRole")
    def for_role(
        self,
        account: builtins.str,
        role: builtins.str,
    ) -> "PolicyStatementWithPrincipal":
        '''(experimental) Adds an IAM role principal to the statement.

        :param account: ID of the AWS account.
        :param role: Name of the IAM role.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithPrincipal", jsii.invoke(self, "forRole", [account, role]))

    @jsii.member(jsii_name="forSaml")
    def for_saml(
        self,
        account: builtins.str,
        provider_name: builtins.str,
    ) -> "PolicyStatementWithPrincipal":
        '''(experimental) Adds federated SAML principal to the statement.

        :param account: ID of the AWS account.
        :param provider_name: Name of the SAML provider.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithPrincipal", jsii.invoke(self, "forSaml", [account, provider_name]))

    @jsii.member(jsii_name="forService")
    def for_service(self, service: builtins.str) -> "PolicyStatementWithPrincipal":
        '''(experimental) Adds a service principal to the statement.

        :param service: Long version of the service name. Usually in the format: ``long_service-name.amazonaws.com``. The service principal is defined by the service. To learn the service principal for a service, see the documentation for that service. For some services, see `AWS Services That Work with IAM <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html>`_ and look for the services that have **Yes** in the **Service-Linked Role** column. Choose a **Yes** with a link to view the service-linked role documentation for that service. View the **Service-Linked Role Permissions** section for that service to view the service principal.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithPrincipal", jsii.invoke(self, "forService", [service]))

    @jsii.member(jsii_name="forUser")
    def for_user(
        self,
        account: builtins.str,
        user: builtins.str,
    ) -> "PolicyStatementWithPrincipal":
        '''(experimental) Adds an IAM user principal to the statement.

        :param account: ID of the AWS account.
        :param user: Name of the IAM user.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithPrincipal", jsii.invoke(self, "forUser", [account, user]))

    @jsii.member(jsii_name="hasPrincipals")
    def has_principals(self) -> builtins.bool:
        '''(experimental) Checks weather a principal was applied to the policy.

        :stability: experimental
        '''
        return typing.cast(builtins.bool, jsii.invoke(self, "hasPrincipals", []))

    @jsii.member(jsii_name="notPrincipals")
    def not_principals(self) -> "PolicyStatementWithPrincipal":
        '''(experimental) Switches the statement to use ```notPrincipal`` <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_notprincipal.html>`_.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithPrincipal", jsii.invoke(self, "notPrincipals", []))

    @jsii.member(jsii_name="toJSON")
    def to_json(self) -> typing.Any:
        '''(experimental) Injects principals into the statement.

        Only relevant for the main package. In CDK mode this only calls super.

        :stability: experimental
        '''
        return typing.cast(typing.Any, jsii.invoke(self, "toJSON", []))

    @jsii.member(jsii_name="toStatementJson")
    def to_statement_json(self) -> typing.Any:
        '''
        :stability: experimental
        '''
        return typing.cast(typing.Any, jsii.invoke(self, "toStatementJson", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="principals")
    def _principals(self) -> Principals:
        '''
        :stability: experimental
        '''
        return typing.cast(Principals, jsii.get(self, "principals"))

    @_principals.setter
    def _principals(self, value: Principals) -> None:
        jsii.set(self, "principals", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="useNotPrincipals")
    def _use_not_principals(self) -> builtins.bool:
        '''
        :stability: experimental
        '''
        return typing.cast(builtins.bool, jsii.get(self, "useNotPrincipals"))

    @_use_not_principals.setter
    def _use_not_principals(self, value: builtins.bool) -> None:
        jsii.set(self, "useNotPrincipals", value)


class PolicyStatement(
    PolicyStatementWithPrincipal,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.PolicyStatement",
):
    '''(experimental) Represents a statement in an IAM policy document.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''
        :param sid: -

        :stability: experimental
        '''
        jsii.create(PolicyStatement, self, [sid])

    @jsii.member(jsii_name="toJSON")
    def to_json(self) -> typing.Any:
        '''(experimental) JSON-ify the policy statement.

        :stability: experimental
        '''
        return typing.cast(typing.Any, jsii.invoke(self, "toJSON", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="cdkApplied")
    def _cdk_applied(self) -> builtins.bool:
        '''
        :stability: experimental
        '''
        return typing.cast(builtins.bool, jsii.get(self, "cdkApplied"))

    @_cdk_applied.setter
    def _cdk_applied(self, value: builtins.bool) -> None:
        jsii.set(self, "cdkApplied", value)


class Polly(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Polly"):
    '''(experimental) Statement provider for service `polly <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonpolly.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `polly <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonpolly.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Polly, self, [sid])

    @jsii.member(jsii_name="onLexicon")
    def on_lexicon(
        self,
        lexicon_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Polly":
        '''(experimental) Adds a resource of type lexicon to the statement.

        https://docs.aws.amazon.com/polly/latest/dg/managing-lexicons.html

        :param lexicon_name: - Identifier for the lexiconName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Polly", jsii.invoke(self, "onLexicon", [lexicon_name, account, region, partition]))

    @jsii.member(jsii_name="toDeleteLexicon")
    def to_delete_lexicon(self) -> "Polly":
        '''(experimental) Grants permissions to delete the specified pronunciation lexicon stored in an AWS Region.

        Access Level: Write

        https://docs.aws.amazon.com/polly/latest/dg/API_DeleteLexicon.html

        :stability: experimental
        '''
        return typing.cast("Polly", jsii.invoke(self, "toDeleteLexicon", []))

    @jsii.member(jsii_name="toDescribeVoices")
    def to_describe_voices(self) -> "Polly":
        '''(experimental) Grants permissions to describe the list of voices that are available for use when requesting speech synthesis.

        Access Level: List

        https://docs.aws.amazon.com/polly/latest/dg/API_DescribeVoices.html

        :stability: experimental
        '''
        return typing.cast("Polly", jsii.invoke(self, "toDescribeVoices", []))

    @jsii.member(jsii_name="toGetLexicon")
    def to_get_lexicon(self) -> "Polly":
        '''(experimental) Grants permissions to retrieve the content of the specified pronunciation lexicon stored in an AWS Region.

        Access Level: Read

        https://docs.aws.amazon.com/polly/latest/dg/API_GetLexicon.html

        :stability: experimental
        '''
        return typing.cast("Polly", jsii.invoke(self, "toGetLexicon", []))

    @jsii.member(jsii_name="toGetSpeechSynthesisTask")
    def to_get_speech_synthesis_task(self) -> "Polly":
        '''(experimental) Grants permissions to get information about specific speech synthesis task.

        Access Level: Read

        https://docs.aws.amazon.com/polly/latest/dg/API_GetSpeechSynthesisTask.html

        :stability: experimental
        '''
        return typing.cast("Polly", jsii.invoke(self, "toGetSpeechSynthesisTask", []))

    @jsii.member(jsii_name="toListLexicons")
    def to_list_lexicons(self) -> "Polly":
        '''(experimental) Grants permisions to list the pronunciation lexicons stored in an AWS Region.

        Access Level: List

        https://docs.aws.amazon.com/polly/latest/dg/API_ListLexicons.html

        :stability: experimental
        '''
        return typing.cast("Polly", jsii.invoke(self, "toListLexicons", []))

    @jsii.member(jsii_name="toListSpeechSynthesisTasks")
    def to_list_speech_synthesis_tasks(self) -> "Polly":
        '''(experimental) Grants permissions to list requested speech synthesis tasks.

        Access Level: List

        https://docs.aws.amazon.com/polly/latest/dg/API_ListSpeechSynthesisTasks.html

        :stability: experimental
        '''
        return typing.cast("Polly", jsii.invoke(self, "toListSpeechSynthesisTasks", []))

    @jsii.member(jsii_name="toPutLexicon")
    def to_put_lexicon(self) -> "Polly":
        '''(experimental) Grants permissions to store a pronunciation lexicon in an AWS Region.

        Access Level: Write

        https://docs.aws.amazon.com/polly/latest/dg/API_PutLexicon.html

        :stability: experimental
        '''
        return typing.cast("Polly", jsii.invoke(self, "toPutLexicon", []))

    @jsii.member(jsii_name="toStartSpeechSynthesisTask")
    def to_start_speech_synthesis_task(self) -> "Polly":
        '''(experimental) Grants permissions to synthesize long inputs to the provided S3 location.

        Access Level: Write

        Dependent actions:

        - s3:PutObject

        https://docs.aws.amazon.com/polly/latest/dg/API_StartSpeechSynthesisTask.html

        :stability: experimental
        '''
        return typing.cast("Polly", jsii.invoke(self, "toStartSpeechSynthesisTask", []))

    @jsii.member(jsii_name="toSynthesizeSpeech")
    def to_synthesize_speech(self) -> "Polly":
        '''(experimental) Grants permissions to synthesize speech.

        Access Level: Read

        https://docs.aws.amazon.com/polly/latest/dg/API_SynthesizeSpeech.html

        :stability: experimental
        '''
        return typing.cast("Polly", jsii.invoke(self, "toSynthesizeSpeech", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Pricing(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Pricing"):
    '''(experimental) Statement provider for service `pricing <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awspricelist.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `pricing <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awspricelist.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Pricing, self, [sid])

    @jsii.member(jsii_name="toDescribeServices")
    def to_describe_services(self) -> "Pricing":
        '''(experimental) Returns the service details for all (paginated) services (if serviceCode is not set) or service detail for a particular service (if given serviceCode).

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_DescribeServices.html

        :stability: experimental
        '''
        return typing.cast("Pricing", jsii.invoke(self, "toDescribeServices", []))

    @jsii.member(jsii_name="toGetAttributeValues")
    def to_get_attribute_values(self) -> "Pricing":
        '''(experimental) Returns all (paginated) possible values for a given attribute.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetAttributeValues.html

        :stability: experimental
        '''
        return typing.cast("Pricing", jsii.invoke(self, "toGetAttributeValues", []))

    @jsii.member(jsii_name="toGetProducts")
    def to_get_products(self) -> "Pricing":
        '''(experimental) Returns all matching products with given search criteria.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetProducts.html

        :stability: experimental
        '''
        return typing.cast("Pricing", jsii.invoke(self, "toGetProducts", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Profile(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Profile"):
    '''(experimental) Statement provider for service `profile <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonconnectcustomerprofiles.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `profile <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonconnectcustomerprofiles.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Profile, self, [sid])

    @jsii.member(jsii_name="onDomains")
    def on_domains(
        self,
        domain_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Profile":
        '''(experimental) Adds a resource of type domains to the statement.

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/

        :param domain_name: - Identifier for the domainName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "onDomains", [domain_name, account, region, partition]))

    @jsii.member(jsii_name="onIntegrations")
    def on_integrations(
        self,
        domain_name: builtins.str,
        uri: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Profile":
        '''(experimental) Adds a resource of type integrations to the statement.

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/

        :param domain_name: - Identifier for the domainName.
        :param uri: - Identifier for the uri.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "onIntegrations", [domain_name, uri, account, region, partition]))

    @jsii.member(jsii_name="onObjectTypes")
    def on_object_types(
        self,
        domain_name: builtins.str,
        object_type_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Profile":
        '''(experimental) Adds a resource of type object-types to the statement.

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/

        :param domain_name: - Identifier for the domainName.
        :param object_type_name: - Identifier for the objectTypeName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "onObjectTypes", [domain_name, object_type_name, account, region, partition]))

    @jsii.member(jsii_name="toAddProfileKey")
    def to_add_profile_key(self) -> "Profile":
        '''(experimental) Grants permission to add a profile key.

        Access Level: Write

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_AddProfileKey.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toAddProfileKey", []))

    @jsii.member(jsii_name="toCreateDomain")
    def to_create_domain(self) -> "Profile":
        '''(experimental) Grants permission to create a Domain.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_CreateDomain.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toCreateDomain", []))

    @jsii.member(jsii_name="toCreateProfile")
    def to_create_profile(self) -> "Profile":
        '''(experimental) Grants permission to create a profile in the domain.

        Access Level: Write

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_CreateProfile.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toCreateProfile", []))

    @jsii.member(jsii_name="toDeleteDomain")
    def to_delete_domain(self) -> "Profile":
        '''(experimental) Grants permission to delete a Domain.

        Access Level: Write

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_DeleteDomain.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toDeleteDomain", []))

    @jsii.member(jsii_name="toDeleteIntegration")
    def to_delete_integration(self) -> "Profile":
        '''(experimental) Grants permission to delete a integration in a domain.

        Access Level: Write

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_DeleteIntegration.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toDeleteIntegration", []))

    @jsii.member(jsii_name="toDeleteProfile")
    def to_delete_profile(self) -> "Profile":
        '''(experimental) Grants permission to delete a profile.

        Access Level: Write

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_DeleteProfile.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toDeleteProfile", []))

    @jsii.member(jsii_name="toDeleteProfileKey")
    def to_delete_profile_key(self) -> "Profile":
        '''(experimental) Grants permission to delete a profile key.

        Access Level: Write

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_DeleteProfileKey.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toDeleteProfileKey", []))

    @jsii.member(jsii_name="toDeleteProfileObject")
    def to_delete_profile_object(self) -> "Profile":
        '''(experimental) Grants permission to delete a profile object.

        Access Level: Write

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_DeleteProfileObject.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toDeleteProfileObject", []))

    @jsii.member(jsii_name="toDeleteProfileObjectType")
    def to_delete_profile_object_type(self) -> "Profile":
        '''(experimental) Grants permission to delete a specific profile object type in the domain.

        Access Level: Write

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_DeleteProfileObjectType.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toDeleteProfileObjectType", []))

    @jsii.member(jsii_name="toGetDomain")
    def to_get_domain(self) -> "Profile":
        '''(experimental) Grants permission to get a specific domain in an account.

        Access Level: Read

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_GetDomain.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toGetDomain", []))

    @jsii.member(jsii_name="toGetIntegration")
    def to_get_integration(self) -> "Profile":
        '''(experimental) Grants permission to get a specific integrations in a domain.

        Access Level: Read

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_GetIntegration.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toGetIntegration", []))

    @jsii.member(jsii_name="toGetProfileObjectType")
    def to_get_profile_object_type(self) -> "Profile":
        '''(experimental) Grants permission to get a specific profile object type in the domain.

        Access Level: Read

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_GetProfileObjectType.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toGetProfileObjectType", []))

    @jsii.member(jsii_name="toGetProfileObjectTypeTemplate")
    def to_get_profile_object_type_template(self) -> "Profile":
        '''(experimental) Grants permission to get a specific object type template.

        Access Level: Read

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_GetProfileObjectTypeTemplate.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toGetProfileObjectTypeTemplate", []))

    @jsii.member(jsii_name="toListAccountIntegrations")
    def to_list_account_integrations(self) -> "Profile":
        '''(experimental) Grants permission to list all the integrations in the account.

        Access Level: List

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_ListAccountIntegrations.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toListAccountIntegrations", []))

    @jsii.member(jsii_name="toListDomains")
    def to_list_domains(self) -> "Profile":
        '''(experimental) Grants permission to list all the domains in an account.

        Access Level: List

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_ListDomains.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toListDomains", []))

    @jsii.member(jsii_name="toListIntegrations")
    def to_list_integrations(self) -> "Profile":
        '''(experimental) Grants permission to list all the integrations in a specific domain.

        Access Level: List

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_ListIntegrations.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toListIntegrations", []))

    @jsii.member(jsii_name="toListProfileObjects")
    def to_list_profile_objects(self) -> "Profile":
        '''(experimental) Grants permission to list all the profile objects for a profile.

        Access Level: List

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_ListProfileObjects.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toListProfileObjects", []))

    @jsii.member(jsii_name="toListProfileObjectTypes")
    def to_list_profile_object_types(self) -> "Profile":
        '''(experimental) Grants permission to list all the profile object types in the domain.

        Access Level: List

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_ListProfileObjectTypes.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toListProfileObjectTypes", []))

    @jsii.member(jsii_name="toListProfileObjectTypeTemplates")
    def to_list_profile_object_type_templates(self) -> "Profile":
        '''(experimental) Grants permission to list all the profile object type templates in the account.

        Access Level: List

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_ListProfileObjectTypeTemplates.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toListProfileObjectTypeTemplates", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Profile":
        '''(experimental) Grants permission to list tags for a resource.

        Access Level: List

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutIntegration")
    def to_put_integration(self) -> "Profile":
        '''(experimental) Grants permission to put a integration in a domain.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_PutIntegration.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toPutIntegration", []))

    @jsii.member(jsii_name="toPutProfileObject")
    def to_put_profile_object(self) -> "Profile":
        '''(experimental) Grants permission to put an object for a profile.

        Access Level: Write

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_PutProfileObject.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toPutProfileObject", []))

    @jsii.member(jsii_name="toPutProfileObjectType")
    def to_put_profile_object_type(self) -> "Profile":
        '''(experimental) Grants permission to put a specific profile object type in the domain.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_PutProfileObjectType.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toPutProfileObjectType", []))

    @jsii.member(jsii_name="toSearchProfiles")
    def to_search_profiles(self) -> "Profile":
        '''(experimental) Grants permission to search for profiles in a domain.

        Access Level: Read

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_SearchProfiles.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toSearchProfiles", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Profile":
        '''(experimental) Grants permission to adds tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Profile":
        '''(experimental) Grants permission to remove tags from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateDomain")
    def to_update_domain(self) -> "Profile":
        '''(experimental) Grants permission to update a Domain.

        Access Level: Write

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_UpdateDomain.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toUpdateDomain", []))

    @jsii.member(jsii_name="toUpdateProfile")
    def to_update_profile(self) -> "Profile":
        '''(experimental) Grants permission to update a profile in the domain.

        Access Level: Write

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_UpdateProfile.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toUpdateProfile", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Proton(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Proton"):
    '''(experimental) Statement provider for service `proton <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsproton.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `proton <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsproton.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Proton, self, [sid])

    @jsii.member(jsii_name="onEnvironment")
    def on_environment(
        self,
        environment_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Proton":
        '''(experimental) Adds a resource of type environment to the statement.

        https://docs.aws.amazon.com/proton/latest/adminguide/ag-environments.html

        :param environment_name: - Identifier for the environmentName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "onEnvironment", [environment_name, account, region, partition]))

    @jsii.member(jsii_name="onEnvironmentTemplate")
    def on_environment_template(
        self,
        template_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Proton":
        '''(experimental) Adds a resource of type environment-template to the statement.

        https://docs.aws.amazon.com/proton/latest/adminguide/ag-env-templates.html

        :param template_name: - Identifier for the templateName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "onEnvironmentTemplate", [template_name, account, region, partition]))

    @jsii.member(jsii_name="onEnvironmentTemplateMajorVersion")
    def on_environment_template_major_version(
        self,
        template_name: builtins.str,
        major_version_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Proton":
        '''(experimental) Adds a resource of type environment-template-major-version to the statement.

        https://docs.aws.amazon.com/proton/latest/adminguide/ag-env-templates.html

        :param template_name: - Identifier for the templateName.
        :param major_version_id: - Identifier for the majorVersionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "onEnvironmentTemplateMajorVersion", [template_name, major_version_id, account, region, partition]))

    @jsii.member(jsii_name="onEnvironmentTemplateMinorVersion")
    def on_environment_template_minor_version(
        self,
        template_name: builtins.str,
        major_version_id: builtins.str,
        minor_version_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Proton":
        '''(experimental) Adds a resource of type environment-template-minor-version to the statement.

        https://docs.aws.amazon.com/proton/latest/adminguide/ag-env-templates.html

        :param template_name: - Identifier for the templateName.
        :param major_version_id: - Identifier for the majorVersionId.
        :param minor_version_id: - Identifier for the minorVersionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "onEnvironmentTemplateMinorVersion", [template_name, major_version_id, minor_version_id, account, region, partition]))

    @jsii.member(jsii_name="onService")
    def on_service(
        self,
        service_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Proton":
        '''(experimental) Adds a resource of type service to the statement.

        https://docs.aws.amazon.com/proton/latest/adminguide/ag-services.html

        :param service_name: - Identifier for the serviceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "onService", [service_name, account, region, partition]))

    @jsii.member(jsii_name="onServiceInstance")
    def on_service_instance(
        self,
        service_name: builtins.str,
        service_instance_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Proton":
        '''(experimental) Adds a resource of type service-instance to the statement.

        https://docs.aws.amazon.com/proton/latest/adminguide/ag-services.html

        :param service_name: - Identifier for the serviceName.
        :param service_instance_name: - Identifier for the serviceInstanceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "onServiceInstance", [service_name, service_instance_name, account, region, partition]))

    @jsii.member(jsii_name="onServiceTemplate")
    def on_service_template(
        self,
        template_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Proton":
        '''(experimental) Adds a resource of type service-template to the statement.

        https://docs.aws.amazon.com/proton/latest/adminguide/managing-svc-templates.html

        :param template_name: - Identifier for the templateName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "onServiceTemplate", [template_name, account, region, partition]))

    @jsii.member(jsii_name="onServiceTemplateMajorVersion")
    def on_service_template_major_version(
        self,
        template_name: builtins.str,
        major_version_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Proton":
        '''(experimental) Adds a resource of type service-template-major-version to the statement.

        https://docs.aws.amazon.com/proton/latest/adminguide/managing-svc-templates.html

        :param template_name: - Identifier for the templateName.
        :param major_version_id: - Identifier for the majorVersionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "onServiceTemplateMajorVersion", [template_name, major_version_id, account, region, partition]))

    @jsii.member(jsii_name="onServiceTemplateMinorVersion")
    def on_service_template_minor_version(
        self,
        template_name: builtins.str,
        major_version_id: builtins.str,
        minor_version_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Proton":
        '''(experimental) Adds a resource of type service-template-minor-version to the statement.

        https://docs.aws.amazon.com/proton/latest/adminguide/managing-svc-templates.html

        :param template_name: - Identifier for the templateName.
        :param major_version_id: - Identifier for the majorVersionId.
        :param minor_version_id: - Identifier for the minorVersionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "onServiceTemplateMinorVersion", [template_name, major_version_id, minor_version_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateEnvironment")
    def to_create_environment(self) -> "Proton":
        '''(experimental) Grants permission to create an environment.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/proton/latest/APIReference/API_CreateEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toCreateEnvironment", []))

    @jsii.member(jsii_name="toCreateEnvironmentTemplate")
    def to_create_environment_template(self) -> "Proton":
        '''(experimental) Grants permission to create an environment template.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/proton/latest/APIReference/API_CreateEnvironmentTemplate.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toCreateEnvironmentTemplate", []))

    @jsii.member(jsii_name="toCreateEnvironmentTemplateMajorVersion")
    def to_create_environment_template_major_version(self) -> "Proton":
        '''(experimental) Grants permission to create an environment template major version.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/proton/latest/APIReference/API_CreateEnvironmentTemplateMajorVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toCreateEnvironmentTemplateMajorVersion", []))

    @jsii.member(jsii_name="toCreateEnvironmentTemplateMinorVersion")
    def to_create_environment_template_minor_version(self) -> "Proton":
        '''(experimental) Grants permission to create an environment template minor version.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/proton/latest/APIReference/API_CreateEnvironmentTemplateMinorVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toCreateEnvironmentTemplateMinorVersion", []))

    @jsii.member(jsii_name="toCreateService")
    def to_create_service(self) -> "Proton":
        '''(experimental) Grants permission to create a service.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - codestar-connections:PassConnection

        https://docs.aws.amazon.com/proton/latest/APIReference/API_CreateService.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toCreateService", []))

    @jsii.member(jsii_name="toCreateServiceTemplate")
    def to_create_service_template(self) -> "Proton":
        '''(experimental) Grants permission to create a service template.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/proton/latest/APIReference/API_CreateServiceTemplate.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toCreateServiceTemplate", []))

    @jsii.member(jsii_name="toCreateServiceTemplateMajorVersion")
    def to_create_service_template_major_version(self) -> "Proton":
        '''(experimental) Grants permission to create a service template major version.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/proton/latest/APIReference/API_CreateServiceTemplateMajorVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toCreateServiceTemplateMajorVersion", []))

    @jsii.member(jsii_name="toCreateServiceTemplateMinorVersion")
    def to_create_service_template_minor_version(self) -> "Proton":
        '''(experimental) Grants permission to create a service template minor version.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/proton/latest/APIReference/API_CreateServiceTemplateMinorVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toCreateServiceTemplateMinorVersion", []))

    @jsii.member(jsii_name="toDeleteAccountRoles")
    def to_delete_account_roles(self) -> "Proton":
        '''(experimental) Grants permission to delete the account role settings.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_DeleteAccountRoles.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toDeleteAccountRoles", []))

    @jsii.member(jsii_name="toDeleteEnvironment")
    def to_delete_environment(self) -> "Proton":
        '''(experimental) Grants permission to delete an environment.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_DeleteEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toDeleteEnvironment", []))

    @jsii.member(jsii_name="toDeleteEnvironmentTemplate")
    def to_delete_environment_template(self) -> "Proton":
        '''(experimental) Grants permission to delete an environment template.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_DeleteEnvironmentTemplate.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toDeleteEnvironmentTemplate", []))

    @jsii.member(jsii_name="toDeleteEnvironmentTemplateMajorVersion")
    def to_delete_environment_template_major_version(self) -> "Proton":
        '''(experimental) Grants permission to delete an environment template major version.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_DeleteEnvironmentTemplateMajorVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toDeleteEnvironmentTemplateMajorVersion", []))

    @jsii.member(jsii_name="toDeleteEnvironmentTemplateMinorVersion")
    def to_delete_environment_template_minor_version(self) -> "Proton":
        '''(experimental) Grants permission to delete an environment template minor version.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_DeleteEnvironmentTemplateMinorVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toDeleteEnvironmentTemplateMinorVersion", []))

    @jsii.member(jsii_name="toDeleteService")
    def to_delete_service(self) -> "Proton":
        '''(experimental) Grants permission to delete a service.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_DeleteService.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toDeleteService", []))

    @jsii.member(jsii_name="toDeleteServiceTemplate")
    def to_delete_service_template(self) -> "Proton":
        '''(experimental) Grants permission to delete a service template.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_DeleteServiceTemplate.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toDeleteServiceTemplate", []))

    @jsii.member(jsii_name="toDeleteServiceTemplateMajorVersion")
    def to_delete_service_template_major_version(self) -> "Proton":
        '''(experimental) Grants permission to delete a service template major version.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_DeleteServiceTemplateMajorVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toDeleteServiceTemplateMajorVersion", []))

    @jsii.member(jsii_name="toDeleteServiceTemplateMinorVersion")
    def to_delete_service_template_minor_version(self) -> "Proton":
        '''(experimental) Grants permission to delete a service template minor version.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_DeleteServiceTemplateMinorVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toDeleteServiceTemplateMinorVersion", []))

    @jsii.member(jsii_name="toGetAccountRoles")
    def to_get_account_roles(self) -> "Proton":
        '''(experimental) Grants permission to describe the account role settings.

        Access Level: Read

        https://docs.aws.amazon.com/proton/latest/APIReference/API_GetAccountRoles.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toGetAccountRoles", []))

    @jsii.member(jsii_name="toGetEnvironment")
    def to_get_environment(self) -> "Proton":
        '''(experimental) Grants permission to describe an environment.

        Access Level: Read

        https://docs.aws.amazon.com/proton/latest/APIReference/API_GetEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toGetEnvironment", []))

    @jsii.member(jsii_name="toGetEnvironmentTemplate")
    def to_get_environment_template(self) -> "Proton":
        '''(experimental) Grants permission to describe an environment template.

        Access Level: Read

        https://docs.aws.amazon.com/proton/latest/APIReference/API_GetEnvironmentTemplate.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toGetEnvironmentTemplate", []))

    @jsii.member(jsii_name="toGetEnvironmentTemplateMajorVersion")
    def to_get_environment_template_major_version(self) -> "Proton":
        '''(experimental) Grants permission to describe an environment template major version.

        Access Level: Read

        https://docs.aws.amazon.com/proton/latest/APIReference/API_GetEnvironmentTemplateMajorVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toGetEnvironmentTemplateMajorVersion", []))

    @jsii.member(jsii_name="toGetEnvironmentTemplateMinorVersion")
    def to_get_environment_template_minor_version(self) -> "Proton":
        '''(experimental) Grants permission to describe an environment template minor version.

        Access Level: Read

        https://docs.aws.amazon.com/proton/latest/APIReference/API_GetEnvironmentTemplateMinorVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toGetEnvironmentTemplateMinorVersion", []))

    @jsii.member(jsii_name="toGetService")
    def to_get_service(self) -> "Proton":
        '''(experimental) Grants permission to describe a service.

        Access Level: Read

        https://docs.aws.amazon.com/proton/latest/APIReference/API_GetService.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toGetService", []))

    @jsii.member(jsii_name="toGetServiceInstance")
    def to_get_service_instance(self) -> "Proton":
        '''(experimental) Grants permission to describe a service instance.

        Access Level: Read

        https://docs.aws.amazon.com/proton/latest/APIReference/API_GetServiceInstance.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toGetServiceInstance", []))

    @jsii.member(jsii_name="toGetServiceTemplate")
    def to_get_service_template(self) -> "Proton":
        '''(experimental) Grants permission to describe a service template.

        Access Level: Read

        https://docs.aws.amazon.com/proton/latest/APIReference/API_GetServiceTemplate.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toGetServiceTemplate", []))

    @jsii.member(jsii_name="toGetServiceTemplateMajorVersion")
    def to_get_service_template_major_version(self) -> "Proton":
        '''(experimental) Grants permission to describe a service template major version.

        Access Level: Read

        https://docs.aws.amazon.com/proton/latest/APIReference/API_GetServiceTemplateMajorVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toGetServiceTemplateMajorVersion", []))

    @jsii.member(jsii_name="toGetServiceTemplateMinorVersion")
    def to_get_service_template_minor_version(self) -> "Proton":
        '''(experimental) Grants permission to describe a service template minor version.

        Access Level: Read

        https://docs.aws.amazon.com/proton/latest/APIReference/API_GetServiceTemplateMinorVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toGetServiceTemplateMinorVersion", []))

    @jsii.member(jsii_name="toListEnvironments")
    def to_list_environments(self) -> "Proton":
        '''(experimental) Grants permission to list environments.

        Access Level: List

        https://docs.aws.amazon.com/proton/latest/APIReference/API_ListEnvironments.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toListEnvironments", []))

    @jsii.member(jsii_name="toListEnvironmentTemplateMajorVersions")
    def to_list_environment_template_major_versions(self) -> "Proton":
        '''(experimental) Grants permission to list environment template major versions.

        Access Level: List

        https://docs.aws.amazon.com/proton/latest/APIReference/API_ListEnvironmentTemplateMajorVersions.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toListEnvironmentTemplateMajorVersions", []))

    @jsii.member(jsii_name="toListEnvironmentTemplateMinorVersions")
    def to_list_environment_template_minor_versions(self) -> "Proton":
        '''(experimental) Grants permission to list environment template minor versions.

        Access Level: List

        https://docs.aws.amazon.com/proton/latest/APIReference/API_ListEnvironmentTemplateMinorVersions.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toListEnvironmentTemplateMinorVersions", []))

    @jsii.member(jsii_name="toListEnvironmentTemplates")
    def to_list_environment_templates(self) -> "Proton":
        '''(experimental) Grants permission to list environment templates.

        Access Level: List

        https://docs.aws.amazon.com/proton/latest/APIReference/API_ListEnvironmentTemplates.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toListEnvironmentTemplates", []))

    @jsii.member(jsii_name="toListServiceInstances")
    def to_list_service_instances(self) -> "Proton":
        '''(experimental) Grants permission to list service instances.

        Access Level: List

        https://docs.aws.amazon.com/proton/latest/APIReference/API_ListServiceInstances.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toListServiceInstances", []))

    @jsii.member(jsii_name="toListServices")
    def to_list_services(self) -> "Proton":
        '''(experimental) Grants permission to list services.

        Access Level: List

        https://docs.aws.amazon.com/proton/latest/APIReference/API_ListServices.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toListServices", []))

    @jsii.member(jsii_name="toListServiceTemplateMajorVersions")
    def to_list_service_template_major_versions(self) -> "Proton":
        '''(experimental) Grants permission to list service template major versions.

        Access Level: List

        https://docs.aws.amazon.com/proton/latest/APIReference/API_ListServiceTemplateMajorVersions.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toListServiceTemplateMajorVersions", []))

    @jsii.member(jsii_name="toListServiceTemplateMinorVersions")
    def to_list_service_template_minor_versions(self) -> "Proton":
        '''(experimental) Grants permission to list service template minor versions.

        Access Level: List

        https://docs.aws.amazon.com/proton/latest/APIReference/API_ListServiceTemplateMinorVersions.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toListServiceTemplateMinorVersions", []))

    @jsii.member(jsii_name="toListServiceTemplates")
    def to_list_service_templates(self) -> "Proton":
        '''(experimental) Grants permission to list service templates.

        Access Level: List

        https://docs.aws.amazon.com/proton/latest/APIReference/API_ListServiceTemplates.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toListServiceTemplates", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Proton":
        '''(experimental) Grants permissions to list tags of a resource.

        Access Level: Read

        https://docs.aws.amazon.com/proton/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Proton":
        '''(experimental) Grants permissions to add tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/proton/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Proton":
        '''(experimental) Grants permissions to remove tags from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/proton/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAccountRoles")
    def to_update_account_roles(self) -> "Proton":
        '''(experimental) Grants permission to update the account role settings.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/proton/latest/APIReference/API_UpdateAccountRoles.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toUpdateAccountRoles", []))

    @jsii.member(jsii_name="toUpdateEnvironment")
    def to_update_environment(self) -> "Proton":
        '''(experimental) Grants permission to update an environment.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/proton/latest/APIReference/API_UpdateEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toUpdateEnvironment", []))

    @jsii.member(jsii_name="toUpdateEnvironmentTemplate")
    def to_update_environment_template(self) -> "Proton":
        '''(experimental) Grants permission to update an environment template.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_UpdateEnvironmentTemplate.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toUpdateEnvironmentTemplate", []))

    @jsii.member(jsii_name="toUpdateEnvironmentTemplateMajorVersion")
    def to_update_environment_template_major_version(self) -> "Proton":
        '''(experimental) Grants permission to update an environment template major version.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_UpdateEnvironmentTemplateMajorVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toUpdateEnvironmentTemplateMajorVersion", []))

    @jsii.member(jsii_name="toUpdateEnvironmentTemplateMinorVersion")
    def to_update_environment_template_minor_version(self) -> "Proton":
        '''(experimental) Grants permission to update an environment template minor version.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_UpdateEnvironmentTemplateMinorVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toUpdateEnvironmentTemplateMinorVersion", []))

    @jsii.member(jsii_name="toUpdateService")
    def to_update_service(self) -> "Proton":
        '''(experimental) Grants permission to update a service.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_UpdateService.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toUpdateService", []))

    @jsii.member(jsii_name="toUpdateServiceInstance")
    def to_update_service_instance(self) -> "Proton":
        '''(experimental) Grants permission to update a service instance.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_UpdateServiceInstance.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toUpdateServiceInstance", []))

    @jsii.member(jsii_name="toUpdateServicePipeline")
    def to_update_service_pipeline(self) -> "Proton":
        '''(experimental) Grants permission to update a service pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_UpdateServicePipeline.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toUpdateServicePipeline", []))

    @jsii.member(jsii_name="toUpdateServiceTemplate")
    def to_update_service_template(self) -> "Proton":
        '''(experimental) Grants permission to update a service template.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_UpdateServiceTemplate.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toUpdateServiceTemplate", []))

    @jsii.member(jsii_name="toUpdateServiceTemplateMajorVersion")
    def to_update_service_template_major_version(self) -> "Proton":
        '''(experimental) Grants permission to update a service template major version.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_UpdateServiceTemplateMajorVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toUpdateServiceTemplateMajorVersion", []))

    @jsii.member(jsii_name="toUpdateServiceTemplateMinorVersion")
    def to_update_service_template_minor_version(self) -> "Proton":
        '''(experimental) Grants permission to update a service template minor version.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_UpdateServiceTemplateMinorVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toUpdateServiceTemplateMinorVersion", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class PurchaseOrders(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.PurchaseOrders",
):
    '''(experimental) Statement provider for service `purchase-orders <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awspurchaseordersconsole.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `purchase-orders <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awspurchaseordersconsole.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(PurchaseOrders, self, [sid])

    @jsii.member(jsii_name="toModifyPurchaseOrders")
    def to_modify_purchase_orders(self) -> "PurchaseOrders":
        '''(experimental) Modify purchase orders and details.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("PurchaseOrders", jsii.invoke(self, "toModifyPurchaseOrders", []))

    @jsii.member(jsii_name="toViewPurchaseOrders")
    def to_view_purchase_orders(self) -> "PurchaseOrders":
        '''(experimental) View purchase orders and details.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("PurchaseOrders", jsii.invoke(self, "toViewPurchaseOrders", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Qldb(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Qldb"):
    '''(experimental) Statement provider for service `qldb <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonqldb.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `qldb <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonqldb.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Qldb, self, [sid])

    @jsii.member(jsii_name="onLedger")
    def on_ledger(
        self,
        ledger_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Qldb":
        '''(experimental) Adds a resource of type ledger to the statement.

        https://docs.aws.amazon.com/qldb/latest/developerguide/what-is.html

        :param ledger_name: - Identifier for the ledgerName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "onLedger", [ledger_name, account, region, partition]))

    @jsii.member(jsii_name="onStream")
    def on_stream(
        self,
        ledger_name: builtins.str,
        stream_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Qldb":
        '''(experimental) Adds a resource of type stream to the statement.

        https://docs.aws.amazon.com/qldb/latest/developerguide/what-is.html

        :param ledger_name: - Identifier for the ledgerName.
        :param stream_id: - Identifier for the streamId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "onStream", [ledger_name, stream_id, account, region, partition]))

    @jsii.member(jsii_name="toCancelJournalKinesisStream")
    def to_cancel_journal_kinesis_stream(self) -> "Qldb":
        '''(experimental) Grants permission to cancel a journal kinesis stream.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_CancelJournalKinesisStream.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toCancelJournalKinesisStream", []))

    @jsii.member(jsii_name="toCreateLedger")
    def to_create_ledger(self) -> "Qldb":
        '''(experimental) Grants permission to create a ledger.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_CreateLedger.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toCreateLedger", []))

    @jsii.member(jsii_name="toDeleteLedger")
    def to_delete_ledger(self) -> "Qldb":
        '''(experimental) Grants permission to delete a ledger.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_DeleteLedger.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toDeleteLedger", []))

    @jsii.member(jsii_name="toDescribeJournalKinesisStream")
    def to_describe_journal_kinesis_stream(self) -> "Qldb":
        '''(experimental) Grants permission to describe information about a journal kinesis stream.

        Access Level: Read

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_DescribeJournalKinesisStream.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toDescribeJournalKinesisStream", []))

    @jsii.member(jsii_name="toDescribeJournalS3Export")
    def to_describe_journal_s3_export(self) -> "Qldb":
        '''(experimental) Grants permission to describe information about a journal export job.

        Access Level: Read

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_DescribeJournalS3Export.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toDescribeJournalS3Export", []))

    @jsii.member(jsii_name="toDescribeLedger")
    def to_describe_ledger(self) -> "Qldb":
        '''(experimental) Grants permission to describe a ledger.

        Access Level: Read

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_DescribeLedger.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toDescribeLedger", []))

    @jsii.member(jsii_name="toExecuteStatement")
    def to_execute_statement(self) -> "Qldb":
        '''(experimental) Grants permission to send commands to a ledger via the console.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/console_QLDB.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toExecuteStatement", []))

    @jsii.member(jsii_name="toExportJournalToS3")
    def to_export_journal_to_s3(self) -> "Qldb":
        '''(experimental) Grants permission to export journal contents to an Amazon S3 bucket.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_ExportJournalToS3.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toExportJournalToS3", []))

    @jsii.member(jsii_name="toGetBlock")
    def to_get_block(self) -> "Qldb":
        '''(experimental) Grants permission to retrieve a block from a ledger for a given BlockAddress.

        Access Level: Read

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_GetBlock.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toGetBlock", []))

    @jsii.member(jsii_name="toGetDigest")
    def to_get_digest(self) -> "Qldb":
        '''(experimental) Grants permission to retrieve a digest from a ledger for a given BlockAddress.

        Access Level: Read

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_GetDigest.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toGetDigest", []))

    @jsii.member(jsii_name="toGetRevision")
    def to_get_revision(self) -> "Qldb":
        '''(experimental) Grants permission to retrieve a revision for a given document ID and a given BlockAddress.

        Access Level: Read

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_GetRevision.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toGetRevision", []))

    @jsii.member(jsii_name="toInsertSampleData")
    def to_insert_sample_data(self) -> "Qldb":
        '''(experimental) Grants permission to insert sample application data via the console.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/console_QLDB.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toInsertSampleData", []))

    @jsii.member(jsii_name="toListJournalKinesisStreamsForLedger")
    def to_list_journal_kinesis_streams_for_ledger(self) -> "Qldb":
        '''(experimental) Grants permission to list journal kinesis streams for a specified ledger.

        Access Level: List

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_ListJournalKinesisStreamsForLedger.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toListJournalKinesisStreamsForLedger", []))

    @jsii.member(jsii_name="toListJournalS3Exports")
    def to_list_journal_s3_exports(self) -> "Qldb":
        '''(experimental) Grants permission to list journal export jobs for all ledgers.

        Access Level: List

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_ListJournalS3Exports.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toListJournalS3Exports", []))

    @jsii.member(jsii_name="toListJournalS3ExportsForLedger")
    def to_list_journal_s3_exports_for_ledger(self) -> "Qldb":
        '''(experimental) Grants permission to list journal export jobs for a specified ledger.

        Access Level: List

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_ListJournalS3ExportsForLedger.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toListJournalS3ExportsForLedger", []))

    @jsii.member(jsii_name="toListLedgers")
    def to_list_ledgers(self) -> "Qldb":
        '''(experimental) Grants permission to list existing ledgers.

        Access Level: List

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_ListLedgers.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toListLedgers", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Qldb":
        '''(experimental) Grants permission to list tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toSendCommand")
    def to_send_command(self) -> "Qldb":
        '''(experimental) Grants permission to send commands to a ledger.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/Using.API.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toSendCommand", []))

    @jsii.member(jsii_name="toShowCatalog")
    def to_show_catalog(self) -> "Qldb":
        '''(experimental) Grants permission to view a ledger's catalog via the console.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/console_QLDB.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toShowCatalog", []))

    @jsii.member(jsii_name="toStreamJournalToKinesis")
    def to_stream_journal_to_kinesis(self) -> "Qldb":
        '''(experimental) Grants permission to stream journal contents to a Kinesis Data Stream.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_StreamJournalToKinesis.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toStreamJournalToKinesis", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Qldb":
        '''(experimental) Grants permission to add one or more tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Qldb":
        '''(experimental) Grants permission to remove one or more tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateLedger")
    def to_update_ledger(self) -> "Qldb":
        '''(experimental) Grants permission to update properties on a ledger.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_UpdateLedger.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toUpdateLedger", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Quicksight(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Quicksight",
):
    '''(experimental) Statement provider for service `quicksight <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonquicksight.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `quicksight <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonquicksight.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Quicksight, self, [sid])

    @jsii.member(jsii_name="ifIamArn")
    def if_iam_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Quicksight":
        '''(experimental) Filters access by IAM user or role ARN.

        https://docs.aws.amazon.com/quicksight/latest/user/iam-actions.html

        Applies to actions:

        - .toRegisterUser()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "ifIamArn", [value, operator]))

    @jsii.member(jsii_name="ifSessionName")
    def if_session_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Quicksight":
        '''(experimental) Filters access by session name.

        https://docs.aws.amazon.com/quicksight/latest/user/iam-actions.html

        Applies to actions:

        - .toRegisterUser()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "ifSessionName", [value, operator]))

    @jsii.member(jsii_name="ifUserName")
    def if_user_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Quicksight":
        '''(experimental) Filters access by user name.

        https://docs.aws.amazon.com/quicksight/latest/user/iam-actions.html

        Applies to actions:

        - .toCreateGroupMembership()
        - .toDeleteGroupMembership()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "ifUserName", [value, operator]))

    @jsii.member(jsii_name="onAnalysis")
    def on_analysis(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Quicksight":
        '''(experimental) Adds a resource of type analysis to the statement.

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_Analysis.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "onAnalysis", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onAssignment")
    def on_assignment(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Quicksight":
        '''(experimental) Adds a resource of type assignment to the statement.

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_IAMPolicyAssignment.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "onAssignment", [resource_id, account, partition]))

    @jsii.member(jsii_name="onCustomization")
    def on_customization(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Quicksight":
        '''(experimental) Adds a resource of type customization to the statement.

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_AccountCustomization.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "onCustomization", [resource_id, account, partition]))

    @jsii.member(jsii_name="onDashboard")
    def on_dashboard(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Quicksight":
        '''(experimental) Adds a resource of type dashboard to the statement.

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_Dashboard.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "onDashboard", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onDataset")
    def on_dataset(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Quicksight":
        '''(experimental) Adds a resource of type dataset to the statement.

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DataSet.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "onDataset", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onDatasource")
    def on_datasource(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Quicksight":
        '''(experimental) Adds a resource of type datasource to the statement.

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DataSource.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "onDatasource", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onGroup")
    def on_group(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Quicksight":
        '''(experimental) Adds a resource of type group to the statement.

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_Group.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "onGroup", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onIngestion")
    def on_ingestion(
        self,
        dataset_id: builtins.str,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Quicksight":
        '''(experimental) Adds a resource of type ingestion to the statement.

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_Ingestion.html

        :param dataset_id: - Identifier for the datasetId.
        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "onIngestion", [dataset_id, resource_id, account, region, partition]))

    @jsii.member(jsii_name="onNamespace")
    def on_namespace(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Quicksight":
        '''(experimental) Adds a resource of type namespace to the statement.

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_Namespace.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "onNamespace", [resource_id, account, partition]))

    @jsii.member(jsii_name="onTemplate")
    def on_template(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Quicksight":
        '''(experimental) Adds a resource of type template to the statement.

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_Template.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "onTemplate", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onTheme")
    def on_theme(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Quicksight":
        '''(experimental) Adds a resource of type theme to the statement.

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_Theme.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "onTheme", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onUser")
    def on_user(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Quicksight":
        '''(experimental) Adds a resource of type user to the statement.

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_User.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "onUser", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toCancelIngestion")
    def to_cancel_ingestion(self) -> "Quicksight":
        '''(experimental) Grants permission to cancel a SPICE ingestions on a dataset.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CancelIngestion.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCancelIngestion", []))

    @jsii.member(jsii_name="toCreateAccountCustomization")
    def to_create_account_customization(self) -> "Quicksight":
        '''(experimental) Grants permission to create an account customization for QuickSight account or namespace.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CreateAccountCustomization.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateAccountCustomization", []))

    @jsii.member(jsii_name="toCreateAdmin")
    def to_create_admin(self) -> "Quicksight":
        '''(experimental) Grants permission to provision Amazon QuickSight administrators, authors, and readers.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/user/iam-actions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateAdmin", []))

    @jsii.member(jsii_name="toCreateAnalysis")
    def to_create_analysis(self) -> "Quicksight":
        '''(experimental) Grants permission to create an analysis from a template.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CreateAnalysis.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateAnalysis", []))

    @jsii.member(jsii_name="toCreateCustomPermissions")
    def to_create_custom_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to create a custom permissions resource for restricting user access.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/user/iam-actions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateCustomPermissions", []))

    @jsii.member(jsii_name="toCreateDashboard")
    def to_create_dashboard(self) -> "Quicksight":
        '''(experimental) Grants permission to create a QuickSight Dashboard.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CreateDashboard.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateDashboard", []))

    @jsii.member(jsii_name="toCreateDataSet")
    def to_create_data_set(self) -> "Quicksight":
        '''(experimental) Grants permission to create a dataset.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - quicksight:PassDataSource

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CreateDataSet.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateDataSet", []))

    @jsii.member(jsii_name="toCreateDataSource")
    def to_create_data_source(self) -> "Quicksight":
        '''(experimental) Grants permission to create a data source.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CreateDataSource.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateDataSource", []))

    @jsii.member(jsii_name="toCreateGroup")
    def to_create_group(self) -> "Quicksight":
        '''(experimental) Grants permission to create a QuickSight group.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CreateGroup.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateGroup", []))

    @jsii.member(jsii_name="toCreateGroupMembership")
    def to_create_group_membership(self) -> "Quicksight":
        '''(experimental) Grants permission to add a QuickSight user to a QuickSight group.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CreateGroupMembership.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateGroupMembership", []))

    @jsii.member(jsii_name="toCreateIAMPolicyAssignment")
    def to_create_iam_policy_assignment(self) -> "Quicksight":
        '''(experimental) Grants permission to create an assignment with one specified IAM Policy ARN that will be assigned to specified groups or users of QuickSight.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CreateIAMPolicyAssignment.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateIAMPolicyAssignment", []))

    @jsii.member(jsii_name="toCreateIngestion")
    def to_create_ingestion(self) -> "Quicksight":
        '''(experimental) Grants permission to start a SPICE ingestion on a dataset.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CreateIngestion.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateIngestion", []))

    @jsii.member(jsii_name="toCreateNamespace")
    def to_create_namespace(self) -> "Quicksight":
        '''(experimental) Grants permission to create an QuickSight namespace.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CreateNamespace.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateNamespace", []))

    @jsii.member(jsii_name="toCreateReader")
    def to_create_reader(self) -> "Quicksight":
        '''(experimental) Grants permission to provision Amazon QuickSight readers.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/user/iam-actions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateReader", []))

    @jsii.member(jsii_name="toCreateTemplate")
    def to_create_template(self) -> "Quicksight":
        '''(experimental) Grants permission to create a template.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CreateTemplate.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateTemplate", []))

    @jsii.member(jsii_name="toCreateTemplateAlias")
    def to_create_template_alias(self) -> "Quicksight":
        '''(experimental) Grants permission to create a template alias.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CreateTemplateAlias.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateTemplateAlias", []))

    @jsii.member(jsii_name="toCreateTheme")
    def to_create_theme(self) -> "Quicksight":
        '''(experimental) Grant permission to create a theme.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CreateTheme.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateTheme", []))

    @jsii.member(jsii_name="toCreateThemeAlias")
    def to_create_theme_alias(self) -> "Quicksight":
        '''(experimental) Grants permission to create an alias for a theme version.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CreateThemeAlias.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateThemeAlias", []))

    @jsii.member(jsii_name="toCreateUser")
    def to_create_user(self) -> "Quicksight":
        '''(experimental) Grants permission to provision Amazon QuickSight authors and readers.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/user/iam-actions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateUser", []))

    @jsii.member(jsii_name="toCreateVPCConnection")
    def to_create_vpc_connection(self) -> "Quicksight":
        '''(experimental) Grants permission to create a VPC connection.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/user/vpc-creating-a-connection-in-quicksight.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateVPCConnection", []))

    @jsii.member(jsii_name="toDeleteAccountCustomization")
    def to_delete_account_customization(self) -> "Quicksight":
        '''(experimental) Grants permission to delete an account customization for QuickSight account or namespace.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteAccountCustomization.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteAccountCustomization", []))

    @jsii.member(jsii_name="toDeleteAnalysis")
    def to_delete_analysis(self) -> "Quicksight":
        '''(experimental) Grants permissions to delete an analysis.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteAnalysis.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteAnalysis", []))

    @jsii.member(jsii_name="toDeleteCustomPermissions")
    def to_delete_custom_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to delete a custom permissions resource.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/user/iam-actions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteCustomPermissions", []))

    @jsii.member(jsii_name="toDeleteDashboard")
    def to_delete_dashboard(self) -> "Quicksight":
        '''(experimental) Grants permission to delete a QuickSight Dashboard.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteDashboard.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteDashboard", []))

    @jsii.member(jsii_name="toDeleteDataSet")
    def to_delete_data_set(self) -> "Quicksight":
        '''(experimental) Grants permission to delete a dataset.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteDataSet.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteDataSet", []))

    @jsii.member(jsii_name="toDeleteDataSource")
    def to_delete_data_source(self) -> "Quicksight":
        '''(experimental) Grants permission to delete a data source.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteDataSource.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteDataSource", []))

    @jsii.member(jsii_name="toDeleteGroup")
    def to_delete_group(self) -> "Quicksight":
        '''(experimental) Grants permission to remove a user group from QuickSight.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteGroup.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteGroup", []))

    @jsii.member(jsii_name="toDeleteGroupMembership")
    def to_delete_group_membership(self) -> "Quicksight":
        '''(experimental) Grants permission to remove a user from a group so that he/she is no longer a member of the group.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteGroupMembership.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteGroupMembership", []))

    @jsii.member(jsii_name="toDeleteIAMPolicyAssignment")
    def to_delete_iam_policy_assignment(self) -> "Quicksight":
        '''(experimental) Grants permission to update an existing assignment.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteIAMPolicyAssignment.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteIAMPolicyAssignment", []))

    @jsii.member(jsii_name="toDeleteNamespace")
    def to_delete_namespace(self) -> "Quicksight":
        '''(experimental) Grants permission to delete a QuickSight namespace.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteNamespace.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteNamespace", []))

    @jsii.member(jsii_name="toDeleteTemplate")
    def to_delete_template(self) -> "Quicksight":
        '''(experimental) Grants permission to delete a template.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteTemplate.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteTemplate", []))

    @jsii.member(jsii_name="toDeleteTemplateAlias")
    def to_delete_template_alias(self) -> "Quicksight":
        '''(experimental) Grants permission to delete a template alias.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteTemplateAlias.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteTemplateAlias", []))

    @jsii.member(jsii_name="toDeleteTheme")
    def to_delete_theme(self) -> "Quicksight":
        '''(experimental) Grants permission to delete a theme.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteTheme.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteTheme", []))

    @jsii.member(jsii_name="toDeleteThemeAlias")
    def to_delete_theme_alias(self) -> "Quicksight":
        '''(experimental) Grants permission to delete the alias of a theme.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteThemeAlias.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteThemeAlias", []))

    @jsii.member(jsii_name="toDeleteUser")
    def to_delete_user(self) -> "Quicksight":
        '''(experimental) Grants permission to delete a QuickSight user, given the user name.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteUser.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteUser", []))

    @jsii.member(jsii_name="toDeleteUserByPrincipalId")
    def to_delete_user_by_principal_id(self) -> "Quicksight":
        '''(experimental) Grants permission to deletes a user identified by its principal ID.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteUserByPrincipalId.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteUserByPrincipalId", []))

    @jsii.member(jsii_name="toDeleteVPCConnection")
    def to_delete_vpc_connection(self) -> "Quicksight":
        '''(experimental) Grants permission to delete a VPC connection.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/user/vpc-creating-a-connection-in-quicksight.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteVPCConnection", []))

    @jsii.member(jsii_name="toDescribeAccountCustomization")
    def to_describe_account_customization(self) -> "Quicksight":
        '''(experimental) Grants permission to describe an account customization for QuickSight account or namespace.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeAccountCustomization.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeAccountCustomization", []))

    @jsii.member(jsii_name="toDescribeAccountSettings")
    def to_describe_account_settings(self) -> "Quicksight":
        '''(experimental) Grants permission to describe the administrative account settings for QuickSight account.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeAccountSettings.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeAccountSettings", []))

    @jsii.member(jsii_name="toDescribeAnalysis")
    def to_describe_analysis(self) -> "Quicksight":
        '''(experimental) Grants permission to describe an analysis.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeAnalysis.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeAnalysis", []))

    @jsii.member(jsii_name="toDescribeAnalysisPermissions")
    def to_describe_analysis_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to describe permissions for an analysis.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeAnalysisPermissions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeAnalysisPermissions", []))

    @jsii.member(jsii_name="toDescribeCustomPermissions")
    def to_describe_custom_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to describe a custom permissions resource in a QuickSight account.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/user/iam-actions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeCustomPermissions", []))

    @jsii.member(jsii_name="toDescribeDashboard")
    def to_describe_dashboard(self) -> "Quicksight":
        '''(experimental) Grants permission to describe a QuickSight Dashboard.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeDashboard.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeDashboard", []))

    @jsii.member(jsii_name="toDescribeDashboardPermissions")
    def to_describe_dashboard_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to describe permissions for a QuickSight Dashboard.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeDashboardPermissions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeDashboardPermissions", []))

    @jsii.member(jsii_name="toDescribeDataSet")
    def to_describe_data_set(self) -> "Quicksight":
        '''(experimental) Grants permission to describe a dataset.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeDataSet.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeDataSet", []))

    @jsii.member(jsii_name="toDescribeDataSetPermissions")
    def to_describe_data_set_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to describe the resource policy of a dataset.

        Access Level: Permissions management

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeDataSetPermissions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeDataSetPermissions", []))

    @jsii.member(jsii_name="toDescribeDataSource")
    def to_describe_data_source(self) -> "Quicksight":
        '''(experimental) Grants permission to describe a data source.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeDataSource.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeDataSource", []))

    @jsii.member(jsii_name="toDescribeDataSourcePermissions")
    def to_describe_data_source_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to describe the resource policy of a data source.

        Access Level: Permissions management

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeDataSourcePermissions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeDataSourcePermissions", []))

    @jsii.member(jsii_name="toDescribeGroup")
    def to_describe_group(self) -> "Quicksight":
        '''(experimental) Grants permission to describe a QuickSight group.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeGroup.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeGroup", []))

    @jsii.member(jsii_name="toDescribeIAMPolicyAssignment")
    def to_describe_iam_policy_assignment(self) -> "Quicksight":
        '''(experimental) Grants permission to describe an existing assignment.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeIAMPolicyAssignment.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeIAMPolicyAssignment", []))

    @jsii.member(jsii_name="toDescribeIngestion")
    def to_describe_ingestion(self) -> "Quicksight":
        '''(experimental) Grants permission to describe a SPICE ingestion on a dataset.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeIngestion.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeIngestion", []))

    @jsii.member(jsii_name="toDescribeNamespace")
    def to_describe_namespace(self) -> "Quicksight":
        '''(experimental) Grants permission to describe a QuickSight namespace.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeNamespace.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeNamespace", []))

    @jsii.member(jsii_name="toDescribeTemplate")
    def to_describe_template(self) -> "Quicksight":
        '''(experimental) Grants permission to describe a template.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeTemplate.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeTemplate", []))

    @jsii.member(jsii_name="toDescribeTemplateAlias")
    def to_describe_template_alias(self) -> "Quicksight":
        '''(experimental) Grants permission to describe a template alias.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeTemplateAlias.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeTemplateAlias", []))

    @jsii.member(jsii_name="toDescribeTemplatePermissions")
    def to_describe_template_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to describe permissions for a template.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeTemplatePermissions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeTemplatePermissions", []))

    @jsii.member(jsii_name="toDescribeTheme")
    def to_describe_theme(self) -> "Quicksight":
        '''(experimental) Grants permission to describe a theme.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeTheme.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeTheme", []))

    @jsii.member(jsii_name="toDescribeThemeAlias")
    def to_describe_theme_alias(self) -> "Quicksight":
        '''(experimental) Grants permission to describe a theme alias.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeThemeAlias.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeThemeAlias", []))

    @jsii.member(jsii_name="toDescribeThemePermissions")
    def to_describe_theme_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to describe permissions for a theme.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeThemePermissions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeThemePermissions", []))

    @jsii.member(jsii_name="toDescribeUser")
    def to_describe_user(self) -> "Quicksight":
        '''(experimental) Grants permission to describe a QuickSight user given the user name.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeUser.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeUser", []))

    @jsii.member(jsii_name="toGetAuthCode")
    def to_get_auth_code(self) -> "Quicksight":
        '''(experimental) Grants permission to get an auth code representing a QuickSight user.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/user/iam-actions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toGetAuthCode", []))

    @jsii.member(jsii_name="toGetDashboardEmbedUrl")
    def to_get_dashboard_embed_url(self) -> "Quicksight":
        '''(experimental) Grants permission to get a URL used to embed a QuickSight Dashboard.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_GetDashboardEmbedUrl.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toGetDashboardEmbedUrl", []))

    @jsii.member(jsii_name="toGetGroupMapping")
    def to_get_group_mapping(self) -> "Quicksight":
        '''(experimental) Grants permission to use Amazon QuickSight, in Enterprise edition, to identify and display the Microsoft Active Directory (Microsoft Active Directory) directory groups that are mapped to roles in Amazon QuickSight.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/user/iam-actions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toGetGroupMapping", []))

    @jsii.member(jsii_name="toGetSessionEmbedUrl")
    def to_get_session_embed_url(self) -> "Quicksight":
        '''(experimental) Grants permission to get a URL to embed QuickSight console experience.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_GetSessionEmbedUrl.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toGetSessionEmbedUrl", []))

    @jsii.member(jsii_name="toListAnalyses")
    def to_list_analyses(self) -> "Quicksight":
        '''(experimental) Grants permission to list all analyses in an account.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListAnalyses.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListAnalyses", []))

    @jsii.member(jsii_name="toListCustomPermissions")
    def to_list_custom_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to list custom permissions resources in QuickSight account.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/user/iam-actions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListCustomPermissions", []))

    @jsii.member(jsii_name="toListDashboards")
    def to_list_dashboards(self) -> "Quicksight":
        '''(experimental) Grants permission to list all Dashboards in a QuickSight Account.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListDashboards.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListDashboards", []))

    @jsii.member(jsii_name="toListDashboardVersions")
    def to_list_dashboard_versions(self) -> "Quicksight":
        '''(experimental) Grants permission to list all versions of a QuickSight Dashboard.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListDashboardVersions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListDashboardVersions", []))

    @jsii.member(jsii_name="toListDataSets")
    def to_list_data_sets(self) -> "Quicksight":
        '''(experimental) Grants permission to list all datasets.

        Access Level: List

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListDataSets.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListDataSets", []))

    @jsii.member(jsii_name="toListDataSources")
    def to_list_data_sources(self) -> "Quicksight":
        '''(experimental) Grants permission to list all data sources.

        Access Level: List

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListDataSources.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListDataSources", []))

    @jsii.member(jsii_name="toListGroupMemberships")
    def to_list_group_memberships(self) -> "Quicksight":
        '''(experimental) Grants permission to list member users in a group.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListGroupMemberships.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListGroupMemberships", []))

    @jsii.member(jsii_name="toListGroups")
    def to_list_groups(self) -> "Quicksight":
        '''(experimental) Grants permission to list all user groups in QuickSight.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListGroups.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListGroups", []))

    @jsii.member(jsii_name="toListIAMPolicyAssignments")
    def to_list_iam_policy_assignments(self) -> "Quicksight":
        '''(experimental) Grants permission to list all assignments in the current Amazon QuickSight account.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListIAMPolicyAssignments.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListIAMPolicyAssignments", []))

    @jsii.member(jsii_name="toListIAMPolicyAssignmentsForUser")
    def to_list_iam_policy_assignments_for_user(self) -> "Quicksight":
        '''(experimental) Grants permission to list all assignments assigned to a user and the groups it belongs.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListIAMPolicyAssignmentsForUser.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListIAMPolicyAssignmentsForUser", []))

    @jsii.member(jsii_name="toListIngestions")
    def to_list_ingestions(self) -> "Quicksight":
        '''(experimental) Grants permission to list all SPICE ingestions on a dataset.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListIngestions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListIngestions", []))

    @jsii.member(jsii_name="toListNamespaces")
    def to_list_namespaces(self) -> "Quicksight":
        '''(experimental) Grants permission to lists all namespaces in a QuickSight account.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListNamespaces.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListNamespaces", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Quicksight":
        '''(experimental) Grants permission to list tags of a QuickSight resource.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTemplateAliases")
    def to_list_template_aliases(self) -> "Quicksight":
        '''(experimental) Grants permission to list all aliases for a template.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListTemplateAliases.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListTemplateAliases", []))

    @jsii.member(jsii_name="toListTemplates")
    def to_list_templates(self) -> "Quicksight":
        '''(experimental) Grants permission to list all templates in a QuickSight account.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListTemplates.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListTemplates", []))

    @jsii.member(jsii_name="toListTemplateVersions")
    def to_list_template_versions(self) -> "Quicksight":
        '''(experimental) Grants permission to list all versions of a template.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListTemplateVersions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListTemplateVersions", []))

    @jsii.member(jsii_name="toListThemeAliases")
    def to_list_theme_aliases(self) -> "Quicksight":
        '''(experimental) Grants permission to list all aliases of a theme.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListThemeAliases.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListThemeAliases", []))

    @jsii.member(jsii_name="toListThemes")
    def to_list_themes(self) -> "Quicksight":
        '''(experimental) Grants permission to list all themes in an account.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListThemes.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListThemes", []))

    @jsii.member(jsii_name="toListThemeVersions")
    def to_list_theme_versions(self) -> "Quicksight":
        '''(experimental) Grants permission to list all versions of a theme.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListThemeVersions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListThemeVersions", []))

    @jsii.member(jsii_name="toListUserGroups")
    def to_list_user_groups(self) -> "Quicksight":
        '''(experimental) Grants permission to list groups that a given user is a member of.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListUserGroups.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListUserGroups", []))

    @jsii.member(jsii_name="toListUsers")
    def to_list_users(self) -> "Quicksight":
        '''(experimental) Grants permission to list all of the QuickSight users belonging to this account.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListUsers.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListUsers", []))

    @jsii.member(jsii_name="toPassDataSet")
    def to_pass_data_set(self) -> "Quicksight":
        '''(experimental) Grants permission to use a dataset for a template.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/qs-api-overview.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toPassDataSet", []))

    @jsii.member(jsii_name="toPassDataSource")
    def to_pass_data_source(self) -> "Quicksight":
        '''(experimental) Grants permission to use a data source for a data set.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/qs-api-overview.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toPassDataSource", []))

    @jsii.member(jsii_name="toRegisterUser")
    def to_register_user(self) -> "Quicksight":
        '''(experimental) Grants permission to create a QuickSight user, whose identity is associated with the IAM identity/role specified in the request.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_RegisterUser.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toRegisterUser", []))

    @jsii.member(jsii_name="toRestoreAnalysis")
    def to_restore_analysis(self) -> "Quicksight":
        '''(experimental) Grants permission to restore a deleted analysis.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_RestoreAnalysis.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toRestoreAnalysis", []))

    @jsii.member(jsii_name="toSearchAnalyses")
    def to_search_analyses(self) -> "Quicksight":
        '''(experimental) Grants permission to search for a sub-set of analyses.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_SearchAnalyses.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toSearchAnalyses", []))

    @jsii.member(jsii_name="toSearchDashboards")
    def to_search_dashboards(self) -> "Quicksight":
        '''(experimental) Grants permission to search for a sub-set of QuickSight Dashboards.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_SearchDashboards.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toSearchDashboards", []))

    @jsii.member(jsii_name="toSearchDirectoryGroups")
    def to_search_directory_groups(self) -> "Quicksight":
        '''(experimental) Grants permission to use Amazon QuickSight, in Enterprise edition, to display your Microsoft Active Directory directory groups so that you can choose which ones to map to roles in Amazon QuickSight.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/user/iam-actions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toSearchDirectoryGroups", []))

    @jsii.member(jsii_name="toSetGroupMapping")
    def to_set_group_mapping(self) -> "Quicksight":
        '''(experimental) Grants permission to use Amazon QuickSight, in Enterprise edition, to display your Microsoft Active Directory directory groups so that you can choose which ones to map to roles in Amazon QuickSight.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/user/iam-actions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toSetGroupMapping", []))

    @jsii.member(jsii_name="toSubscribe")
    def to_subscribe(self) -> "Quicksight":
        '''(experimental) Grants permission to subscribe to Amazon QuickSight, and also to allow the user to upgrade the subscription to Enterprise edition.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/user/iam-actions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toSubscribe", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Quicksight":
        '''(experimental) Grants permission to add tags to a QuickSight resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUnsubscribe")
    def to_unsubscribe(self) -> "Quicksight":
        '''(experimental) Grants permission to unsubscribe from Amazon QuickSight, which permanently deletes all users and their resources from Amazon QuickSight.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/user/iam-actions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUnsubscribe", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Quicksight":
        '''(experimental) Grants permission to remove tags from a QuickSight resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAccountCustomization")
    def to_update_account_customization(self) -> "Quicksight":
        '''(experimental) Grants permission to update an account customization for QuickSight account or namespace.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateAccountCustomization.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateAccountCustomization", []))

    @jsii.member(jsii_name="toUpdateAccountSettings")
    def to_update_account_settings(self) -> "Quicksight":
        '''(experimental) Grants permission to update the administrative account settings for QuickSight account.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateAccountSettings.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateAccountSettings", []))

    @jsii.member(jsii_name="toUpdateAnalysis")
    def to_update_analysis(self) -> "Quicksight":
        '''(experimental) Grants permission to update an analysis.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateAnalysis.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateAnalysis", []))

    @jsii.member(jsii_name="toUpdateAnalysisPermissions")
    def to_update_analysis_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to update permissions for an analysis.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateAnalysisPermissions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateAnalysisPermissions", []))

    @jsii.member(jsii_name="toUpdateCustomPermissions")
    def to_update_custom_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to update a custom permissions resource.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/user/iam-actions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateCustomPermissions", []))

    @jsii.member(jsii_name="toUpdateDashboard")
    def to_update_dashboard(self) -> "Quicksight":
        '''(experimental) Grants permission to update a QuickSight Dashboard.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateDashboard.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateDashboard", []))

    @jsii.member(jsii_name="toUpdateDashboardPermissions")
    def to_update_dashboard_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to update permissions for a QuickSight Dashboard.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateDashboardPermissions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateDashboardPermissions", []))

    @jsii.member(jsii_name="toUpdateDashboardPublishedVersion")
    def to_update_dashboard_published_version(self) -> "Quicksight":
        '''(experimental) Grants permission to update a QuickSight Dashboard’s Published Version.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateDashboardPublishedVersion.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateDashboardPublishedVersion", []))

    @jsii.member(jsii_name="toUpdateDataSet")
    def to_update_data_set(self) -> "Quicksight":
        '''(experimental) Grants permission to update a dataset.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - quicksight:PassDataSource

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateDataSet.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateDataSet", []))

    @jsii.member(jsii_name="toUpdateDataSetPermissions")
    def to_update_data_set_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to update the resource policy of a dataset.

        Access Level: Permissions management

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateDataSetPermissions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateDataSetPermissions", []))

    @jsii.member(jsii_name="toUpdateDataSource")
    def to_update_data_source(self) -> "Quicksight":
        '''(experimental) Grants permission to update a data source.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateDataSource.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateDataSource", []))

    @jsii.member(jsii_name="toUpdateDataSourcePermissions")
    def to_update_data_source_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to update the resource policy of a data source.

        Access Level: Permissions management

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateDataSourcePermissions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateDataSourcePermissions", []))

    @jsii.member(jsii_name="toUpdateGroup")
    def to_update_group(self) -> "Quicksight":
        '''(experimental) Grants permission to change group description.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateGroup.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateGroup", []))

    @jsii.member(jsii_name="toUpdateIAMPolicyAssignment")
    def to_update_iam_policy_assignment(self) -> "Quicksight":
        '''(experimental) Grants permission to update an existing assignment.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateIAMPolicyAssignment.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateIAMPolicyAssignment", []))

    @jsii.member(jsii_name="toUpdateTemplate")
    def to_update_template(self) -> "Quicksight":
        '''(experimental) Grants permission to update a template.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateTemplate.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateTemplate", []))

    @jsii.member(jsii_name="toUpdateTemplateAlias")
    def to_update_template_alias(self) -> "Quicksight":
        '''(experimental) Grants permission to update a template alias.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateTemplateAlias.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateTemplateAlias", []))

    @jsii.member(jsii_name="toUpdateTemplatePermissions")
    def to_update_template_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to update permissions for a template.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateTemplatePermissions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateTemplatePermissions", []))

    @jsii.member(jsii_name="toUpdateTheme")
    def to_update_theme(self) -> "Quicksight":
        '''(experimental) Grants permission to update a theme.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateTheme.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateTheme", []))

    @jsii.member(jsii_name="toUpdateThemeAlias")
    def to_update_theme_alias(self) -> "Quicksight":
        '''(experimental) Grants permission to update the alias of a theme.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateThemeAlias.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateThemeAlias", []))

    @jsii.member(jsii_name="toUpdateThemePermissions")
    def to_update_theme_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to update permissions for a theme.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateThemePermissions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateThemePermissions", []))

    @jsii.member(jsii_name="toUpdateUser")
    def to_update_user(self) -> "Quicksight":
        '''(experimental) Grants permission to update an Amazon QuickSight user.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateUser.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateUser", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Ram(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Ram"):
    '''(experimental) Statement provider for service `ram <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsresourceaccessmanager.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `ram <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsresourceaccessmanager.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Ram, self, [sid])

    @jsii.member(jsii_name="ifAllowsExternalPrincipals")
    def if_allows_external_principals(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Ram":
        '''(experimental) Filters access based on resource shares that allow or deny sharing with external principals.

        For example, specify true if the action can only be performed on resource shares that allow sharing with external principals. External principals are AWS accounts that are outside of its AWS organization

        https://docs.aws.amazon.com/ram/latest/userguide/iam-policies.html#iam-policies-condition

        Applies to actions:

        - .toAssociateResourceShare()
        - .toDeleteResourceShare()
        - .toDisassociateResourceShare()
        - .toListResourceSharePermissions()
        - .toUpdateResourceShare()

        Applies to resource types:

        - resource-share

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "ifAllowsExternalPrincipals", [value]))

    @jsii.member(jsii_name="ifPermissionArn")
    def if_permission_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ram":
        '''(experimental) Filters access based on the specified Permission ARN.

        https://docs.aws.amazon.com/ram/latest/userguide/iam-policies.html#iam-policies-condition

        Applies to actions:

        - .toGetPermission()

        Applies to resource types:

        - permission

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "ifPermissionArn", [value, operator]))

    @jsii.member(jsii_name="ifPermissionResourceType")
    def if_permission_resource_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ram":
        '''(experimental) Filters access based on permissions of specified resource type.

        https://docs.aws.amazon.com/ram/latest/userguide/iam-policies.html#iam-policies-condition

        Applies to resource types:

        - permission

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "ifPermissionResourceType", [value, operator]))

    @jsii.member(jsii_name="ifPrincipal")
    def if_principal(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ram":
        '''(experimental) Filters access based on the format of the specified principal.

        https://docs.aws.amazon.com/ram/latest/userguide/iam-policies.html#iam-policies-condition

        Applies to actions:

        - .toAssociateResourceShare()
        - .toCreateResourceShare()
        - .toDisassociateResourceShare()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "ifPrincipal", [value, operator]))

    @jsii.member(jsii_name="ifRequestedAllowsExternalPrincipals")
    def if_requested_allows_external_principals(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Ram":
        '''(experimental) Filters access based on the specified value for 'allowExternalPrincipals'.

        External principals are AWS accounts that are outside of its AWS Organization

        https://docs.aws.amazon.com/ram/latest/userguide/iam-policies.html#iam-policies-condition

        Applies to actions:

        - .toCreateResourceShare()
        - .toUpdateResourceShare()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "ifRequestedAllowsExternalPrincipals", [value]))

    @jsii.member(jsii_name="ifRequestedResourceType")
    def if_requested_resource_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ram":
        '''(experimental) Filters access based on the specified resource type.

        https://docs.aws.amazon.com/ram/latest/userguide/iam-policies.html#iam-policies-condition

        Applies to actions:

        - .toAssociateResourceShare()
        - .toCreateResourceShare()
        - .toDisassociateResourceShare()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "ifRequestedResourceType", [value, operator]))

    @jsii.member(jsii_name="ifResourceArn")
    def if_resource_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ram":
        '''(experimental) Filters access based on a resource with the specified ARN.

        https://docs.aws.amazon.com/ram/latest/userguide/iam-policies.html#iam-policies-condition

        Applies to actions:

        - .toAssociateResourceShare()
        - .toCreateResourceShare()
        - .toDisassociateResourceShare()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "ifResourceArn", [value, operator]))

    @jsii.member(jsii_name="ifResourceShareName")
    def if_resource_share_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ram":
        '''(experimental) Filters access based on a resource share with the specified name.

        https://docs.aws.amazon.com/ram/latest/userguide/iam-policies.html#iam-policies-condition

        Applies to actions:

        - .toAssociateResourceShare()
        - .toDeleteResourceShare()
        - .toDisassociateResourceShare()
        - .toListResourceSharePermissions()
        - .toUpdateResourceShare()

        Applies to resource types:

        - resource-share

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "ifResourceShareName", [value, operator]))

    @jsii.member(jsii_name="ifShareOwnerAccountId")
    def if_share_owner_account_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ram":
        '''(experimental) Filters access based on resource shares owned by a specific account.

        For example, you can use this condition key to specify which resource share invitations can be accepted or rejected based on the resource share owner’s account ID

        https://docs.aws.amazon.com/ram/latest/userguide/iam-policies.html#iam-policies-condition

        Applies to actions:

        - .toAcceptResourceShareInvitation()
        - .toRejectResourceShareInvitation()

        Applies to resource types:

        - resource-share-invitation

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "ifShareOwnerAccountId", [value, operator]))

    @jsii.member(jsii_name="onPermission")
    def on_permission(
        self,
        resource_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ram":
        '''(experimental) Adds a resource of type permission to the statement.

        https://docs.aws.amazon.com/ram/latest/APIReference/API_ResourceSharePermissionDetail.html

        :param resource_path: - Identifier for the resourcePath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifPermissionArn() - .ifPermissionResourceType()

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "onPermission", [resource_path, account, partition]))

    @jsii.member(jsii_name="onResourceShare")
    def on_resource_share(
        self,
        resource_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ram":
        '''(experimental) Adds a resource of type resource-share to the statement.

        https://docs.aws.amazon.com/ram/latest/APIReference/API_ResourceShare.html

        :param resource_path: - Identifier for the resourcePath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifAllowsExternalPrincipals() - .ifResourceShareName()

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "onResourceShare", [resource_path, account, region, partition]))

    @jsii.member(jsii_name="onResourceShareInvitation")
    def on_resource_share_invitation(
        self,
        resource_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ram":
        '''(experimental) Adds a resource of type resource-share-invitation to the statement.

        https://docs.aws.amazon.com/ram/latest/APIReference/API_ResourceShareInvitation.html

        :param resource_path: - Identifier for the resourcePath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifShareOwnerAccountId()

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "onResourceShareInvitation", [resource_path, account, region, partition]))

    @jsii.member(jsii_name="toAcceptResourceShareInvitation")
    def to_accept_resource_share_invitation(self) -> "Ram":
        '''(experimental) Grants permission to accept the specified resource share invitation.

        Access Level: Write

        Possible conditions:

        - .ifShareOwnerAccountId()

        https://docs.aws.amazon.com/ram/latest/APIReference/API_AcceptResourceShareInvitation.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toAcceptResourceShareInvitation", []))

    @jsii.member(jsii_name="toAssociateResourceShare")
    def to_associate_resource_share(self) -> "Ram":
        '''(experimental) Grants permission to associate resource(s) and/or principal(s) to a resource share.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifResourceShareName()
        - .ifAllowsExternalPrincipals()
        - .ifPrincipal()
        - .ifRequestedResourceType()
        - .ifResourceArn()

        https://docs.aws.amazon.com/ram/latest/APIReference/API_AssociateResourceShare.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toAssociateResourceShare", []))

    @jsii.member(jsii_name="toAssociateResourceSharePermission")
    def to_associate_resource_share_permission(self) -> "Ram":
        '''(experimental) Grants permission to associate a Permission with a Resource Share.

        Access Level: Write

        https://docs.aws.amazon.com/ram/latest/APIReference/API_AssociateResourceSharePermission.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toAssociateResourceSharePermission", []))

    @jsii.member(jsii_name="toCreateResourceShare")
    def to_create_resource_share(self) -> "Ram":
        '''(experimental) Grants permission to create a resource share with provided resource(s) and/or principal(s).

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRequestedResourceType()
        - .ifResourceArn()
        - .ifRequestedAllowsExternalPrincipals()
        - .ifPrincipal()

        https://docs.aws.amazon.com/ram/latest/APIReference/API_CreateResourceShare.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toCreateResourceShare", []))

    @jsii.member(jsii_name="toDeleteResourceShare")
    def to_delete_resource_share(self) -> "Ram":
        '''(experimental) Grants permission to delete resource share.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifResourceShareName()
        - .ifAllowsExternalPrincipals()

        https://docs.aws.amazon.com/ram/latest/APIReference/API_DeleteResourceShare.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toDeleteResourceShare", []))

    @jsii.member(jsii_name="toDisassociateResourceShare")
    def to_disassociate_resource_share(self) -> "Ram":
        '''(experimental) Grants permission to disassociate resource(s) and/or principal(s) from a resource share.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifResourceShareName()
        - .ifAllowsExternalPrincipals()
        - .ifPrincipal()
        - .ifRequestedResourceType()
        - .ifResourceArn()

        https://docs.aws.amazon.com/ram/latest/APIReference/API_DisassociateResourceShare.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toDisassociateResourceShare", []))

    @jsii.member(jsii_name="toDisassociateResourceSharePermission")
    def to_disassociate_resource_share_permission(self) -> "Ram":
        '''(experimental) Grants permission to disassociate a Permission from a Resource Share.

        Access Level: Write

        https://docs.aws.amazon.com/ram/latest/APIReference/API_DisassociateResourceSharePermission.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toDisassociateResourceSharePermission", []))

    @jsii.member(jsii_name="toEnableSharingWithAwsOrganization")
    def to_enable_sharing_with_aws_organization(self) -> "Ram":
        '''(experimental) Grants permission to access customer's organization and create a SLR in the customer's account.

        Access Level: Write

        https://docs.aws.amazon.com/ram/latest/APIReference/API_EnableSharingWithAwsOrganization.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toEnableSharingWithAwsOrganization", []))

    @jsii.member(jsii_name="toGetPermission")
    def to_get_permission(self) -> "Ram":
        '''(experimental) Grants permission to get the contents of an AWS RAM permission.

        Access Level: Read

        Possible conditions:

        - .ifPermissionArn()

        https://docs.aws.amazon.com/ram/latest/APIReference/API_GetPermission.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toGetPermission", []))

    @jsii.member(jsii_name="toGetResourcePolicies")
    def to_get_resource_policies(self) -> "Ram":
        '''(experimental) Grants permission to get the policies for the specified resources that you own and have shared.

        Access Level: Read

        https://docs.aws.amazon.com/ram/latest/APIReference/API_GetResourcePolicies.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toGetResourcePolicies", []))

    @jsii.member(jsii_name="toGetResourceShareAssociations")
    def to_get_resource_share_associations(self) -> "Ram":
        '''(experimental) Grants permission to get a set of resource share associations from a provided list or with a specified status of the specified type.

        Access Level: Read

        https://docs.aws.amazon.com/ram/latest/APIReference/API_GetResourceShareAssociations.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toGetResourceShareAssociations", []))

    @jsii.member(jsii_name="toGetResourceShareInvitations")
    def to_get_resource_share_invitations(self) -> "Ram":
        '''(experimental) Grants permission to get resource share invitations by the specified invitation arn or those for the resource share.

        Access Level: Read

        https://docs.aws.amazon.com/ram/latest/APIReference/API_GetResourceShareInvitations.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toGetResourceShareInvitations", []))

    @jsii.member(jsii_name="toGetResourceShares")
    def to_get_resource_shares(self) -> "Ram":
        '''(experimental) Grants permission to get a set of resource shares from a provided list or with a specified status.

        Access Level: Read

        https://docs.aws.amazon.com/ram/latest/APIReference/API_GetResourceShares.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toGetResourceShares", []))

    @jsii.member(jsii_name="toListPendingInvitationResources")
    def to_list_pending_invitation_resources(self) -> "Ram":
        '''(experimental) Grants permission to list the resources in a resource share that is shared with you but that the invitation is still pending for.

        Access Level: Read

        https://docs.aws.amazon.com/ram/latest/APIReference/API_ListPendingInvitationResources.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toListPendingInvitationResources", []))

    @jsii.member(jsii_name="toListPermissions")
    def to_list_permissions(self) -> "Ram":
        '''(experimental) Grants permission to list the AWS RAM permissions.

        Access Level: List

        https://docs.aws.amazon.com/ram/latest/APIReference/API_ListPermissions.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toListPermissions", []))

    @jsii.member(jsii_name="toListPrincipals")
    def to_list_principals(self) -> "Ram":
        '''(experimental) Grants permission to list the principals that you have shared resources with or that have shared resources with you.

        Access Level: List

        https://docs.aws.amazon.com/ram/latest/APIReference/API_ListPrincipals.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toListPrincipals", []))

    @jsii.member(jsii_name="toListResources")
    def to_list_resources(self) -> "Ram":
        '''(experimental) Grants permission to list the resources that you added to resource shares or the resources that are shared with you.

        Access Level: List

        https://docs.aws.amazon.com/ram/latest/APIReference/API_ListResources.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toListResources", []))

    @jsii.member(jsii_name="toListResourceSharePermissions")
    def to_list_resource_share_permissions(self) -> "Ram":
        '''(experimental) Grants permission to list the Permissions associated with a Resource Share.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifResourceShareName()
        - .ifAllowsExternalPrincipals()

        https://docs.aws.amazon.com/ram/latest/APIReference/API_ListResourceSharePermissions.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toListResourceSharePermissions", []))

    @jsii.member(jsii_name="toListResourceTypes")
    def to_list_resource_types(self) -> "Ram":
        '''(experimental) Grants permission to list the shareable resource types supported by AWS RAM.

        Access Level: List

        https://docs.aws.amazon.com/ram/latest/APIReference/API_ListResourceTypes.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toListResourceTypes", []))

    @jsii.member(jsii_name="toPromoteResourceShareCreatedFromPolicy")
    def to_promote_resource_share_created_from_policy(self) -> "Ram":
        '''(experimental) Grants permission to promote the specified resource share.

        Access Level: Write

        https://docs.aws.amazon.com/ram/latest/APIReference/API_PromoteResourceShareCreatedFromPolicy.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toPromoteResourceShareCreatedFromPolicy", []))

    @jsii.member(jsii_name="toRejectResourceShareInvitation")
    def to_reject_resource_share_invitation(self) -> "Ram":
        '''(experimental) Grants permission to reject the specified resource share invitation.

        Access Level: Write

        Possible conditions:

        - .ifShareOwnerAccountId()

        https://docs.aws.amazon.com/ram/latest/APIReference/API_RejectResourceShareInvitation.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toRejectResourceShareInvitation", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Ram":
        '''(experimental) Grants permission to tag the specified resource share.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/ram/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Ram":
        '''(experimental) Grants permission to untag the specified resource share.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/ram/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateResourceShare")
    def to_update_resource_share(self) -> "Ram":
        '''(experimental) Grants permission to update attributes of the resource share.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifResourceShareName()
        - .ifAllowsExternalPrincipals()
        - .ifRequestedAllowsExternalPrincipals()

        https://docs.aws.amazon.com/ram/latest/APIReference/API_UpdateResourceShare.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toUpdateResourceShare", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Rds(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Rds"):
    '''(experimental) Statement provider for service `rds <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonrds.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `rds <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonrds.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Rds, self, [sid])

    @jsii.member(jsii_name="ifClusterPgTag")
    def if_cluster_pg_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the tag attached to a DB cluster parameter group.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to resource types:

        - cluster-pg

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "ifClusterPgTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifClusterSnapshotTag")
    def if_cluster_snapshot_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the tag attached to a DB cluster snapshot.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to resource types:

        - cluster-snapshot

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "ifClusterSnapshotTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifClusterTag")
    def if_cluster_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the tag attached to a DB cluster.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to resource types:

        - cluster

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "ifClusterTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifDatabaseClass")
    def if_database_class(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the type of DB instance class.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to resource types:

        - db

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "ifDatabaseClass", [value, operator]))

    @jsii.member(jsii_name="ifDatabaseEngine")
    def if_database_engine(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the database engine. For possible values refer to the engine parameter in CreateDBInstance API.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to actions:

        - .toCreateDBCluster()
        - .toRestoreDBClusterFromS3()

        Applies to resource types:

        - db

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "ifDatabaseEngine", [value, operator]))

    @jsii.member(jsii_name="ifDatabaseName")
    def if_database_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the user-defined name of the database on the DB instance.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to actions:

        - .toCreateDBCluster()
        - .toRestoreDBClusterFromS3()

        Applies to resource types:

        - db

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "ifDatabaseName", [value, operator]))

    @jsii.member(jsii_name="ifDbTag")
    def if_db_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the tag attached to a DB instance.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to resource types:

        - db

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "ifDbTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifEndpointType")
    def if_endpoint_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the type of the endpoint. One of: READER, WRITER, CUSTOM.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to actions:

        - .toCreateDBClusterEndpoint()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "ifEndpointType", [value, operator]))

    @jsii.member(jsii_name="ifEsTag")
    def if_es_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the tag attached to an event subscription.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to resource types:

        - es

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "ifEsTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifMultiAz")
    def if_multi_az(self, value: typing.Optional[builtins.bool] = None) -> "Rds":
        '''(experimental) Filters access by the value that specifies whether the DB instance runs in multiple Availability Zones.

        To indicate that the DB instance is using Multi-AZ, specify true

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to resource types:

        - db

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "ifMultiAz", [value]))

    @jsii.member(jsii_name="ifOgTag")
    def if_og_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the tag attached to a DB option group.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to resource types:

        - og

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "ifOgTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifPgTag")
    def if_pg_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the tag attached to a DB parameter group.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to resource types:

        - pg

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "ifPgTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifPiops")
    def if_piops(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the value that contains the number of Provisioned IOPS (PIOPS) that the instance supports.

        To indicate a DB instance that does not have PIOPS enabled, specify 0

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to resource types:

        - db

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "ifPiops", [value, operator]))

    @jsii.member(jsii_name="ifReqTag")
    def if_req_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the set of tag keys and values that can be used to tag a resource.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to actions:

        - .toAddTagsToResource()
        - .toCreateDBCluster()
        - .toCreateDBClusterParameterGroup()
        - .toCreateDBClusterSnapshot()
        - .toCreateDBInstance()
        - .toCreateDBInstanceReadReplica()
        - .toCreateDBParameterGroup()
        - .toCreateDBSecurityGroup()
        - .toCreateDBSnapshot()
        - .toCreateDBSubnetGroup()
        - .toCreateEventSubscription()
        - .toCreateOptionGroup()
        - .toRemoveTagsFromResource()
        - .toRestoreDBClusterFromS3()
        - .toRestoreDBClusterFromSnapshot()
        - .toRestoreDBClusterToPointInTime()
        - .toRestoreDBInstanceFromDBSnapshot()
        - .toRestoreDBInstanceFromS3()
        - .toRestoreDBInstanceToPointInTime()

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "ifReqTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifRiTag")
    def if_ri_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the tag attached to a reserved DB instance.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to resource types:

        - ri

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "ifRiTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifSecgrpTag")
    def if_secgrp_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the tag attached to a DB security group.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to resource types:

        - secgrp

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "ifSecgrpTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifSnapshotTag")
    def if_snapshot_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the tag attached to a DB snapshot.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to resource types:

        - snapshot

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "ifSnapshotTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifStorageEncrypted")
    def if_storage_encrypted(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the value that specifies whether the DB instance storage should be encrypted.

        To enforce storage encryption, specify true

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to actions:

        - .toCreateDBCluster()
        - .toRestoreDBClusterFromS3()

        Applies to resource types:

        - db

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "ifStorageEncrypted", [value]))

    @jsii.member(jsii_name="ifStorageSize")
    def if_storage_size(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the storage volume size (in GB).

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to resource types:

        - db

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "ifStorageSize", [value, operator]))

    @jsii.member(jsii_name="ifSubgrpTag")
    def if_subgrp_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the tag attached to a DB subnet group.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to resource types:

        - subgrp

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "ifSubgrpTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifVpc")
    def if_vpc(self, value: typing.Optional[builtins.bool] = None) -> "Rds":
        '''(experimental) Filters access by the value that specifies whether the DB instance runs in an Amazon Virtual Private Cloud (Amazon VPC).

        To indicate that the DB instance runs in an Amazon VPC, specify true

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to resource types:

        - db

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "ifVpc", [value]))

    @jsii.member(jsii_name="onCluster")
    def on_cluster(
        self,
        db_cluster_instance_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rds":
        '''(experimental) Adds a resource of type cluster to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Aurora.Managing.html

        :param db_cluster_instance_name: - Identifier for the dbClusterInstanceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifClusterTag()

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "onCluster", [db_cluster_instance_name, account, region, partition]))

    @jsii.member(jsii_name="onClusterEndpoint")
    def on_cluster_endpoint(
        self,
        db_cluster_endpoint: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rds":
        '''(experimental) Adds a resource of type cluster-endpoint to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Aurora.Overview.Endpoints.html

        :param db_cluster_endpoint: - Identifier for the dbClusterEndpoint.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "onClusterEndpoint", [db_cluster_endpoint, account, region, partition]))

    @jsii.member(jsii_name="onClusterPg")
    def on_cluster_pg(
        self,
        cluster_parameter_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rds":
        '''(experimental) Adds a resource of type cluster-pg to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithParamGroups.html

        :param cluster_parameter_group_name: - Identifier for the clusterParameterGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifClusterPgTag()

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "onClusterPg", [cluster_parameter_group_name, account, region, partition]))

    @jsii.member(jsii_name="onClusterSnapshot")
    def on_cluster_snapshot(
        self,
        cluster_snapshot_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rds":
        '''(experimental) Adds a resource of type cluster-snapshot to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithAutomatedBackups.html

        :param cluster_snapshot_name: - Identifier for the clusterSnapshotName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifClusterSnapshotTag()

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "onClusterSnapshot", [cluster_snapshot_name, account, region, partition]))

    @jsii.member(jsii_name="onDb")
    def on_db(
        self,
        db_instance_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rds":
        '''(experimental) Adds a resource of type db to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.DBInstance.html

        :param db_instance_name: - Identifier for the dbInstanceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifDatabaseClass() - .ifDatabaseEngine() - .ifDatabaseName() - .ifMultiAz() - .ifPiops() - .ifStorageEncrypted() - .ifStorageSize() - .ifVpc() - .ifDbTag()

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "onDb", [db_instance_name, account, region, partition]))

    @jsii.member(jsii_name="onEs")
    def on_es(
        self,
        subscription_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rds":
        '''(experimental) Adds a resource of type es to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html

        :param subscription_name: - Identifier for the subscriptionName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifEsTag()

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "onEs", [subscription_name, account, region, partition]))

    @jsii.member(jsii_name="onGlobalCluster")
    def on_global_cluster(
        self,
        global_cluster: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rds":
        '''(experimental) Adds a resource of type global-cluster to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.Aurora.GlobalDB.html

        :param global_cluster: - Identifier for the globalCluster.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "onGlobalCluster", [global_cluster, account, partition]))

    @jsii.member(jsii_name="onOg")
    def on_og(
        self,
        option_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rds":
        '''(experimental) Adds a resource of type og to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithOptionGroups.html

        :param option_group_name: - Identifier for the optionGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifOgTag()

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "onOg", [option_group_name, account, region, partition]))

    @jsii.member(jsii_name="onPg")
    def on_pg(
        self,
        parameter_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rds":
        '''(experimental) Adds a resource of type pg to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithParamGroups.html

        :param parameter_group_name: - Identifier for the parameterGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifPgTag()

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "onPg", [parameter_group_name, account, region, partition]))

    @jsii.member(jsii_name="onProxy")
    def on_proxy(
        self,
        db_proxy_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rds":
        '''(experimental) Adds a resource of type proxy to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.DBProxy.html

        :param db_proxy_id: - Identifier for the dbProxyId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "onProxy", [db_proxy_id, account, region, partition]))

    @jsii.member(jsii_name="onProxyEndpoint")
    def on_proxy_endpoint(
        self,
        db_proxy_endpoint_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rds":
        '''(experimental) Adds a resource of type proxy-endpoint to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.DBProxy.html

        :param db_proxy_endpoint_id: - Identifier for the dbProxyEndpointId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "onProxyEndpoint", [db_proxy_endpoint_id, account, region, partition]))

    @jsii.member(jsii_name="onRi")
    def on_ri(
        self,
        reserved_db_instance_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rds":
        '''(experimental) Adds a resource of type ri to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithReservedDBInstances.html

        :param reserved_db_instance_name: - Identifier for the reservedDbInstanceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifRiTag()

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "onRi", [reserved_db_instance_name, account, region, partition]))

    @jsii.member(jsii_name="onSecgrp")
    def on_secgrp(
        self,
        security_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rds":
        '''(experimental) Adds a resource of type secgrp to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithSecurityGroups.html

        :param security_group_name: - Identifier for the securityGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifSecgrpTag()

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "onSecgrp", [security_group_name, account, region, partition]))

    @jsii.member(jsii_name="onSnapshot")
    def on_snapshot(
        self,
        snapshot_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rds":
        '''(experimental) Adds a resource of type snapshot to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithAutomatedBackups.html

        :param snapshot_name: - Identifier for the snapshotName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifSnapshotTag()

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "onSnapshot", [snapshot_name, account, region, partition]))

    @jsii.member(jsii_name="onSubgrp")
    def on_subgrp(
        self,
        subnet_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rds":
        '''(experimental) Adds a resource of type subgrp to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.Scenarios.html#USER_VPC.Scenario1

        :param subnet_group_name: - Identifier for the subnetGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifSubgrpTag()

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "onSubgrp", [subnet_group_name, account, region, partition]))

    @jsii.member(jsii_name="onTarget")
    def on_target(
        self,
        target_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rds":
        '''(experimental) Adds a resource of type target to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.DBProxy.html

        :param target_id: - Identifier for the targetId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "onTarget", [target_id, account, region, partition]))

    @jsii.member(jsii_name="onTargetGroup")
    def on_target_group(
        self,
        target_group_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rds":
        '''(experimental) Adds a resource of type target-group to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.DBProxy.html

        :param target_group_id: - Identifier for the targetGroupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "onTargetGroup", [target_group_id, account, region, partition]))

    @jsii.member(jsii_name="toAddRoleToDBCluster")
    def to_add_role_to_db_cluster(self) -> "Rds":
        '''(experimental) Grants permission to associate an Identity and Access Management (IAM) role from an Aurora DB cluster.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_AddRoleToDBCluster.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toAddRoleToDBCluster", []))

    @jsii.member(jsii_name="toAddRoleToDBInstance")
    def to_add_role_to_db_instance(self) -> "Rds":
        '''(experimental) Grants permission to associate an AWS Identity and Access Management (IAM) role with a DB instance.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_AddRoleToDBInstance.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toAddRoleToDBInstance", []))

    @jsii.member(jsii_name="toAddSourceIdentifierToSubscription")
    def to_add_source_identifier_to_subscription(self) -> "Rds":
        '''(experimental) Grants permission to add a source identifier to an existing RDS event notification subscription.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_AddSourceIdentifierToSubscription.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toAddSourceIdentifierToSubscription", []))

    @jsii.member(jsii_name="toAddTagsToResource")
    def to_add_tags_to_resource(self) -> "Rds":
        '''(experimental) Grants permission to add metadata tags to an Amazon RDS resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_AddTagsToResource.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toAddTagsToResource", []))

    @jsii.member(jsii_name="toApplyPendingMaintenanceAction")
    def to_apply_pending_maintenance_action(self) -> "Rds":
        '''(experimental) Grants permission to apply a pending maintenance action to a resource.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ApplyPendingMaintenanceAction.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toApplyPendingMaintenanceAction", []))

    @jsii.member(jsii_name="toAuthorizeDBSecurityGroupIngress")
    def to_authorize_db_security_group_ingress(self) -> "Rds":
        '''(experimental) Grants permission to enable ingress to a DBSecurityGroup using one of two forms of authorization.

        Access Level: Permissions management

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_AuthorizeDBSecurityGroupIngress.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toAuthorizeDBSecurityGroupIngress", []))

    @jsii.member(jsii_name="toBacktrackDBCluster")
    def to_backtrack_db_cluster(self) -> "Rds":
        '''(experimental) Grants permission to backtrack a DB cluster to a specific time, without creating a new DB cluster.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_BacktrackDBCluster.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toBacktrackDBCluster", []))

    @jsii.member(jsii_name="toCancelExportTask")
    def to_cancel_export_task(self) -> "Rds":
        '''(experimental) Grants permission to cancel an export task in progress.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CancelExportTask.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCancelExportTask", []))

    @jsii.member(jsii_name="toCopyDBClusterParameterGroup")
    def to_copy_db_cluster_parameter_group(self) -> "Rds":
        '''(experimental) Grants permission to copy the specified DB cluster parameter group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CopyDBClusterParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCopyDBClusterParameterGroup", []))

    @jsii.member(jsii_name="toCopyDBClusterSnapshot")
    def to_copy_db_cluster_snapshot(self) -> "Rds":
        '''(experimental) Grants permission to create a snapshot of a DB cluster.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CopyDBClusterSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCopyDBClusterSnapshot", []))

    @jsii.member(jsii_name="toCopyDBParameterGroup")
    def to_copy_db_parameter_group(self) -> "Rds":
        '''(experimental) Grants permission to copy the specified DB parameter group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CopyDBParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCopyDBParameterGroup", []))

    @jsii.member(jsii_name="toCopyDBSnapshot")
    def to_copy_db_snapshot(self) -> "Rds":
        '''(experimental) Grants permission to copy the specified DB snapshot.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CopyDBSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCopyDBSnapshot", []))

    @jsii.member(jsii_name="toCopyOptionGroup")
    def to_copy_option_group(self) -> "Rds":
        '''(experimental) Grants permission to copy the specified option group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CopyOptionGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCopyOptionGroup", []))

    @jsii.member(jsii_name="toCreateDBCluster")
    def to_create_db_cluster(self) -> "Rds":
        '''(experimental) Grants permission to create a new Amazon Aurora DB cluster.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()
        - .ifDatabaseEngine()
        - .ifDatabaseName()
        - .ifStorageEncrypted()

        Dependent actions:

        - iam:PassRole
        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBCluster.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCreateDBCluster", []))

    @jsii.member(jsii_name="toCreateDBClusterEndpoint")
    def to_create_db_cluster_endpoint(self) -> "Rds":
        '''(experimental) Grants permission to create a new custom endpoint and associates it with an Amazon Aurora DB cluster.

        Access Level: Write

        Possible conditions:

        - .ifEndpointType()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBClusterEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCreateDBClusterEndpoint", []))

    @jsii.member(jsii_name="toCreateDBClusterParameterGroup")
    def to_create_db_cluster_parameter_group(self) -> "Rds":
        '''(experimental) Grants permission to create a new DB cluster parameter group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        Dependent actions:

        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBClusterParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCreateDBClusterParameterGroup", []))

    @jsii.member(jsii_name="toCreateDBClusterSnapshot")
    def to_create_db_cluster_snapshot(self) -> "Rds":
        '''(experimental) Grants permission to create a snapshot of a DB cluster.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        Dependent actions:

        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBClusterSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCreateDBClusterSnapshot", []))

    @jsii.member(jsii_name="toCreateDBInstance")
    def to_create_db_instance(self) -> "Rds":
        '''(experimental) Grants permission to create a new DB instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        Dependent actions:

        - iam:PassRole
        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBInstance.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCreateDBInstance", []))

    @jsii.member(jsii_name="toCreateDBInstanceReadReplica")
    def to_create_db_instance_read_replica(self) -> "Rds":
        '''(experimental) Grants permission to create a DB instance that acts as a Read Replica of a source DB instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        Dependent actions:

        - iam:PassRole
        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBInstanceReadReplica.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCreateDBInstanceReadReplica", []))

    @jsii.member(jsii_name="toCreateDBParameterGroup")
    def to_create_db_parameter_group(self) -> "Rds":
        '''(experimental) Grants permission to create a new DB parameter group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        Dependent actions:

        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCreateDBParameterGroup", []))

    @jsii.member(jsii_name="toCreateDBProxy")
    def to_create_db_proxy(self) -> "Rds":
        '''(experimental) Grants permission to create a database proxy.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBProxy.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCreateDBProxy", []))

    @jsii.member(jsii_name="toCreateDBProxyEndpoint")
    def to_create_db_proxy_endpoint(self) -> "Rds":
        '''(experimental) Grants permission to create a database proxy endpoint.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBProxyEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCreateDBProxyEndpoint", []))

    @jsii.member(jsii_name="toCreateDBSecurityGroup")
    def to_create_db_security_group(self) -> "Rds":
        '''(experimental) Grants permission to create a new DB security group. DB security groups control access to a DB instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        Dependent actions:

        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBSecurityGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCreateDBSecurityGroup", []))

    @jsii.member(jsii_name="toCreateDBSnapshot")
    def to_create_db_snapshot(self) -> "Rds":
        '''(experimental) Grants permission to create a DBSnapshot.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        Dependent actions:

        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCreateDBSnapshot", []))

    @jsii.member(jsii_name="toCreateDBSubnetGroup")
    def to_create_db_subnet_group(self) -> "Rds":
        '''(experimental) Grants permission to create a new DB subnet group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        Dependent actions:

        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBSubnetGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCreateDBSubnetGroup", []))

    @jsii.member(jsii_name="toCreateEventSubscription")
    def to_create_event_subscription(self) -> "Rds":
        '''(experimental) Grants permission to create an RDS event notification subscription.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        Dependent actions:

        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateEventSubscription.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCreateEventSubscription", []))

    @jsii.member(jsii_name="toCreateGlobalCluster")
    def to_create_global_cluster(self) -> "Rds":
        '''(experimental) Grants permission to create an Aurora global database spread across multiple regions.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateGlobalCluster.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCreateGlobalCluster", []))

    @jsii.member(jsii_name="toCreateOptionGroup")
    def to_create_option_group(self) -> "Rds":
        '''(experimental) Grants permission to create a new option group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        Dependent actions:

        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateOptionGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCreateOptionGroup", []))

    @jsii.member(jsii_name="toCrossRegionCommunication")
    def to_cross_region_communication(self) -> "Rds":
        '''(experimental) Grants permission to access a resource in the remote Region when executing cross-Region operations, such as cross-Region snapshot copy or cross-Region read replica creation.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCrossRegionCommunication", []))

    @jsii.member(jsii_name="toDeleteDBCluster")
    def to_delete_db_cluster(self) -> "Rds":
        '''(experimental) Grants permission to delete a previously provisioned DB cluster.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBCluster.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDeleteDBCluster", []))

    @jsii.member(jsii_name="toDeleteDBClusterEndpoint")
    def to_delete_db_cluster_endpoint(self) -> "Rds":
        '''(experimental) Grants permission to delete a custom endpoint and removes it from an Amazon Aurora DB cluster.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBClusterEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDeleteDBClusterEndpoint", []))

    @jsii.member(jsii_name="toDeleteDBClusterParameterGroup")
    def to_delete_db_cluster_parameter_group(self) -> "Rds":
        '''(experimental) Grants permission to delete a specified DB cluster parameter group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBClusterParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDeleteDBClusterParameterGroup", []))

    @jsii.member(jsii_name="toDeleteDBClusterSnapshot")
    def to_delete_db_cluster_snapshot(self) -> "Rds":
        '''(experimental) Grants permission to delete a DB cluster snapshot.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBClusterSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDeleteDBClusterSnapshot", []))

    @jsii.member(jsii_name="toDeleteDBInstance")
    def to_delete_db_instance(self) -> "Rds":
        '''(experimental) Grants permission to delete a previously provisioned DB instance.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBInstance.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDeleteDBInstance", []))

    @jsii.member(jsii_name="toDeleteDBInstanceAutomatedBackup")
    def to_delete_db_instance_automated_backup(self) -> "Rds":
        '''(experimental) Grants permission to deletes automated backups based on the source instance's DbiResourceId value or the restorable instance's resource ID.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBInstanceAutomatedBackup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDeleteDBInstanceAutomatedBackup", []))

    @jsii.member(jsii_name="toDeleteDBParameterGroup")
    def to_delete_db_parameter_group(self) -> "Rds":
        '''(experimental) Grants permission to delete a specified DBParameterGroup.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDeleteDBParameterGroup", []))

    @jsii.member(jsii_name="toDeleteDBProxy")
    def to_delete_db_proxy(self) -> "Rds":
        '''(experimental) Grants permission to delete a database proxy.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBProxy.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDeleteDBProxy", []))

    @jsii.member(jsii_name="toDeleteDBProxyEndpoint")
    def to_delete_db_proxy_endpoint(self) -> "Rds":
        '''(experimental) Grants permission to delete a database proxy endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBProxyEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDeleteDBProxyEndpoint", []))

    @jsii.member(jsii_name="toDeleteDBSecurityGroup")
    def to_delete_db_security_group(self) -> "Rds":
        '''(experimental) Grants permission to delete a DB security group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBSecurityGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDeleteDBSecurityGroup", []))

    @jsii.member(jsii_name="toDeleteDBSnapshot")
    def to_delete_db_snapshot(self) -> "Rds":
        '''(experimental) Grants permission to delete a DBSnapshot.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDeleteDBSnapshot", []))

    @jsii.member(jsii_name="toDeleteDBSubnetGroup")
    def to_delete_db_subnet_group(self) -> "Rds":
        '''(experimental) Grants permission to delete a DB subnet group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBSubnetGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDeleteDBSubnetGroup", []))

    @jsii.member(jsii_name="toDeleteEventSubscription")
    def to_delete_event_subscription(self) -> "Rds":
        '''(experimental) Grants permission to delete an RDS event notification subscription.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteEventSubscription.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDeleteEventSubscription", []))

    @jsii.member(jsii_name="toDeleteGlobalCluster")
    def to_delete_global_cluster(self) -> "Rds":
        '''(experimental) Grants permission to delete a global database cluster.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteGlobalCluster.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDeleteGlobalCluster", []))

    @jsii.member(jsii_name="toDeleteOptionGroup")
    def to_delete_option_group(self) -> "Rds":
        '''(experimental) Grants permission to delete an existing option group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteOptionGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDeleteOptionGroup", []))

    @jsii.member(jsii_name="toDeregisterDBProxyTargets")
    def to_deregister_db_proxy_targets(self) -> "Rds":
        '''(experimental) Grants permission to remove targets from a database proxy target group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeregisterDBProxyTargets.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDeregisterDBProxyTargets", []))

    @jsii.member(jsii_name="toDescribeAccountAttributes")
    def to_describe_account_attributes(self) -> "Rds":
        '''(experimental) Grants permission to list all of the attributes for a customer account.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeAccountAttributes.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeAccountAttributes", []))

    @jsii.member(jsii_name="toDescribeCertificates")
    def to_describe_certificates(self) -> "Rds":
        '''(experimental) Lists the set of CA certificates provided by Amazon RDS for this AWS account.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeCertificates.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeCertificates", []))

    @jsii.member(jsii_name="toDescribeDBClusterBacktracks")
    def to_describe_db_cluster_backtracks(self) -> "Rds":
        '''(experimental) Grants permission to return information about backtracks for a DB cluster.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBClusterBacktracks.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBClusterBacktracks", []))

    @jsii.member(jsii_name="toDescribeDBClusterEndpoints")
    def to_describe_db_cluster_endpoints(self) -> "Rds":
        '''(experimental) Grants permission to return information about endpoints for an Amazon Aurora DB cluster.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBClusterEndpoints.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBClusterEndpoints", []))

    @jsii.member(jsii_name="toDescribeDBClusterParameterGroups")
    def to_describe_db_cluster_parameter_groups(self) -> "Rds":
        '''(experimental) Grants permission to return a list of DBClusterParameterGroup descriptions.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBClusterParameterGroups.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBClusterParameterGroups", []))

    @jsii.member(jsii_name="toDescribeDBClusterParameters")
    def to_describe_db_cluster_parameters(self) -> "Rds":
        '''(experimental) Grants permission to return the detailed parameter list for a particular DB cluster parameter group.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBClusterParameters.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBClusterParameters", []))

    @jsii.member(jsii_name="toDescribeDBClusters")
    def to_describe_db_clusters(self) -> "Rds":
        '''(experimental) Grants permission to return information about provisioned Aurora DB clusters.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBClusters.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBClusters", []))

    @jsii.member(jsii_name="toDescribeDBClusterSnapshotAttributes")
    def to_describe_db_cluster_snapshot_attributes(self) -> "Rds":
        '''(experimental) Grants permission to return a list of DB cluster snapshot attribute names and values for a manual DB cluster snapshot.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBClusterSnapshotAttributes.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBClusterSnapshotAttributes", []))

    @jsii.member(jsii_name="toDescribeDBClusterSnapshots")
    def to_describe_db_cluster_snapshots(self) -> "Rds":
        '''(experimental) Grants permission to return information about DB cluster snapshots.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBClusterSnapshots.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBClusterSnapshots", []))

    @jsii.member(jsii_name="toDescribeDBEngineVersions")
    def to_describe_db_engine_versions(self) -> "Rds":
        '''(experimental) Grants permission to return a list of the available DB engines.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBEngineVersions.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBEngineVersions", []))

    @jsii.member(jsii_name="toDescribeDBInstanceAutomatedBackups")
    def to_describe_db_instance_automated_backups(self) -> "Rds":
        '''(experimental) Grants permission to return a list of automated backups for both current and deleted instances.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBInstanceAutomatedBackups.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBInstanceAutomatedBackups", []))

    @jsii.member(jsii_name="toDescribeDBInstances")
    def to_describe_db_instances(self) -> "Rds":
        '''(experimental) Grants permission to return information about provisioned RDS instances.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBInstances.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBInstances", []))

    @jsii.member(jsii_name="toDescribeDBLogFiles")
    def to_describe_db_log_files(self) -> "Rds":
        '''(experimental) Grants permission to return a list of DB log files for the DB instance.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBLogFiles.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBLogFiles", []))

    @jsii.member(jsii_name="toDescribeDBParameterGroups")
    def to_describe_db_parameter_groups(self) -> "Rds":
        '''(experimental) Grants permission to return a list of DBParameterGroup descriptions.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBParameterGroups.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBParameterGroups", []))

    @jsii.member(jsii_name="toDescribeDBParameters")
    def to_describe_db_parameters(self) -> "Rds":
        '''(experimental) Grants permission to return the detailed parameter list for a particular DB parameter group.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBParameters.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBParameters", []))

    @jsii.member(jsii_name="toDescribeDBProxies")
    def to_describe_db_proxies(self) -> "Rds":
        '''(experimental) Grants permission to view proxies.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBProxies.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBProxies", []))

    @jsii.member(jsii_name="toDescribeDBProxyEndpoints")
    def to_describe_db_proxy_endpoints(self) -> "Rds":
        '''(experimental) Grants permission to view proxy endpoints.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBProxyEndpoints.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBProxyEndpoints", []))

    @jsii.member(jsii_name="toDescribeDBProxyTargetGroups")
    def to_describe_db_proxy_target_groups(self) -> "Rds":
        '''(experimental) Grants permission to view database proxy target group details.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBProxyTargetGroups.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBProxyTargetGroups", []))

    @jsii.member(jsii_name="toDescribeDBProxyTargets")
    def to_describe_db_proxy_targets(self) -> "Rds":
        '''(experimental) Grants permission to view database proxy target details.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBProxyTargets.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBProxyTargets", []))

    @jsii.member(jsii_name="toDescribeDBSecurityGroups")
    def to_describe_db_security_groups(self) -> "Rds":
        '''(experimental) Grants permission to return a list of DBSecurityGroup descriptions.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBSecurityGroups.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBSecurityGroups", []))

    @jsii.member(jsii_name="toDescribeDBSnapshotAttributes")
    def to_describe_db_snapshot_attributes(self) -> "Rds":
        '''(experimental) Grants permission to return a list of DB snapshot attribute names and values for a manual DB snapshot.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBSnapshotAttributes.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBSnapshotAttributes", []))

    @jsii.member(jsii_name="toDescribeDBSnapshots")
    def to_describe_db_snapshots(self) -> "Rds":
        '''(experimental) Grants permission to return information about DB snapshots.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBSnapshots.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBSnapshots", []))

    @jsii.member(jsii_name="toDescribeDBSubnetGroups")
    def to_describe_db_subnet_groups(self) -> "Rds":
        '''(experimental) Grants permission to return a list of DBSubnetGroup descriptions.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBSubnetGroups.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBSubnetGroups", []))

    @jsii.member(jsii_name="toDescribeEngineDefaultClusterParameters")
    def to_describe_engine_default_cluster_parameters(self) -> "Rds":
        '''(experimental) Grants permission to return the default engine and system parameter information for the cluster database engine.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeEngineDefaultClusterParameters.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeEngineDefaultClusterParameters", []))

    @jsii.member(jsii_name="toDescribeEngineDefaultParameters")
    def to_describe_engine_default_parameters(self) -> "Rds":
        '''(experimental) Grants permission to return the default engine and system parameter information for the specified database engine.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeEngineDefaultParameters.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeEngineDefaultParameters", []))

    @jsii.member(jsii_name="toDescribeEventCategories")
    def to_describe_event_categories(self) -> "Rds":
        '''(experimental) Grants permission to display a list of categories for all event source types, or, if specified, for a specified source type.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeEventCategories.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeEventCategories", []))

    @jsii.member(jsii_name="toDescribeEvents")
    def to_describe_events(self) -> "Rds":
        '''(experimental) Grants permission to return events related to DB instances, DB security groups, DB snapshots, and DB parameter groups for the past 14 days.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeEvents.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeEvents", []))

    @jsii.member(jsii_name="toDescribeEventSubscriptions")
    def to_describe_event_subscriptions(self) -> "Rds":
        '''(experimental) Grants permission to list all the subscription descriptions for a customer account.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeEventSubscriptions.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeEventSubscriptions", []))

    @jsii.member(jsii_name="toDescribeExportTasks")
    def to_describe_export_tasks(self) -> "Rds":
        '''(experimental) Grants permission to return information about the export tasks.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeExportTasks.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeExportTasks", []))

    @jsii.member(jsii_name="toDescribeGlobalClusters")
    def to_describe_global_clusters(self) -> "Rds":
        '''(experimental) Grants permission to return information about Aurora global database clusters.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeGlobalClusters.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeGlobalClusters", []))

    @jsii.member(jsii_name="toDescribeOptionGroupOptions")
    def to_describe_option_group_options(self) -> "Rds":
        '''(experimental) Grants permission to describe all available options.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeOptionGroupOptions.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeOptionGroupOptions", []))

    @jsii.member(jsii_name="toDescribeOptionGroups")
    def to_describe_option_groups(self) -> "Rds":
        '''(experimental) Grants permission to describe the available option groups.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeOptionGroups.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeOptionGroups", []))

    @jsii.member(jsii_name="toDescribeOrderableDBInstanceOptions")
    def to_describe_orderable_db_instance_options(self) -> "Rds":
        '''(experimental) Grants permission to return a list of orderable DB instance options for the specified engine.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeOrderableDBInstanceOptions.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeOrderableDBInstanceOptions", []))

    @jsii.member(jsii_name="toDescribePendingMaintenanceActions")
    def to_describe_pending_maintenance_actions(self) -> "Rds":
        '''(experimental) Grants permission to return a list of resources (for example, DB instances) that have at least one pending maintenance action.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribePendingMaintenanceActions.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribePendingMaintenanceActions", []))

    @jsii.member(jsii_name="toDescribeReservedDBInstances")
    def to_describe_reserved_db_instances(self) -> "Rds":
        '''(experimental) Grants permission to return information about reserved DB instances for this account, or about a specified reserved DB instance.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeReservedDBInstances.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeReservedDBInstances", []))

    @jsii.member(jsii_name="toDescribeReservedDBInstancesOfferings")
    def to_describe_reserved_db_instances_offerings(self) -> "Rds":
        '''(experimental) Grants permission to list available reserved DB instance offerings.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeReservedDBInstancesOfferings.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeReservedDBInstancesOfferings", []))

    @jsii.member(jsii_name="toDescribeSourceRegions")
    def to_describe_source_regions(self) -> "Rds":
        '''(experimental) Grants permission to return a list of the source AWS Regions where the current AWS Region can create a Read Replica or copy a DB snapshot from.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeSourceRegions.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeSourceRegions", []))

    @jsii.member(jsii_name="toDescribeValidDBInstanceModifications")
    def to_describe_valid_db_instance_modifications(self) -> "Rds":
        '''(experimental) Grants permission to list available modifications you can make to your DB instance.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeValidDBInstanceModifications.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeValidDBInstanceModifications", []))

    @jsii.member(jsii_name="toDownloadDBLogFilePortion")
    def to_download_db_log_file_portion(self) -> "Rds":
        '''(experimental) Grants permission to download all or a portion of the specified log file, up to 1 MB in size.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DownloadDBLogFilePortion.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDownloadDBLogFilePortion", []))

    @jsii.member(jsii_name="toFailoverDBCluster")
    def to_failover_db_cluster(self) -> "Rds":
        '''(experimental) Grants permission to force a failover for a DB cluster.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_FailoverDBCluster.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toFailoverDBCluster", []))

    @jsii.member(jsii_name="toFailoverGlobalCluster")
    def to_failover_global_cluster(self) -> "Rds":
        '''(experimental) Grants permission to failover a global cluster.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_FailoverGlobalCluster.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toFailoverGlobalCluster", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Rds":
        '''(experimental) Grants permission to list all tags on an Amazon RDS resource.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toModifyCurrentDBClusterCapacity")
    def to_modify_current_db_cluster_capacity(self) -> "Rds":
        '''(experimental) Grants permission to modify current cluster capacity for an Amazon Aurora Severless DB cluster.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyCurrentDBClusterCapacity.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toModifyCurrentDBClusterCapacity", []))

    @jsii.member(jsii_name="toModifyDBCluster")
    def to_modify_db_cluster(self) -> "Rds":
        '''(experimental) Grants permission to modify a setting for an Amazon Aurora DB cluster.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBCluster.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toModifyDBCluster", []))

    @jsii.member(jsii_name="toModifyDBClusterEndpoint")
    def to_modify_db_cluster_endpoint(self) -> "Rds":
        '''(experimental) Grants permission to modify the properties of an endpoint in an Amazon Aurora DB cluster.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBClusterEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toModifyDBClusterEndpoint", []))

    @jsii.member(jsii_name="toModifyDBClusterParameterGroup")
    def to_modify_db_cluster_parameter_group(self) -> "Rds":
        '''(experimental) Grants permission to modify the parameters of a DB cluster parameter group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBClusterParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toModifyDBClusterParameterGroup", []))

    @jsii.member(jsii_name="toModifyDBClusterSnapshotAttribute")
    def to_modify_db_cluster_snapshot_attribute(self) -> "Rds":
        '''(experimental) Grants permission to add an attribute and values to, or removes an attribute and values from, a manual DB cluster snapshot.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBClusterSnapshotAttribute.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toModifyDBClusterSnapshotAttribute", []))

    @jsii.member(jsii_name="toModifyDBInstance")
    def to_modify_db_instance(self) -> "Rds":
        '''(experimental) Grants permission to modify settings for a DB instance.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBInstance.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toModifyDBInstance", []))

    @jsii.member(jsii_name="toModifyDBParameterGroup")
    def to_modify_db_parameter_group(self) -> "Rds":
        '''(experimental) Grants permission to modify the parameters of a DB parameter group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toModifyDBParameterGroup", []))

    @jsii.member(jsii_name="toModifyDBProxy")
    def to_modify_db_proxy(self) -> "Rds":
        '''(experimental) Grants permission to modify database proxy.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBProxy.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toModifyDBProxy", []))

    @jsii.member(jsii_name="toModifyDBProxyEndpoint")
    def to_modify_db_proxy_endpoint(self) -> "Rds":
        '''(experimental) Grants permission to modify database proxy endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBProxyEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toModifyDBProxyEndpoint", []))

    @jsii.member(jsii_name="toModifyDBProxyTargetGroup")
    def to_modify_db_proxy_target_group(self) -> "Rds":
        '''(experimental) Grants permission to modify target group for a database proxy.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBProxyTargetGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toModifyDBProxyTargetGroup", []))

    @jsii.member(jsii_name="toModifyDBSnapshot")
    def to_modify_db_snapshot(self) -> "Rds":
        '''(experimental) Grants permission to update a manual DB snapshot, which can be encrypted or not encrypted, with a new engine version.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toModifyDBSnapshot", []))

    @jsii.member(jsii_name="toModifyDBSnapshotAttribute")
    def to_modify_db_snapshot_attribute(self) -> "Rds":
        '''(experimental) Grants permission to add an attribute and values to, or removes an attribute and values from, a manual DB snapshot.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBSnapshotAttribute.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toModifyDBSnapshotAttribute", []))

    @jsii.member(jsii_name="toModifyDBSubnetGroup")
    def to_modify_db_subnet_group(self) -> "Rds":
        '''(experimental) Grants permission to modify an existing DB subnet group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBSubnetGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toModifyDBSubnetGroup", []))

    @jsii.member(jsii_name="toModifyEventSubscription")
    def to_modify_event_subscription(self) -> "Rds":
        '''(experimental) Grants permission to modify an existing RDS event notification subscription.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyEventSubscription.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toModifyEventSubscription", []))

    @jsii.member(jsii_name="toModifyGlobalCluster")
    def to_modify_global_cluster(self) -> "Rds":
        '''(experimental) Grants permission to modify a setting for an Amazon Aurora global cluster.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyGlobalCluster.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toModifyGlobalCluster", []))

    @jsii.member(jsii_name="toModifyOptionGroup")
    def to_modify_option_group(self) -> "Rds":
        '''(experimental) Grants permission to modify an existing option group.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyOptionGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toModifyOptionGroup", []))

    @jsii.member(jsii_name="toPromoteReadReplica")
    def to_promote_read_replica(self) -> "Rds":
        '''(experimental) Grants permission to promote a Read Replica DB instance to a standalone DB instance.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_PromoteReadReplica.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toPromoteReadReplica", []))

    @jsii.member(jsii_name="toPromoteReadReplicaDBCluster")
    def to_promote_read_replica_db_cluster(self) -> "Rds":
        '''(experimental) Grants permission to promote a Read Replica DB cluster to a standalone DB cluster.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_PromoteReadReplicaDBCluster.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toPromoteReadReplicaDBCluster", []))

    @jsii.member(jsii_name="toPurchaseReservedDBInstancesOffering")
    def to_purchase_reserved_db_instances_offering(self) -> "Rds":
        '''(experimental) Grants permission to purchase a reserved DB instance offering.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_PurchaseReservedDBInstancesOffering.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toPurchaseReservedDBInstancesOffering", []))

    @jsii.member(jsii_name="toRebootDBInstance")
    def to_reboot_db_instance(self) -> "Rds":
        '''(experimental) Grants permission to restart the database engine service.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RebootDBInstance.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toRebootDBInstance", []))

    @jsii.member(jsii_name="toRegisterDBProxyTargets")
    def to_register_db_proxy_targets(self) -> "Rds":
        '''(experimental) Grants permission to add targets to a database proxy target group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RegisterDBProxyTargets.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toRegisterDBProxyTargets", []))

    @jsii.member(jsii_name="toRemoveFromGlobalCluster")
    def to_remove_from_global_cluster(self) -> "Rds":
        '''(experimental) Grants permission to detach an Aurora secondary cluster from an Aurora global database cluster.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RemoveFromGlobalCluster.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toRemoveFromGlobalCluster", []))

    @jsii.member(jsii_name="toRemoveRoleFromDBCluster")
    def to_remove_role_from_db_cluster(self) -> "Rds":
        '''(experimental) Grants permission to disassociate an AWS Identity and Access Management (IAM) role from an Amazon Aurora DB cluster.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RemoveRoleFromDBCluster.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toRemoveRoleFromDBCluster", []))

    @jsii.member(jsii_name="toRemoveRoleFromDBInstance")
    def to_remove_role_from_db_instance(self) -> "Rds":
        '''(experimental) Grants permission to disassociate an AWS Identity and Access Management (IAM) role from a DB instance.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RemoveRoleFromDBInstance.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toRemoveRoleFromDBInstance", []))

    @jsii.member(jsii_name="toRemoveSourceIdentifierFromSubscription")
    def to_remove_source_identifier_from_subscription(self) -> "Rds":
        '''(experimental) Grants permission to remove a source identifier from an existing RDS event notification subscription.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RemoveSourceIdentifierFromSubscription.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toRemoveSourceIdentifierFromSubscription", []))

    @jsii.member(jsii_name="toRemoveTagsFromResource")
    def to_remove_tags_from_resource(self) -> "Rds":
        '''(experimental) Grants permission to remove metadata tags from an Amazon RDS resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RemoveTagsFromResource.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toRemoveTagsFromResource", []))

    @jsii.member(jsii_name="toResetDBClusterParameterGroup")
    def to_reset_db_cluster_parameter_group(self) -> "Rds":
        '''(experimental) Grants permission to modify the parameters of a DB cluster parameter group to the default value.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ResetDBClusterParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toResetDBClusterParameterGroup", []))

    @jsii.member(jsii_name="toResetDBParameterGroup")
    def to_reset_db_parameter_group(self) -> "Rds":
        '''(experimental) Grants permission to modify the parameters of a DB parameter group to the engine/system default value.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ResetDBParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toResetDBParameterGroup", []))

    @jsii.member(jsii_name="toRestoreDBClusterFromS3")
    def to_restore_db_cluster_from_s3(self) -> "Rds":
        '''(experimental) Grants permission to create an Amazon Aurora DB cluster from data stored in an Amazon S3 bucket.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()
        - .ifDatabaseEngine()
        - .ifDatabaseName()
        - .ifStorageEncrypted()

        Dependent actions:

        - iam:PassRole
        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RestoreDBClusterFromS3.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toRestoreDBClusterFromS3", []))

    @jsii.member(jsii_name="toRestoreDBClusterFromSnapshot")
    def to_restore_db_cluster_from_snapshot(self) -> "Rds":
        '''(experimental) Grants permission to create a new DB cluster from a DB cluster snapshot.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        Dependent actions:

        - iam:PassRole
        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RestoreDBClusterFromSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toRestoreDBClusterFromSnapshot", []))

    @jsii.member(jsii_name="toRestoreDBClusterToPointInTime")
    def to_restore_db_cluster_to_point_in_time(self) -> "Rds":
        '''(experimental) Grants permission to restore a DB cluster to an arbitrary point in time.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        Dependent actions:

        - iam:PassRole
        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RestoreDBClusterToPointInTime.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toRestoreDBClusterToPointInTime", []))

    @jsii.member(jsii_name="toRestoreDBInstanceFromDBSnapshot")
    def to_restore_db_instance_from_db_snapshot(self) -> "Rds":
        '''(experimental) Grants permission to create a new DB instance from a DB snapshot.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        Dependent actions:

        - iam:PassRole
        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RestoreDBInstanceFromDBSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toRestoreDBInstanceFromDBSnapshot", []))

    @jsii.member(jsii_name="toRestoreDBInstanceFromS3")
    def to_restore_db_instance_from_s3(self) -> "Rds":
        '''(experimental) Grants permission to create a new DB instance from an Amazon S3 bucket.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        Dependent actions:

        - iam:PassRole
        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RestoreDBInstanceFromS3.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toRestoreDBInstanceFromS3", []))

    @jsii.member(jsii_name="toRestoreDBInstanceToPointInTime")
    def to_restore_db_instance_to_point_in_time(self) -> "Rds":
        '''(experimental) Grants permission to restore a DB instance to an arbitrary point in time.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        Dependent actions:

        - iam:PassRole
        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RestoreDBInstanceToPointInTime.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toRestoreDBInstanceToPointInTime", []))

    @jsii.member(jsii_name="toRevokeDBSecurityGroupIngress")
    def to_revoke_db_security_group_ingress(self) -> "Rds":
        '''(experimental) Grants permission to revoke ingress from a DBSecurityGroup for previously authorized IP ranges or EC2 or VPC Security Groups.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RevokeDBSecurityGroupIngress.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toRevokeDBSecurityGroupIngress", []))

    @jsii.member(jsii_name="toStartActivityStream")
    def to_start_activity_stream(self) -> "Rds":
        '''(experimental) Grants permission to start Activity Stream.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StartActivityStream.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toStartActivityStream", []))

    @jsii.member(jsii_name="toStartDBCluster")
    def to_start_db_cluster(self) -> "Rds":
        '''(experimental) Starts the DB cluster.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StartDBCluster.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toStartDBCluster", []))

    @jsii.member(jsii_name="toStartDBInstance")
    def to_start_db_instance(self) -> "Rds":
        '''(experimental) Grants permission to start the DB instance.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StartDBInstance.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toStartDBInstance", []))

    @jsii.member(jsii_name="toStartExportTask")
    def to_start_export_task(self) -> "Rds":
        '''(experimental) Grants permission to start a new Export task for a DB snapshot.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StartExportTask.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toStartExportTask", []))

    @jsii.member(jsii_name="toStopActivityStream")
    def to_stop_activity_stream(self) -> "Rds":
        '''(experimental) Grants permission to stop Activity Stream.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StopActivityStream.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toStopActivityStream", []))

    @jsii.member(jsii_name="toStopDBCluster")
    def to_stop_db_cluster(self) -> "Rds":
        '''(experimental) Grants permission to stop the DB cluster.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StopDBCluster.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toStopDBCluster", []))

    @jsii.member(jsii_name="toStopDBInstance")
    def to_stop_db_instance(self) -> "Rds":
        '''(experimental) Grants permission to stop the DB instance.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StopDBInstance.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toStopDBInstance", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class RdsData(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.RdsData"):
    '''(experimental) Statement provider for service `rds-data <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonrdsdataapi.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `rds-data <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonrdsdataapi.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(RdsData, self, [sid])

    @jsii.member(jsii_name="onCluster")
    def on_cluster(
        self,
        db_cluster_instance_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "RdsData":
        '''(experimental) Adds a resource of type cluster to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Aurora.Managing.html

        :param db_cluster_instance_name: - Identifier for the dbClusterInstanceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifAwsTagKeys()

        :stability: experimental
        '''
        return typing.cast("RdsData", jsii.invoke(self, "onCluster", [db_cluster_instance_name, account, region, partition]))

    @jsii.member(jsii_name="toBatchExecuteStatement")
    def to_batch_execute_statement(self) -> "RdsData":
        '''(experimental) Grants permission to run a batch SQL statement over an array of data.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/rdsdataservice/latest/APIReference/API_BatchExecuteStatement.html

        :stability: experimental
        '''
        return typing.cast("RdsData", jsii.invoke(self, "toBatchExecuteStatement", []))

    @jsii.member(jsii_name="toBeginTransaction")
    def to_begin_transaction(self) -> "RdsData":
        '''(experimental) Grants permission to start a SQL transaction.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/rdsdataservice/latest/APIReference/API_BeginTransaction.html

        :stability: experimental
        '''
        return typing.cast("RdsData", jsii.invoke(self, "toBeginTransaction", []))

    @jsii.member(jsii_name="toCommitTransaction")
    def to_commit_transaction(self) -> "RdsData":
        '''(experimental) Grants permission to end a SQL transaction started with the BeginTransaction operation and commits the changes.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - rds-data:BeginTransaction

        https://docs.aws.amazon.com/rdsdataservice/latest/APIReference/API_CommitTransaction.html

        :stability: experimental
        '''
        return typing.cast("RdsData", jsii.invoke(self, "toCommitTransaction", []))

    @jsii.member(jsii_name="toExecuteSql")
    def to_execute_sql(self) -> "RdsData":
        '''(experimental) Grants permission to run one or more SQL statements. This operation is deprecated. Use the BatchExecuteStatement or ExecuteStatement operation.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/rdsdataservice/latest/APIReference/API_ExecuteSql.html

        :stability: experimental
        '''
        return typing.cast("RdsData", jsii.invoke(self, "toExecuteSql", []))

    @jsii.member(jsii_name="toExecuteStatement")
    def to_execute_statement(self) -> "RdsData":
        '''(experimental) Grants permission to run a SQL statement against a database.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/rdsdataservice/latest/APIReference/API_ExecuteStatement.html

        :stability: experimental
        '''
        return typing.cast("RdsData", jsii.invoke(self, "toExecuteStatement", []))

    @jsii.member(jsii_name="toRollbackTransaction")
    def to_rollback_transaction(self) -> "RdsData":
        '''(experimental) Grants permission to perform a rollback of a transaction. Rolling back a transaction cancels its changes.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - rds-data:BeginTransaction

        https://docs.aws.amazon.com/rdsdataservice/latest/APIReference/API_RollbackTransaction.html

        :stability: experimental
        '''
        return typing.cast("RdsData", jsii.invoke(self, "toRollbackTransaction", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class RdsDb(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.RdsDb"):
    '''(experimental) Statement provider for service `rds-db <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonrdsiamauthentication.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `rds-db <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonrdsiamauthentication.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(RdsDb, self, [sid])

    @jsii.member(jsii_name="onDbUser")
    def on_db_user(
        self,
        dbi_resource_id: builtins.str,
        db_user_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "RdsDb":
        '''(experimental) Adds a resource of type db-user to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.DBAccounts.html

        :param dbi_resource_id: - Identifier for the dbiResourceId.
        :param db_user_name: - Identifier for the dbUserName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("RdsDb", jsii.invoke(self, "onDbUser", [dbi_resource_id, db_user_name, account, region, partition]))

    @jsii.member(jsii_name="toConnect")
    def to_connect(self) -> "RdsDb":
        '''(experimental) Allows IAM role or user to connect to RDS database.

        Access Level: Permissions management

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.IAMPolicy.html

        :stability: experimental
        '''
        return typing.cast("RdsDb", jsii.invoke(self, "toConnect", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Redshift(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Redshift",
):
    '''(experimental) Statement provider for service `redshift <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonredshift.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `redshift <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonredshift.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Redshift, self, [sid])

    @jsii.member(jsii_name="ifDbName")
    def if_db_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Redshift":
        '''(experimental) Filters access by the database name.

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-iam-access-control-overview.html#redshift-policy-resources.conditions

        Applies to actions:

        - .toGetClusterCredentials()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "ifDbName", [value, operator]))

    @jsii.member(jsii_name="ifDbUser")
    def if_db_user(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Redshift":
        '''(experimental) Filters access by the database user name.

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-iam-access-control-overview.html#redshift-policy-resources.conditions

        Applies to actions:

        - .toCreateClusterUser()
        - .toGetClusterCredentials()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "ifDbUser", [value, operator]))

    @jsii.member(jsii_name="ifDurationSeconds")
    def if_duration_seconds(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Redshift":
        '''(experimental) Filters access by the number of seconds until a temporary credential set expires.

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-iam-access-control-overview.html#redshift-policy-resources.conditions

        Applies to actions:

        - .toGetClusterCredentials()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "ifDurationSeconds", [value, operator]))

    @jsii.member(jsii_name="onCluster")
    def on_cluster(
        self,
        cluster_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Redshift":
        '''(experimental) Adds a resource of type cluster to the statement.

        https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-clusters.html

        :param cluster_name: - Identifier for the clusterName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "onCluster", [cluster_name, account, region, partition]))

    @jsii.member(jsii_name="onDbgroup")
    def on_dbgroup(
        self,
        cluster_name: builtins.str,
        db_group: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Redshift":
        '''(experimental) Adds a resource of type dbgroup to the statement.

        https://docs.aws.amazon.com/redshift/latest/dg/r_CREATE_GROUP.html

        :param cluster_name: - Identifier for the clusterName.
        :param db_group: - Identifier for the dbGroup.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "onDbgroup", [cluster_name, db_group, account, region, partition]))

    @jsii.member(jsii_name="onDbname")
    def on_dbname(
        self,
        cluster_name: builtins.str,
        db_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Redshift":
        '''(experimental) Adds a resource of type dbname to the statement.

        https://docs.aws.amazon.com/redshift/latest/dg/t_creating_database.html

        :param cluster_name: - Identifier for the clusterName.
        :param db_name: - Identifier for the dbName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "onDbname", [cluster_name, db_name, account, region, partition]))

    @jsii.member(jsii_name="onDbuser")
    def on_dbuser(
        self,
        cluster_name: builtins.str,
        db_user: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Redshift":
        '''(experimental) Adds a resource of type dbuser to the statement.

        https://docs.aws.amazon.com/redshift/latest/dg/r_Users.html

        :param cluster_name: - Identifier for the clusterName.
        :param db_user: - Identifier for the dbUser.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "onDbuser", [cluster_name, db_user, account, region, partition]))

    @jsii.member(jsii_name="onEventsubscription")
    def on_eventsubscription(
        self,
        event_subscription_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Redshift":
        '''(experimental) Adds a resource of type eventsubscription to the statement.

        https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-events.html

        :param event_subscription_name: - Identifier for the eventSubscriptionName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "onEventsubscription", [event_subscription_name, account, region, partition]))

    @jsii.member(jsii_name="onHsmclientcertificate")
    def on_hsmclientcertificate(
        self,
        h_sm_client_certificate_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Redshift":
        '''(experimental) Adds a resource of type hsmclientcertificate to the statement.

        https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-db-encryption.html#working-with-HSM

        :param h_sm_client_certificate_id: - Identifier for the hSMClientCertificateId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "onHsmclientcertificate", [h_sm_client_certificate_id, account, region, partition]))

    @jsii.member(jsii_name="onHsmconfiguration")
    def on_hsmconfiguration(
        self,
        h_sm_configuration_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Redshift":
        '''(experimental) Adds a resource of type hsmconfiguration to the statement.

        https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-db-encryption.html#working-with-HSM

        :param h_sm_configuration_id: - Identifier for the hSMConfigurationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "onHsmconfiguration", [h_sm_configuration_id, account, region, partition]))

    @jsii.member(jsii_name="onParametergroup")
    def on_parametergroup(
        self,
        parameter_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Redshift":
        '''(experimental) Adds a resource of type parametergroup to the statement.

        https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-parameter-groups.html

        :param parameter_group_name: - Identifier for the parameterGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "onParametergroup", [parameter_group_name, account, region, partition]))

    @jsii.member(jsii_name="onSecuritygroup")
    def on_securitygroup(
        self,
        security_group_name: builtins.str,
        owner: builtins.str,
        ec2_security_group_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Redshift":
        '''(experimental) Adds a resource of type securitygroup to the statement.

        https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-security-groups.html

        :param security_group_name: - Identifier for the securityGroupName.
        :param owner: - Identifier for the owner.
        :param ec2_security_group_id: - Identifier for the ec2SecurityGroupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "onSecuritygroup", [security_group_name, owner, ec2_security_group_id, account, region, partition]))

    @jsii.member(jsii_name="onSecuritygroupingressCidr")
    def on_securitygroupingress_cidr(
        self,
        security_group_name: builtins.str,
        ip_range: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Redshift":
        '''(experimental) Adds a resource of type securitygroupingress-cidr to the statement.

        https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-security-groups.html

        :param security_group_name: - Identifier for the securityGroupName.
        :param ip_range: - Identifier for the ipRange.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "onSecuritygroupingressCidr", [security_group_name, ip_range, account, region, partition]))

    @jsii.member(jsii_name="onSecuritygroupingressEc2securitygroup")
    def on_securitygroupingress_ec2securitygroup(
        self,
        security_group_name: builtins.str,
        owner: builtins.str,
        ece2_securitygroup_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Redshift":
        '''(experimental) Adds a resource of type securitygroupingress-ec2securitygroup to the statement.

        https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-security-groups.html

        :param security_group_name: - Identifier for the securityGroupName.
        :param owner: - Identifier for the owner.
        :param ece2_securitygroup_id: - Identifier for the ece2SecuritygroupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "onSecuritygroupingressEc2securitygroup", [security_group_name, owner, ece2_securitygroup_id, account, region, partition]))

    @jsii.member(jsii_name="onSnapshot")
    def on_snapshot(
        self,
        cluster_name: builtins.str,
        snapshot_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Redshift":
        '''(experimental) Adds a resource of type snapshot to the statement.

        https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-snapshots.html

        :param cluster_name: - Identifier for the clusterName.
        :param snapshot_name: - Identifier for the snapshotName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "onSnapshot", [cluster_name, snapshot_name, account, region, partition]))

    @jsii.member(jsii_name="onSnapshotcopygrant")
    def on_snapshotcopygrant(
        self,
        snapshot_copy_grant_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Redshift":
        '''(experimental) Adds a resource of type snapshotcopygrant to the statement.

        https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-db-encryption.html#configure-snapshot-copy-grant

        :param snapshot_copy_grant_name: - Identifier for the snapshotCopyGrantName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "onSnapshotcopygrant", [snapshot_copy_grant_name, account, region, partition]))

    @jsii.member(jsii_name="onSnapshotschedule")
    def on_snapshotschedule(
        self,
        parameter_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Redshift":
        '''(experimental) Adds a resource of type snapshotschedule to the statement.

        https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-snapshots.html

        :param parameter_group_name: - Identifier for the parameterGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "onSnapshotschedule", [parameter_group_name, account, region, partition]))

    @jsii.member(jsii_name="onSubnetgroup")
    def on_subnetgroup(
        self,
        subnet_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Redshift":
        '''(experimental) Adds a resource of type subnetgroup to the statement.

        https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-cluster-subnet-groups.html

        :param subnet_group_name: - Identifier for the subnetGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "onSubnetgroup", [subnet_group_name, account, region, partition]))

    @jsii.member(jsii_name="toAcceptReservedNodeExchange")
    def to_accept_reserved_node_exchange(self) -> "Redshift":
        '''(experimental) Grants permission to exchange a DC1 reserved node for a DC2 reserved node with no changes to the configuration.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_AcceptReservedNodeExchange.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toAcceptReservedNodeExchange", []))

    @jsii.member(jsii_name="toAuthorizeClusterSecurityGroupIngress")
    def to_authorize_cluster_security_group_ingress(self) -> "Redshift":
        '''(experimental) Grants permission to add an inbound (ingress) rule to an Amazon Redshift security group.

        Access Level: Permissions management

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_AuthorizeClusterSecurityGroupIngress.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toAuthorizeClusterSecurityGroupIngress", []))

    @jsii.member(jsii_name="toAuthorizeSnapshotAccess")
    def to_authorize_snapshot_access(self) -> "Redshift":
        '''(experimental) Grants permission to the specified AWS account to restore a snapshot.

        Access Level: Permissions management

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_AuthorizeSnapshotAccess.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toAuthorizeSnapshotAccess", []))

    @jsii.member(jsii_name="toBatchDeleteClusterSnapshots")
    def to_batch_delete_cluster_snapshots(self) -> "Redshift":
        '''(experimental) Grants permission to delete snapshots in a batch of size upto 100.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_BatchDeleteClusterSnapshots.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toBatchDeleteClusterSnapshots", []))

    @jsii.member(jsii_name="toBatchModifyClusterSnapshots")
    def to_batch_modify_cluster_snapshots(self) -> "Redshift":
        '''(experimental) Grants permission to modify settings for a list of snapshots.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_BatchModifyClusterSnapshots.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toBatchModifyClusterSnapshots", []))

    @jsii.member(jsii_name="toCancelQuery")
    def to_cancel_query(self) -> "Redshift":
        '''(experimental) Grants permission to cancel a query through the Amazon Redshift console.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCancelQuery", []))

    @jsii.member(jsii_name="toCancelQuerySession")
    def to_cancel_query_session(self) -> "Redshift":
        '''(experimental) Grants permission to see queries in the Amazon Redshift console.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCancelQuerySession", []))

    @jsii.member(jsii_name="toCancelResize")
    def to_cancel_resize(self) -> "Redshift":
        '''(experimental) Grants permission to cancel a resize operation.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_CancelResize.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCancelResize", []))

    @jsii.member(jsii_name="toCopyClusterSnapshot")
    def to_copy_cluster_snapshot(self) -> "Redshift":
        '''(experimental) Grants permission to copy a cluster snapshot.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_CopyClusterSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCopyClusterSnapshot", []))

    @jsii.member(jsii_name="toCreateCluster")
    def to_create_cluster(self) -> "Redshift":
        '''(experimental) Grants permission to create a cluster.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_CreateCluster.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCreateCluster", []))

    @jsii.member(jsii_name="toCreateClusterParameterGroup")
    def to_create_cluster_parameter_group(self) -> "Redshift":
        '''(experimental) Grants permission to create an Amazon Redshift parameter group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_CreateClusterParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCreateClusterParameterGroup", []))

    @jsii.member(jsii_name="toCreateClusterSecurityGroup")
    def to_create_cluster_security_group(self) -> "Redshift":
        '''(experimental) Grants permission to create an Amazon Redshift security group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_CreateClusterSecurityGroup.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCreateClusterSecurityGroup", []))

    @jsii.member(jsii_name="toCreateClusterSnapshot")
    def to_create_cluster_snapshot(self) -> "Redshift":
        '''(experimental) Grants permission to create a manual snapshot of the specified cluster.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_CreateClusterSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCreateClusterSnapshot", []))

    @jsii.member(jsii_name="toCreateClusterSubnetGroup")
    def to_create_cluster_subnet_group(self) -> "Redshift":
        '''(experimental) Grants permission to create an Amazon Redshift subnet group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_CreateClusterSubnetGroup.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCreateClusterSubnetGroup", []))

    @jsii.member(jsii_name="toCreateClusterUser")
    def to_create_cluster_user(self) -> "Redshift":
        '''(experimental) Grants permission to automatically create the specified Amazon Redshift user if it does not exist.

        Access Level: Permissions management

        Possible conditions:

        - .ifDbUser()

        https://docs.aws.amazon.com/redshift/latest/mgmt/generating-iam-credentials-role-permissions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCreateClusterUser", []))

    @jsii.member(jsii_name="toCreateEventSubscription")
    def to_create_event_subscription(self) -> "Redshift":
        '''(experimental) Grants permission to create an Amazon Redshift event notification subscription.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_CreateEventSubscription.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCreateEventSubscription", []))

    @jsii.member(jsii_name="toCreateHsmClientCertificate")
    def to_create_hsm_client_certificate(self) -> "Redshift":
        '''(experimental) Grants permission to create an HSM client certificate that a cluster uses to connect to an HSM.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_CreateHsmClientCertificate.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCreateHsmClientCertificate", []))

    @jsii.member(jsii_name="toCreateHsmConfiguration")
    def to_create_hsm_configuration(self) -> "Redshift":
        '''(experimental) Grants permission to create an HSM configuration that contains information required by a cluster to store and use database encryption keys in a hardware security module (HSM).

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_CreateHsmConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCreateHsmConfiguration", []))

    @jsii.member(jsii_name="toCreateSavedQuery")
    def to_create_saved_query(self) -> "Redshift":
        '''(experimental) Grants permission to create saved SQL queries through the Amazon Redshift console.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCreateSavedQuery", []))

    @jsii.member(jsii_name="toCreateScheduledAction")
    def to_create_scheduled_action(self) -> "Redshift":
        '''(experimental) Grants permission to create an Amazon Redshift scheduled action.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_CreateScheduledAction.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCreateScheduledAction", []))

    @jsii.member(jsii_name="toCreateSnapshotCopyGrant")
    def to_create_snapshot_copy_grant(self) -> "Redshift":
        '''(experimental) Grants permission to create a snapshot copy grant and encrypt copied snapshots in a destination AWS Region.

        Access Level: Permissions management

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_CreateSnapshotCopyGrant.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCreateSnapshotCopyGrant", []))

    @jsii.member(jsii_name="toCreateSnapshotSchedule")
    def to_create_snapshot_schedule(self) -> "Redshift":
        '''(experimental) Grants permission to create a snapshot schedule.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_CreateSnapshotSchedule.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCreateSnapshotSchedule", []))

    @jsii.member(jsii_name="toCreateTags")
    def to_create_tags(self) -> "Redshift":
        '''(experimental) Grants permission to add one or more tags to a specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_CreateTags.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCreateTags", []))

    @jsii.member(jsii_name="toDeleteCluster")
    def to_delete_cluster(self) -> "Redshift":
        '''(experimental) Grants permission to delete a previously provisioned cluster.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DeleteCluster.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDeleteCluster", []))

    @jsii.member(jsii_name="toDeleteClusterParameterGroup")
    def to_delete_cluster_parameter_group(self) -> "Redshift":
        '''(experimental) Grants permission to delete an Amazon Redshift parameter group.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DeleteClusterParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDeleteClusterParameterGroup", []))

    @jsii.member(jsii_name="toDeleteClusterSecurityGroup")
    def to_delete_cluster_security_group(self) -> "Redshift":
        '''(experimental) Grants permission to delete an Amazon Redshift security group.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DeleteClusterSecurityGroup.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDeleteClusterSecurityGroup", []))

    @jsii.member(jsii_name="toDeleteClusterSnapshot")
    def to_delete_cluster_snapshot(self) -> "Redshift":
        '''(experimental) Grants permission to delete a manual snapshot.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DeleteClusterSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDeleteClusterSnapshot", []))

    @jsii.member(jsii_name="toDeleteClusterSubnetGroup")
    def to_delete_cluster_subnet_group(self) -> "Redshift":
        '''(experimental) Grants permission to delete a cluster subnet group.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DeleteClusterSubnetGroup.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDeleteClusterSubnetGroup", []))

    @jsii.member(jsii_name="toDeleteEventSubscription")
    def to_delete_event_subscription(self) -> "Redshift":
        '''(experimental) Grants permission to delete an Amazon Redshift event notification subscription.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DeleteEventSubscription.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDeleteEventSubscription", []))

    @jsii.member(jsii_name="toDeleteHsmClientCertificate")
    def to_delete_hsm_client_certificate(self) -> "Redshift":
        '''(experimental) Grants permission to delete an HSM client certificate.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DeleteHsmClientCertificate.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDeleteHsmClientCertificate", []))

    @jsii.member(jsii_name="toDeleteHsmConfiguration")
    def to_delete_hsm_configuration(self) -> "Redshift":
        '''(experimental) Grants permission to delete an Amazon Redshift HSM configuration.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DeleteHsmConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDeleteHsmConfiguration", []))

    @jsii.member(jsii_name="toDeleteSavedQueries")
    def to_delete_saved_queries(self) -> "Redshift":
        '''(experimental) Grants permission to delete saved SQL queries through the Amazon Redshift console.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDeleteSavedQueries", []))

    @jsii.member(jsii_name="toDeleteScheduledAction")
    def to_delete_scheduled_action(self) -> "Redshift":
        '''(experimental) Grants permission to delete an Amazon Redshift scheduled action.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDeleteScheduledAction", []))

    @jsii.member(jsii_name="toDeleteSnapshotCopyGrant")
    def to_delete_snapshot_copy_grant(self) -> "Redshift":
        '''(experimental) Grants permission to delete a snapshot copy grant.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DeleteSnapshotCopyGrant.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDeleteSnapshotCopyGrant", []))

    @jsii.member(jsii_name="toDeleteSnapshotSchedule")
    def to_delete_snapshot_schedule(self) -> "Redshift":
        '''(experimental) Grants permission to delete a snapshot schedule.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DeleteSnapshotSchedule.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDeleteSnapshotSchedule", []))

    @jsii.member(jsii_name="toDeleteTags")
    def to_delete_tags(self) -> "Redshift":
        '''(experimental) Grants permission to delete a tag or tags from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DeleteTags.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDeleteTags", []))

    @jsii.member(jsii_name="toDescribeAccountAttributes")
    def to_describe_account_attributes(self) -> "Redshift":
        '''(experimental) Grants permission to describe attributes attached to the specified AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeAccountAttributes.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeAccountAttributes", []))

    @jsii.member(jsii_name="toDescribeClusterDbRevisions")
    def to_describe_cluster_db_revisions(self) -> "Redshift":
        '''(experimental) Grants permission to describe database revisions for a cluster.

        Access Level: List

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeClusterDbRevisions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeClusterDbRevisions", []))

    @jsii.member(jsii_name="toDescribeClusterParameterGroups")
    def to_describe_cluster_parameter_groups(self) -> "Redshift":
        '''(experimental) Grants permission to describe Amazon Redshift parameter groups, including parameter groups you created and the default parameter group.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeClusterParameterGroups.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeClusterParameterGroups", []))

    @jsii.member(jsii_name="toDescribeClusterParameters")
    def to_describe_cluster_parameters(self) -> "Redshift":
        '''(experimental) Grants permission to describe parameters contained within an Amazon Redshift parameter group.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeClusterParameters.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeClusterParameters", []))

    @jsii.member(jsii_name="toDescribeClusters")
    def to_describe_clusters(self) -> "Redshift":
        '''(experimental) Grants permission to describe properties of provisioned clusters.

        Access Level: List

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeClusters.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeClusters", []))

    @jsii.member(jsii_name="toDescribeClusterSecurityGroups")
    def to_describe_cluster_security_groups(self) -> "Redshift":
        '''(experimental) Grants permission to describe Amazon Redshift security groups.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeClusterSecurityGroups.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeClusterSecurityGroups", []))

    @jsii.member(jsii_name="toDescribeClusterSnapshots")
    def to_describe_cluster_snapshots(self) -> "Redshift":
        '''(experimental) Grants permission to describe one or more snapshot objects, which contain metadata about your cluster snapshots.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeClusterSnapshots.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeClusterSnapshots", []))

    @jsii.member(jsii_name="toDescribeClusterSubnetGroups")
    def to_describe_cluster_subnet_groups(self) -> "Redshift":
        '''(experimental) Grants permission to describe one or more cluster subnet group objects, which contain metadata about your cluster subnet groups.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeClusterSubnetGroups.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeClusterSubnetGroups", []))

    @jsii.member(jsii_name="toDescribeClusterTracks")
    def to_describe_cluster_tracks(self) -> "Redshift":
        '''(experimental) Grants permission to describe available maintenance tracks.

        Access Level: List

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeClusterTracks.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeClusterTracks", []))

    @jsii.member(jsii_name="toDescribeClusterVersions")
    def to_describe_cluster_versions(self) -> "Redshift":
        '''(experimental) Grants permission to describe available Amazon Redshift cluster versions.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeClusterVersions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeClusterVersions", []))

    @jsii.member(jsii_name="toDescribeDefaultClusterParameters")
    def to_describe_default_cluster_parameters(self) -> "Redshift":
        '''(experimental) Grants permission to describe parameter settings for a parameter group family.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeDefaultClusterParameters.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeDefaultClusterParameters", []))

    @jsii.member(jsii_name="toDescribeEventCategories")
    def to_describe_event_categories(self) -> "Redshift":
        '''(experimental) Grants permission to describe event categories for all event source types, or for a specified source type.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeEventCategories.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeEventCategories", []))

    @jsii.member(jsii_name="toDescribeEvents")
    def to_describe_events(self) -> "Redshift":
        '''(experimental) Grants permission to describe events related to clusters, security groups, snapshots, and parameter groups for the past 14 days.

        Access Level: List

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeEvents.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeEvents", []))

    @jsii.member(jsii_name="toDescribeEventSubscriptions")
    def to_describe_event_subscriptions(self) -> "Redshift":
        '''(experimental) Grants permission to describe Amazon Redshift event notification subscriptions for the specified AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeEventSubscriptions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeEventSubscriptions", []))

    @jsii.member(jsii_name="toDescribeHsmClientCertificates")
    def to_describe_hsm_client_certificates(self) -> "Redshift":
        '''(experimental) Grants permission to describe HSM client certificates.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeHsmClientCertificates.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeHsmClientCertificates", []))

    @jsii.member(jsii_name="toDescribeHsmConfigurations")
    def to_describe_hsm_configurations(self) -> "Redshift":
        '''(experimental) Grants permission to describe Amazon Redshift HSM configurations.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeHsmConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeHsmConfigurations", []))

    @jsii.member(jsii_name="toDescribeLoggingStatus")
    def to_describe_logging_status(self) -> "Redshift":
        '''(experimental) Grants permission to describe whether information, such as queries and connection attempts, is being logged for a cluster.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeLoggingStatus.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeLoggingStatus", []))

    @jsii.member(jsii_name="toDescribeNodeConfigurationOptions")
    def to_describe_node_configuration_options(self) -> "Redshift":
        '''(experimental) Grants permission to describe properties of possible node configurations such as node type, number of nodes, and disk usage for the specified action type.

        Access Level: List

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeNodeConfigurationOptions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeNodeConfigurationOptions", []))

    @jsii.member(jsii_name="toDescribeOrderableClusterOptions")
    def to_describe_orderable_cluster_options(self) -> "Redshift":
        '''(experimental) Grants permission to describe orderable cluster options.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeOrderableClusterOptions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeOrderableClusterOptions", []))

    @jsii.member(jsii_name="toDescribeQuery")
    def to_describe_query(self) -> "Redshift":
        '''(experimental) Grants permission to describe a query through the Amazon Redshift console.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeQuery", []))

    @jsii.member(jsii_name="toDescribeReservedNodeOfferings")
    def to_describe_reserved_node_offerings(self) -> "Redshift":
        '''(experimental) Grants permission to describe available reserved node offerings by Amazon Redshift.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeReservedNodeOfferings.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeReservedNodeOfferings", []))

    @jsii.member(jsii_name="toDescribeReservedNodes")
    def to_describe_reserved_nodes(self) -> "Redshift":
        '''(experimental) Grants permission to describe the reserved nodes.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeReservedNodes.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeReservedNodes", []))

    @jsii.member(jsii_name="toDescribeResize")
    def to_describe_resize(self) -> "Redshift":
        '''(experimental) Grants permission to describe the last resize operation for a cluster.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeResize.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeResize", []))

    @jsii.member(jsii_name="toDescribeSavedQueries")
    def to_describe_saved_queries(self) -> "Redshift":
        '''(experimental) Grants permission to describe saved queries through the Amazon Redshift console.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeSavedQueries", []))

    @jsii.member(jsii_name="toDescribeScheduledActions")
    def to_describe_scheduled_actions(self) -> "Redshift":
        '''(experimental) Grants permission to describe created Amazon Redshift scheduled actions.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeScheduledActions", []))

    @jsii.member(jsii_name="toDescribeSnapshotCopyGrants")
    def to_describe_snapshot_copy_grants(self) -> "Redshift":
        '''(experimental) Grants permission to describe snapshot copy grants owned by the specified AWS account in the destination AWS Region.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeSnapshotCopyGrants.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeSnapshotCopyGrants", []))

    @jsii.member(jsii_name="toDescribeSnapshotSchedules")
    def to_describe_snapshot_schedules(self) -> "Redshift":
        '''(experimental) Grants permission to describe snapshot schedules.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeSnapshotSchedules.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeSnapshotSchedules", []))

    @jsii.member(jsii_name="toDescribeStorage")
    def to_describe_storage(self) -> "Redshift":
        '''(experimental) Grants permission to describe account level backups storage size and provisional storage.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeStorage.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeStorage", []))

    @jsii.member(jsii_name="toDescribeTable")
    def to_describe_table(self) -> "Redshift":
        '''(experimental) Grants permission to describe a table through the Amazon Redshift console.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeTable", []))

    @jsii.member(jsii_name="toDescribeTableRestoreStatus")
    def to_describe_table_restore_status(self) -> "Redshift":
        '''(experimental) Grants permission to describe status of one or more table restore requests made using the RestoreTableFromClusterSnapshot API action.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeTableRestoreStatus.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeTableRestoreStatus", []))

    @jsii.member(jsii_name="toDescribeTags")
    def to_describe_tags(self) -> "Redshift":
        '''(experimental) Grants permission to describe tags.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeTags.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeTags", []))

    @jsii.member(jsii_name="toDisableLogging")
    def to_disable_logging(self) -> "Redshift":
        '''(experimental) Grants permission to disable logging information, such as queries and connection attempts, for a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DisableLogging.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDisableLogging", []))

    @jsii.member(jsii_name="toDisableSnapshotCopy")
    def to_disable_snapshot_copy(self) -> "Redshift":
        '''(experimental) Grants permission to disable the automatic copy of snapshots for a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DisableSnapshotCopy.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDisableSnapshotCopy", []))

    @jsii.member(jsii_name="toEnableLogging")
    def to_enable_logging(self) -> "Redshift":
        '''(experimental) Grants permission to enable logging information, such as queries and connection attempts, for a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_EnableLogging.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toEnableLogging", []))

    @jsii.member(jsii_name="toEnableSnapshotCopy")
    def to_enable_snapshot_copy(self) -> "Redshift":
        '''(experimental) Grants permission to enable the automatic copy of snapshots for a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_EnableSnapshotCopy.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toEnableSnapshotCopy", []))

    @jsii.member(jsii_name="toExecuteQuery")
    def to_execute_query(self) -> "Redshift":
        '''(experimental) Grants permission to execute a query through the Amazon Redshift console.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toExecuteQuery", []))

    @jsii.member(jsii_name="toFetchResults")
    def to_fetch_results(self) -> "Redshift":
        '''(experimental) Grants permission to fetch query results through the Amazon Redshift console.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toFetchResults", []))

    @jsii.member(jsii_name="toGetClusterCredentials")
    def to_get_cluster_credentials(self) -> "Redshift":
        '''(experimental) Grants permission to get temporary credentials to access an Amazon Redshift database by the specified AWS account.

        Access Level: Write

        Possible conditions:

        - .ifDbName()
        - .ifDbUser()
        - .ifDurationSeconds()

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_GetClusterCredentials.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toGetClusterCredentials", []))

    @jsii.member(jsii_name="toGetReservedNodeExchangeOfferings")
    def to_get_reserved_node_exchange_offerings(self) -> "Redshift":
        '''(experimental) Grants permission to get an array of DC2 ReservedNodeOfferings that matches the payment type, term, and usage price of the given DC1 reserved node.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_GetReservedNodeExchangeOfferings.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toGetReservedNodeExchangeOfferings", []))

    @jsii.member(jsii_name="toJoinGroup")
    def to_join_group(self) -> "Redshift":
        '''(experimental) Grants permission to join the specified Amazon Redshift group.

        Access Level: Permissions management

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_GetClusterCredentials.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toJoinGroup", []))

    @jsii.member(jsii_name="toListDatabases")
    def to_list_databases(self) -> "Redshift":
        '''(experimental) Grants permission to list databases through the Amazon Redshift console.

        Access Level: List

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toListDatabases", []))

    @jsii.member(jsii_name="toListSavedQueries")
    def to_list_saved_queries(self) -> "Redshift":
        '''(experimental) Grants permission to list saved queries through the Amazon Redshift console.

        Access Level: List

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toListSavedQueries", []))

    @jsii.member(jsii_name="toListSchemas")
    def to_list_schemas(self) -> "Redshift":
        '''(experimental) Grants permission to list schemas through the Amazon Redshift console.

        Access Level: List

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toListSchemas", []))

    @jsii.member(jsii_name="toListTables")
    def to_list_tables(self) -> "Redshift":
        '''(experimental) Grants permission to list tables through the Amazon Redshift console.

        Access Level: List

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toListTables", []))

    @jsii.member(jsii_name="toModifyCluster")
    def to_modify_cluster(self) -> "Redshift":
        '''(experimental) Grants permission to modify the settings of a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_ModifyCluster.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toModifyCluster", []))

    @jsii.member(jsii_name="toModifyClusterDbRevision")
    def to_modify_cluster_db_revision(self) -> "Redshift":
        '''(experimental) Grants permission to modify the database revision of a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_ModifyClusterDbRevision.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toModifyClusterDbRevision", []))

    @jsii.member(jsii_name="toModifyClusterIamRoles")
    def to_modify_cluster_iam_roles(self) -> "Redshift":
        '''(experimental) Grants permission to modify the list of AWS Identity and Access Management (IAM) roles that can be used by a cluster to access other AWS services.

        Access Level: Permissions management

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_ModifyClusterIamRoles.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toModifyClusterIamRoles", []))

    @jsii.member(jsii_name="toModifyClusterMaintenance")
    def to_modify_cluster_maintenance(self) -> "Redshift":
        '''(experimental) Grants permission to modify the maintenance settings of a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_ModifyClusterMaintenance.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toModifyClusterMaintenance", []))

    @jsii.member(jsii_name="toModifyClusterParameterGroup")
    def to_modify_cluster_parameter_group(self) -> "Redshift":
        '''(experimental) Grants permission to modify the parameters of a parameter group.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_ModifyClusterParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toModifyClusterParameterGroup", []))

    @jsii.member(jsii_name="toModifyClusterSnapshot")
    def to_modify_cluster_snapshot(self) -> "Redshift":
        '''(experimental) Grants permission to modify the settings of a snapshot.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_ModifyClusterSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toModifyClusterSnapshot", []))

    @jsii.member(jsii_name="toModifyClusterSnapshotSchedule")
    def to_modify_cluster_snapshot_schedule(self) -> "Redshift":
        '''(experimental) Grants permission to modify a snapshot schedule for a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_ModifyClusterSnapshotSchedule.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toModifyClusterSnapshotSchedule", []))

    @jsii.member(jsii_name="toModifyClusterSubnetGroup")
    def to_modify_cluster_subnet_group(self) -> "Redshift":
        '''(experimental) Grants permission to modify a cluster subnet group to include the specified list of VPC subnets.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_ModifyClusterSubnetGroup.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toModifyClusterSubnetGroup", []))

    @jsii.member(jsii_name="toModifyEventSubscription")
    def to_modify_event_subscription(self) -> "Redshift":
        '''(experimental) Grants permission to modify an existing Amazon Redshift event notification subscription.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_ModifyEventSubscription.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toModifyEventSubscription", []))

    @jsii.member(jsii_name="toModifySavedQuery")
    def to_modify_saved_query(self) -> "Redshift":
        '''(experimental) Grants permission to modify an existing saved query through the Amazon Redshift console.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toModifySavedQuery", []))

    @jsii.member(jsii_name="toModifyScheduledAction")
    def to_modify_scheduled_action(self) -> "Redshift":
        '''(experimental) Grants permission to modify an existing Amazon Redshift scheduled action.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_ModifyScheduledAction.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toModifyScheduledAction", []))

    @jsii.member(jsii_name="toModifySnapshotCopyRetentionPeriod")
    def to_modify_snapshot_copy_retention_period(self) -> "Redshift":
        '''(experimental) Grants permission to modify the number of days to retain snapshots in the destination AWS Region after they are copied from the source AWS Region.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_ModifySnapshotCopyRetentionPeriod.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toModifySnapshotCopyRetentionPeriod", []))

    @jsii.member(jsii_name="toModifySnapshotSchedule")
    def to_modify_snapshot_schedule(self) -> "Redshift":
        '''(experimental) Grants permission to modify a snapshot schedule.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_ModifySnapshotSchedule.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toModifySnapshotSchedule", []))

    @jsii.member(jsii_name="toPauseCluster")
    def to_pause_cluster(self) -> "Redshift":
        '''(experimental) Grants permission to pause a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_PauseCluster.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toPauseCluster", []))

    @jsii.member(jsii_name="toPurchaseReservedNodeOffering")
    def to_purchase_reserved_node_offering(self) -> "Redshift":
        '''(experimental) Grants permission to purchase a reserved node.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_PurchaseReservedNodeOffering.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toPurchaseReservedNodeOffering", []))

    @jsii.member(jsii_name="toRebootCluster")
    def to_reboot_cluster(self) -> "Redshift":
        '''(experimental) Grants permission to reboot a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_RebootCluster.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toRebootCluster", []))

    @jsii.member(jsii_name="toResetClusterParameterGroup")
    def to_reset_cluster_parameter_group(self) -> "Redshift":
        '''(experimental) Grants permission to set one or more parameters of a parameter group to their default values and set the source values of the parameters to "engine-default".

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_ResetClusterParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toResetClusterParameterGroup", []))

    @jsii.member(jsii_name="toResizeCluster")
    def to_resize_cluster(self) -> "Redshift":
        '''(experimental) Grants permission to change the size of a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_ResizeCluster.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toResizeCluster", []))

    @jsii.member(jsii_name="toRestoreFromClusterSnapshot")
    def to_restore_from_cluster_snapshot(self) -> "Redshift":
        '''(experimental) Grants permission to create a cluster from a snapshot.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_RestoreFromClusterSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toRestoreFromClusterSnapshot", []))

    @jsii.member(jsii_name="toRestoreTableFromClusterSnapshot")
    def to_restore_table_from_cluster_snapshot(self) -> "Redshift":
        '''(experimental) Grants permission to create a table from a table in an Amazon Redshift cluster snapshot.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_RestoreTableFromClusterSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toRestoreTableFromClusterSnapshot", []))

    @jsii.member(jsii_name="toResumeCluster")
    def to_resume_cluster(self) -> "Redshift":
        '''(experimental) Grants permission to resume a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_ResumeCluster.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toResumeCluster", []))

    @jsii.member(jsii_name="toRevokeClusterSecurityGroupIngress")
    def to_revoke_cluster_security_group_ingress(self) -> "Redshift":
        '''(experimental) Grants permission to revoke an ingress rule in an Amazon Redshift security group for a previously authorized IP range or Amazon EC2 security group.

        Access Level: Permissions management

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_RevokeClusterSecurityGroupIngress.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toRevokeClusterSecurityGroupIngress", []))

    @jsii.member(jsii_name="toRevokeSnapshotAccess")
    def to_revoke_snapshot_access(self) -> "Redshift":
        '''(experimental) Grants permission to revoke access from the specified AWS account to restore a snapshot.

        Access Level: Permissions management

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_RevokeSnapshotAccess.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toRevokeSnapshotAccess", []))

    @jsii.member(jsii_name="toRotateEncryptionKey")
    def to_rotate_encryption_key(self) -> "Redshift":
        '''(experimental) Grants permission to rotate an encryption key for a cluster.

        Access Level: Permissions management

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_RotateEncryptionKey.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toRotateEncryptionKey", []))

    @jsii.member(jsii_name="toViewQueriesFromConsole")
    def to_view_queries_from_console(self) -> "Redshift":
        '''(experimental) Grants permission to view query results through the Amazon Redshift console.

        Access Level: List

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toViewQueriesFromConsole", []))

    @jsii.member(jsii_name="toViewQueriesInConsole")
    def to_view_queries_in_console(self) -> "Redshift":
        '''(experimental) Grants permission to terminate running queries and loads through the Amazon Redshift console.

        Access Level: List

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toViewQueriesInConsole", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class RedshiftData(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.RedshiftData",
):
    '''(experimental) Statement provider for service `redshift-data <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonredshiftdataapi.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `redshift-data <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonredshiftdataapi.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(RedshiftData, self, [sid])

    @jsii.member(jsii_name="ifStatementOwnerIamUserid")
    def if_statement_owner_iam_userid(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "RedshiftData":
        '''(experimental) Filters access by statement owner iam userid.

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-iam-access-control-overview.html#redshift-policy-resources.conditions

        Applies to actions:

        - .toCancelStatement()
        - .toDescribeStatement()
        - .toGetStatementResult()
        - .toListStatements()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("RedshiftData", jsii.invoke(self, "ifStatementOwnerIamUserid", [value, operator]))

    @jsii.member(jsii_name="toCancelStatement")
    def to_cancel_statement(self) -> "RedshiftData":
        '''(experimental) Grants permission to cancel a running query.

        Access Level: Write

        Possible conditions:

        - .ifStatementOwnerIamUserid()

        https://docs.aws.amazon.com/redshift-data/latest/APIReference/API_CancelStatement.html

        :stability: experimental
        '''
        return typing.cast("RedshiftData", jsii.invoke(self, "toCancelStatement", []))

    @jsii.member(jsii_name="toDescribeStatement")
    def to_describe_statement(self) -> "RedshiftData":
        '''(experimental) Grants permission to retrieve detailed information about a statement execution.

        Access Level: Read

        Possible conditions:

        - .ifStatementOwnerIamUserid()

        https://docs.aws.amazon.com/redshift-data/latest/APIReference/API_DescribeStatement.html

        :stability: experimental
        '''
        return typing.cast("RedshiftData", jsii.invoke(self, "toDescribeStatement", []))

    @jsii.member(jsii_name="toDescribeTable")
    def to_describe_table(self) -> "RedshiftData":
        '''(experimental) Grants permission to retrieve metadata about a particular table.

        Access Level: Read

        https://docs.aws.amazon.com/redshift-data/latest/APIReference/API_DescribeTable.html

        :stability: experimental
        '''
        return typing.cast("RedshiftData", jsii.invoke(self, "toDescribeTable", []))

    @jsii.member(jsii_name="toExecuteStatement")
    def to_execute_statement(self) -> "RedshiftData":
        '''(experimental) Grants permission to execute a query.

        Access Level: Write

        https://docs.aws.amazon.com/redshift-data/latest/APIReference/API_ExecuteStatement.html

        :stability: experimental
        '''
        return typing.cast("RedshiftData", jsii.invoke(self, "toExecuteStatement", []))

    @jsii.member(jsii_name="toGetStatementResult")
    def to_get_statement_result(self) -> "RedshiftData":
        '''(experimental) Grants permission to fetch the result of a query.

        Access Level: Read

        Possible conditions:

        - .ifStatementOwnerIamUserid()

        https://docs.aws.amazon.com/redshift-data/latest/APIReference/API_GetStatementResult.html

        :stability: experimental
        '''
        return typing.cast("RedshiftData", jsii.invoke(self, "toGetStatementResult", []))

    @jsii.member(jsii_name="toListDatabases")
    def to_list_databases(self) -> "RedshiftData":
        '''(experimental) Grants permission to list databases for a given cluster.

        Access Level: Read

        https://docs.aws.amazon.com/redshift-data/latest/APIReference/API_ListDatabases.html

        :stability: experimental
        '''
        return typing.cast("RedshiftData", jsii.invoke(self, "toListDatabases", []))

    @jsii.member(jsii_name="toListSchemas")
    def to_list_schemas(self) -> "RedshiftData":
        '''(experimental) Grants permission to list schemas for a given cluster.

        Access Level: Read

        https://docs.aws.amazon.com/redshift-data/latest/APIReference/API_ListSchemas.html

        :stability: experimental
        '''
        return typing.cast("RedshiftData", jsii.invoke(self, "toListSchemas", []))

    @jsii.member(jsii_name="toListStatements")
    def to_list_statements(self) -> "RedshiftData":
        '''(experimental) Grants permission to list queries for a given principal.

        Access Level: List

        Possible conditions:

        - .ifStatementOwnerIamUserid()

        https://docs.aws.amazon.com/redshift-data/latest/APIReference/API_ListStatements.html

        :stability: experimental
        '''
        return typing.cast("RedshiftData", jsii.invoke(self, "toListStatements", []))

    @jsii.member(jsii_name="toListTables")
    def to_list_tables(self) -> "RedshiftData":
        '''(experimental) Grants permission to list tables for a given cluster.

        Access Level: List

        https://docs.aws.amazon.com/redshift-data/latest/APIReference/API_ListTables.html

        :stability: experimental
        '''
        return typing.cast("RedshiftData", jsii.invoke(self, "toListTables", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Rekognition(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Rekognition",
):
    '''(experimental) Statement provider for service `rekognition <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonrekognition.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `rekognition <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonrekognition.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Rekognition, self, [sid])

    @jsii.member(jsii_name="onCollection")
    def on_collection(
        self,
        collection_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rekognition":
        '''(experimental) Adds a resource of type collection to the statement.

        https://docs.aws.amazon.com/rekognition/latest/dg/howitworks-collection.html

        :param collection_id: - Identifier for the collectionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "onCollection", [collection_id, account, region, partition]))

    @jsii.member(jsii_name="onProject")
    def on_project(
        self,
        project_name: builtins.str,
        creation_timestamp: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rekognition":
        '''(experimental) Adds a resource of type project to the statement.

        :param project_name: - Identifier for the projectName.
        :param creation_timestamp: - Identifier for the creationTimestamp.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "onProject", [project_name, creation_timestamp, account, region, partition]))

    @jsii.member(jsii_name="onProjectversion")
    def on_projectversion(
        self,
        project_name: builtins.str,
        version_name: builtins.str,
        creation_timestamp: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rekognition":
        '''(experimental) Adds a resource of type projectversion to the statement.

        :param project_name: - Identifier for the projectName.
        :param version_name: - Identifier for the versionName.
        :param creation_timestamp: - Identifier for the creationTimestamp.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "onProjectversion", [project_name, version_name, creation_timestamp, account, region, partition]))

    @jsii.member(jsii_name="onStreamprocessor")
    def on_streamprocessor(
        self,
        streamprocessor_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rekognition":
        '''(experimental) Adds a resource of type streamprocessor to the statement.

        :param streamprocessor_id: - Identifier for the streamprocessorId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "onStreamprocessor", [streamprocessor_id, account, region, partition]))

    @jsii.member(jsii_name="toCompareFaces")
    def to_compare_faces(self) -> "Rekognition":
        '''(experimental) Compares a face in source input image with each face detected in the target input image.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/dg/API_CompareFaces.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toCompareFaces", []))

    @jsii.member(jsii_name="toCreateCollection")
    def to_create_collection(self) -> "Rekognition":
        '''(experimental) Creates a collection in an AWS region. You can then add faces to the collection using the IndexFaces API.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/rekognition/latest/dg/API_CreateCollection.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toCreateCollection", []))

    @jsii.member(jsii_name="toCreateProject")
    def to_create_project(self) -> "Rekognition":
        '''(experimental) Creates a new Amazon Rekognition Custom Labels project.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/dg/API_CreateProject.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toCreateProject", []))

    @jsii.member(jsii_name="toCreateProjectVersion")
    def to_create_project_version(self) -> "Rekognition":
        '''(experimental) Creates a new version of a model and begins training.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/rekognition/latest/dg/API_CreateProjectVersion.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toCreateProjectVersion", []))

    @jsii.member(jsii_name="toCreateStreamProcessor")
    def to_create_stream_processor(self) -> "Rekognition":
        '''(experimental) Creates an Amazon Rekognition stream processor that you can use to detect and recognize faces in a streaming video.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/rekognition/latest/dg/API_CreateStreamProcessor.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toCreateStreamProcessor", []))

    @jsii.member(jsii_name="toDeleteCollection")
    def to_delete_collection(self) -> "Rekognition":
        '''(experimental) Deletes the specified collection. Note that this operation removes all faces in the collection.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/dg/API_DeleteCollection.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toDeleteCollection", []))

    @jsii.member(jsii_name="toDeleteFaces")
    def to_delete_faces(self) -> "Rekognition":
        '''(experimental) Deletes faces from a collection.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/dg/API_DeleteFaces.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toDeleteFaces", []))

    @jsii.member(jsii_name="toDeleteProject")
    def to_delete_project(self) -> "Rekognition":
        '''(experimental) Deletes a project.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/dg/API_DeleteProject.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toDeleteProject", []))

    @jsii.member(jsii_name="toDeleteProjectVersion")
    def to_delete_project_version(self) -> "Rekognition":
        '''(experimental) Deletes a model.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/dg/API_DeleteProjectVersion.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toDeleteProjectVersion", []))

    @jsii.member(jsii_name="toDeleteStreamProcessor")
    def to_delete_stream_processor(self) -> "Rekognition":
        '''(experimental) Deletes the stream processor identified by Name.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/dg/API_DeleteStreamProcessor.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toDeleteStreamProcessor", []))

    @jsii.member(jsii_name="toDescribeCollection")
    def to_describe_collection(self) -> "Rekognition":
        '''(experimental) Describes the specified collection.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/dg/API_DescribeCollection.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toDescribeCollection", []))

    @jsii.member(jsii_name="toDescribeProjects")
    def to_describe_projects(self) -> "Rekognition":
        '''(experimental) Lists and gets information about your Amazon Rekognition Custom Labels projects.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/dg/API_DescribeProjects.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toDescribeProjects", []))

    @jsii.member(jsii_name="toDescribeProjectVersions")
    def to_describe_project_versions(self) -> "Rekognition":
        '''(experimental) Lists and describes the model versions in an Amazon Rekognition Custom Labels project.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/dg/API_DescribeProjectVersions.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toDescribeProjectVersions", []))

    @jsii.member(jsii_name="toDescribeStreamProcessor")
    def to_describe_stream_processor(self) -> "Rekognition":
        '''(experimental) Provides information about a stream processor created by CreateStreamProcessor.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/dg/API_DescribeStreamProcessorh.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toDescribeStreamProcessor", []))

    @jsii.member(jsii_name="toDetectCustomLabels")
    def to_detect_custom_labels(self) -> "Rekognition":
        '''(experimental) Detects custom labels in a supplied image by using an Amazon Rekognition Custom Labels model version.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/dg/API_DetectCustomLabels.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toDetectCustomLabels", []))

    @jsii.member(jsii_name="toDetectFaces")
    def to_detect_faces(self) -> "Rekognition":
        '''(experimental) Detects human faces within an image (JPEG or PNG) provided as input.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/dg/API_DetectFaces.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toDetectFaces", []))

    @jsii.member(jsii_name="toDetectLabels")
    def to_detect_labels(self) -> "Rekognition":
        '''(experimental) Detects instances of real-world labels within an image (JPEG or PNG) provided as input.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/dg/API_DetectLabels.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toDetectLabels", []))

    @jsii.member(jsii_name="toDetectModerationLabels")
    def to_detect_moderation_labels(self) -> "Rekognition":
        '''(experimental) Detects moderation labels within input image.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/dg/API_DetectModerationLabels.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toDetectModerationLabels", []))

    @jsii.member(jsii_name="toDetectProtectiveEquipment")
    def to_detect_protective_equipment(self) -> "Rekognition":
        '''(experimental) Detects Protective Equipment in the input image.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/dg/API_DetectProtectiveEquipment.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toDetectProtectiveEquipment", []))

    @jsii.member(jsii_name="toDetectText")
    def to_detect_text(self) -> "Rekognition":
        '''(experimental) Detects text in the input image and converts it into machine-readable text.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/dg/API_DetectText.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toDetectText", []))

    @jsii.member(jsii_name="toGetCelebrityInfo")
    def to_get_celebrity_info(self) -> "Rekognition":
        '''(experimental) Gets the name and additional information about a celebrity based on his or her Rekognition ID.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/dg/API_GetCelebrityInfo.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toGetCelebrityInfo", []))

    @jsii.member(jsii_name="toGetCelebrityRecognition")
    def to_get_celebrity_recognition(self) -> "Rekognition":
        '''(experimental) Gets the celebrity recognition results for a Rekognition Video analysis started by StartCelebrityRecognition.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/dg/API_GetCelebrityRecognition.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toGetCelebrityRecognition", []))

    @jsii.member(jsii_name="toGetContentModeration")
    def to_get_content_moderation(self) -> "Rekognition":
        '''(experimental) Gets the content moderation analysis results for a Rekognition Video analysis started by StartContentModeration.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/dg/API_GetContentModeration.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toGetContentModeration", []))

    @jsii.member(jsii_name="toGetFaceDetection")
    def to_get_face_detection(self) -> "Rekognition":
        '''(experimental) Gets face detection results for a Rekognition Video analysis started by StartFaceDetection.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/dg/API_GetFaceDetection.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toGetFaceDetection", []))

    @jsii.member(jsii_name="toGetFaceSearch")
    def to_get_face_search(self) -> "Rekognition":
        '''(experimental) Gets the face search results for Rekognition Video face search started by StartFaceSearch.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/dg/API_GetFaceSearch.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toGetFaceSearch", []))

    @jsii.member(jsii_name="toGetLabelDetection")
    def to_get_label_detection(self) -> "Rekognition":
        '''(experimental) Gets the label detection results of a Rekognition Video analysis started by StartLabelDetection.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/dg/API_GetLabelDetection.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toGetLabelDetection", []))

    @jsii.member(jsii_name="toGetPersonTracking")
    def to_get_person_tracking(self) -> "Rekognition":
        '''(experimental) Gets information about people detected within a video.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/dg/API_GetPersonTracking.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toGetPersonTracking", []))

    @jsii.member(jsii_name="toGetSegmentDetection")
    def to_get_segment_detection(self) -> "Rekognition":
        '''(experimental) Gets segment detection results for a Rekognition Video analysis started by StartSegmentDetection.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/dg/API_GetSegmentDetection.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toGetSegmentDetection", []))

    @jsii.member(jsii_name="toGetTextDetection")
    def to_get_text_detection(self) -> "Rekognition":
        '''(experimental) Gets text detection results for a Rekognition Video analysis started by StartTextDetection.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/dg/API_GetTextDetection.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toGetTextDetection", []))

    @jsii.member(jsii_name="toIndexFaces")
    def to_index_faces(self) -> "Rekognition":
        '''(experimental) Detects faces in the input image and adds them to the specified collection.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/dg/API_IndexFaces.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toIndexFaces", []))

    @jsii.member(jsii_name="toListCollections")
    def to_list_collections(self) -> "Rekognition":
        '''(experimental) Returns a list of collection IDs in your account.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/dg/API_ListCollections.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toListCollections", []))

    @jsii.member(jsii_name="toListFaces")
    def to_list_faces(self) -> "Rekognition":
        '''(experimental) Returns metadata for faces in the specified collection.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/dg/API_ListFaces.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toListFaces", []))

    @jsii.member(jsii_name="toListStreamProcessors")
    def to_list_stream_processors(self) -> "Rekognition":
        '''(experimental) Gets a list of stream processors that you have created with CreateStreamProcessor.

        Access Level: List

        https://docs.aws.amazon.com/rekognition/latest/dg/API_ListStreamProcessors.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toListStreamProcessors", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Rekognition":
        '''(experimental) Returns a list of tags associated with a resource.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/dg/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toRecognizeCelebrities")
    def to_recognize_celebrities(self) -> "Rekognition":
        '''(experimental) Returns an array of celebrities recognized in the input image.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/dg/API_RecognizeCelebrities.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toRecognizeCelebrities", []))

    @jsii.member(jsii_name="toSearchFaces")
    def to_search_faces(self) -> "Rekognition":
        '''(experimental) For a given input face ID, searches the specified collection for matching faces.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/dg/API_SearchFaces.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toSearchFaces", []))

    @jsii.member(jsii_name="toSearchFacesByImage")
    def to_search_faces_by_image(self) -> "Rekognition":
        '''(experimental) For a given input image, first detects the largest face in the image, and then searches the specified collection for matching faces.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/dg/API_SearchFacesByImage.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toSearchFacesByImage", []))

    @jsii.member(jsii_name="toStartCelebrityRecognition")
    def to_start_celebrity_recognition(self) -> "Rekognition":
        '''(experimental) Starts asynchronous recognition of celebrities in a video.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/dg/API_StartCelebrityRecognition.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toStartCelebrityRecognition", []))

    @jsii.member(jsii_name="toStartContentModeration")
    def to_start_content_moderation(self) -> "Rekognition":
        '''(experimental) Starts asynchronous detection of explicit or suggestive adult content in a video.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/dg/API_StartContentModeration.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toStartContentModeration", []))

    @jsii.member(jsii_name="toStartFaceDetection")
    def to_start_face_detection(self) -> "Rekognition":
        '''(experimental) Starts asynchronous detection of faces in a video.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/dg/API_StartFaceDetection.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toStartFaceDetection", []))

    @jsii.member(jsii_name="toStartFaceSearch")
    def to_start_face_search(self) -> "Rekognition":
        '''(experimental) Starts the asynchronous search for faces in a collection that match the faces of persons detected in a video.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/dg/API_StartFaceSearch.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toStartFaceSearch", []))

    @jsii.member(jsii_name="toStartLabelDetection")
    def to_start_label_detection(self) -> "Rekognition":
        '''(experimental) Starts asynchronous detection of labels in a video.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/dg/API_StartLabelDetection.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toStartLabelDetection", []))

    @jsii.member(jsii_name="toStartPersonTracking")
    def to_start_person_tracking(self) -> "Rekognition":
        '''(experimental) Starts the asynchronous tracking of persons in a video.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/dg/API_StartPersonTracking.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toStartPersonTracking", []))

    @jsii.member(jsii_name="toStartProjectVersion")
    def to_start_project_version(self) -> "Rekognition":
        '''(experimental) Starts the deployment of a model version.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/dg/API_StartProjectVersion.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toStartProjectVersion", []))

    @jsii.member(jsii_name="toStartSegmentDetection")
    def to_start_segment_detection(self) -> "Rekognition":
        '''(experimental) Starts asynchronous detection of segments in a video.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/dg/API_StartSegmentDetection.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toStartSegmentDetection", []))

    @jsii.member(jsii_name="toStartStreamProcessor")
    def to_start_stream_processor(self) -> "Rekognition":
        '''(experimental) Starts processing a stream processor.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/dg/API_StartStreamProcessor.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toStartStreamProcessor", []))

    @jsii.member(jsii_name="toStartTextDetection")
    def to_start_text_detection(self) -> "Rekognition":
        '''(experimental) Starts asynchronous detection of text in a video.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/dg/API_StartTextDetection.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toStartTextDetection", []))

    @jsii.member(jsii_name="toStopProjectVersion")
    def to_stop_project_version(self) -> "Rekognition":
        '''(experimental) Stops a deployed model version.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/dg/API_StopProjectVersion.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toStopProjectVersion", []))

    @jsii.member(jsii_name="toStopStreamProcessor")
    def to_stop_stream_processor(self) -> "Rekognition":
        '''(experimental) Stops a running stream processor that was created by CreateStreamProcessor.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/dg/API_StopStreamProcessor.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toStopStreamProcessor", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Rekognition":
        '''(experimental) Adds one or more tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/rekognition/latest/dg/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Rekognition":
        '''(experimental) Removes one or more tags from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/rekognition/latest/dg/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toUntagResource", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class ResourceExplorer(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.ResourceExplorer",
):
    '''(experimental) Statement provider for service `resource-explorer <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awstageditor.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `resource-explorer <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awstageditor.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(ResourceExplorer, self, [sid])

    @jsii.member(jsii_name="toListResources")
    def to_list_resources(self) -> "ResourceExplorer":
        '''(experimental) Grants permission to retrieve the identifiers of the resources in the AWS account.

        Access Level: List

        https://docs.aws.amazon.com/ARG/latest/userguide/gettingstarted-prereqs.html#rg-permissions-te

        :stability: experimental
        '''
        return typing.cast("ResourceExplorer", jsii.invoke(self, "toListResources", []))

    @jsii.member(jsii_name="toListResourceTypes")
    def to_list_resource_types(self) -> "ResourceExplorer":
        '''(experimental) Grants permission to retrieve the resource types currently supported by Tag Editor.

        Access Level: List

        https://docs.aws.amazon.com/ARG/latest/userguide/gettingstarted-prereqs.html#rg-permissions-te

        :stability: experimental
        '''
        return typing.cast("ResourceExplorer", jsii.invoke(self, "toListResourceTypes", []))

    @jsii.member(jsii_name="toListTags")
    def to_list_tags(self) -> "ResourceExplorer":
        '''(experimental) Grants permission to retrieve the tags attached to the specified resource identifiers.

        Access Level: Read

        Dependent actions:

        - tag:GetResources

        https://docs.aws.amazon.com/ARG/latest/userguide/gettingstarted-prereqs.html#rg-permissions-te

        :stability: experimental
        '''
        return typing.cast("ResourceExplorer", jsii.invoke(self, "toListTags", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class ResourceGroups(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.ResourceGroups",
):
    '''(experimental) Statement provider for service `resource-groups <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsresourcegroups.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `resource-groups <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsresourcegroups.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(ResourceGroups, self, [sid])

    @jsii.member(jsii_name="onGroup")
    def on_group(
        self,
        group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ResourceGroups":
        '''(experimental) Adds a resource of type group to the statement.

        https://docs.aws.amazon.com/ARG/latest/userguide/welcome.html

        :param group_name: - Identifier for the groupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("ResourceGroups", jsii.invoke(self, "onGroup", [group_name, account, region, partition]))

    @jsii.member(jsii_name="toCreateGroup")
    def to_create_group(self) -> "ResourceGroups":
        '''(experimental) Grants permission to create a resource group with a specified name, description, and resource query.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/ARG/latest/APIReference/API_CreateGroup.html

        :stability: experimental
        '''
        return typing.cast("ResourceGroups", jsii.invoke(self, "toCreateGroup", []))

    @jsii.member(jsii_name="toDeleteGroup")
    def to_delete_group(self) -> "ResourceGroups":
        '''(experimental) Grants permission to delete a specified resource group.

        Access Level: Write

        https://docs.aws.amazon.com/ARG/latest/APIReference/API_DeleteGroup.html

        :stability: experimental
        '''
        return typing.cast("ResourceGroups", jsii.invoke(self, "toDeleteGroup", []))

    @jsii.member(jsii_name="toGetGroup")
    def to_get_group(self) -> "ResourceGroups":
        '''(experimental) Grants permission to get information of a specified resource group.

        Access Level: Read

        https://docs.aws.amazon.com/ARG/latest/APIReference/API_GetGroup.html

        :stability: experimental
        '''
        return typing.cast("ResourceGroups", jsii.invoke(self, "toGetGroup", []))

    @jsii.member(jsii_name="toGetGroupConfiguration")
    def to_get_group_configuration(self) -> "ResourceGroups":
        '''(experimental) Grants permission to get the service configuration associated with the specified resource group.

        Access Level: Read

        https://docs.aws.amazon.com/ARG/latest/APIReference/API_GetGroupConfiguration.html

        :stability: experimental
        '''
        return typing.cast("ResourceGroups", jsii.invoke(self, "toGetGroupConfiguration", []))

    @jsii.member(jsii_name="toGetGroupQuery")
    def to_get_group_query(self) -> "ResourceGroups":
        '''(experimental) Grants permission to get the query associated with a specified resource group.

        Access Level: Read

        https://docs.aws.amazon.com/ARG/latest/APIReference/API_GetGroupQuery.html

        :stability: experimental
        '''
        return typing.cast("ResourceGroups", jsii.invoke(self, "toGetGroupQuery", []))

    @jsii.member(jsii_name="toGetTags")
    def to_get_tags(self) -> "ResourceGroups":
        '''(experimental) Grants permission to get the tags associated with a specified resource group.

        Access Level: Read

        https://docs.aws.amazon.com/ARG/latest/APIReference/API_GetTags.html

        :stability: experimental
        '''
        return typing.cast("ResourceGroups", jsii.invoke(self, "toGetTags", []))

    @jsii.member(jsii_name="toGroupResources")
    def to_group_resources(self) -> "ResourceGroups":
        '''(experimental) Grants permission to add the specified resources to the specified group.

        Access Level: Write

        https://docs.aws.amazon.com/ARG/latest/APIReference/API_GroupResources.html

        :stability: experimental
        '''
        return typing.cast("ResourceGroups", jsii.invoke(self, "toGroupResources", []))

    @jsii.member(jsii_name="toListGroupResources")
    def to_list_group_resources(self) -> "ResourceGroups":
        '''(experimental) Grants permission to list the resources that are members of a specified resource group.

        Access Level: List

        Dependent actions:

        - cloudformation:DescribeStacks
        - cloudformation:ListStackResources
        - tag:GetResources

        https://docs.aws.amazon.com/ARG/latest/APIReference/API_ListGroupResources.html

        :stability: experimental
        '''
        return typing.cast("ResourceGroups", jsii.invoke(self, "toListGroupResources", []))

    @jsii.member(jsii_name="toListGroups")
    def to_list_groups(self) -> "ResourceGroups":
        '''(experimental) Grants permission to list all resource groups in your account.

        Access Level: List

        https://docs.aws.amazon.com/ARG/latest/APIReference/API_ListGroups.html

        :stability: experimental
        '''
        return typing.cast("ResourceGroups", jsii.invoke(self, "toListGroups", []))

    @jsii.member(jsii_name="toPutGroupPolicy")
    def to_put_group_policy(self) -> "ResourceGroups":
        '''(experimental) Grants permission to add a resource-based policy for the specified group.

        Access Level: Write

        https://docs.aws.amazon.com/ARG/latest/APIReference/LM_REDIRECT

        :stability: experimental
        '''
        return typing.cast("ResourceGroups", jsii.invoke(self, "toPutGroupPolicy", []))

    @jsii.member(jsii_name="toSearchResources")
    def to_search_resources(self) -> "ResourceGroups":
        '''(experimental) Grants permission to search for AWS resources matching the given query.

        Access Level: List

        Dependent actions:

        - cloudformation:DescribeStacks
        - cloudformation:ListStackResources
        - tag:GetResources

        https://docs.aws.amazon.com/ARG/latest/APIReference/API_SearchResources.html

        :stability: experimental
        '''
        return typing.cast("ResourceGroups", jsii.invoke(self, "toSearchResources", []))

    @jsii.member(jsii_name="toTag")
    def to_tag(self) -> "ResourceGroups":
        '''(experimental) Grants permission to tag a specified resource group.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/ARG/latest/APIReference/API_Tag.html

        :stability: experimental
        '''
        return typing.cast("ResourceGroups", jsii.invoke(self, "toTag", []))

    @jsii.member(jsii_name="toUngroupResources")
    def to_ungroup_resources(self) -> "ResourceGroups":
        '''(experimental) Grants permission to remove the specified resources from the specified group.

        Access Level: Write

        https://docs.aws.amazon.com/ARG/latest/APIReference/API_UngroupResources.html

        :stability: experimental
        '''
        return typing.cast("ResourceGroups", jsii.invoke(self, "toUngroupResources", []))

    @jsii.member(jsii_name="toUntag")
    def to_untag(self) -> "ResourceGroups":
        '''(experimental) Grants permission to remove tags associated with a specified resource group.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/ARG/latest/APIReference/API_Untag.html

        :stability: experimental
        '''
        return typing.cast("ResourceGroups", jsii.invoke(self, "toUntag", []))

    @jsii.member(jsii_name="toUpdateGroup")
    def to_update_group(self) -> "ResourceGroups":
        '''(experimental) Grants permission to update a specified resource group.

        Access Level: Write

        https://docs.aws.amazon.com/ARG/latest/APIReference/API_UpdateGroup.html

        :stability: experimental
        '''
        return typing.cast("ResourceGroups", jsii.invoke(self, "toUpdateGroup", []))

    @jsii.member(jsii_name="toUpdateGroupQuery")
    def to_update_group_query(self) -> "ResourceGroups":
        '''(experimental) Grants permission to update the query associated with a specified resource group.

        Access Level: Write

        https://docs.aws.amazon.com/ARG/latest/APIReference/API_UpdateGroupQuery.html

        :stability: experimental
        '''
        return typing.cast("ResourceGroups", jsii.invoke(self, "toUpdateGroupQuery", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Robomaker(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Robomaker",
):
    '''(experimental) Statement provider for service `robomaker <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsrobomaker.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `robomaker <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsrobomaker.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Robomaker, self, [sid])

    @jsii.member(jsii_name="onDeploymentFleet")
    def on_deployment_fleet(
        self,
        fleet_name: builtins.str,
        created_on_epoch: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Robomaker":
        '''(experimental) Adds a resource of type deploymentFleet to the statement.

        https://docs.aws.amazon.com/robomaker/latest/dg/managing-simulation-applications.html

        :param fleet_name: - Identifier for the fleetName.
        :param created_on_epoch: - Identifier for the createdOnEpoch.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "onDeploymentFleet", [fleet_name, created_on_epoch, account, region, partition]))

    @jsii.member(jsii_name="onDeploymentJob")
    def on_deployment_job(
        self,
        deployment_job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Robomaker":
        '''(experimental) Adds a resource of type deploymentJob to the statement.

        https://docs.aws.amazon.com/robomaker/latest/dg/deployment.html

        :param deployment_job_id: - Identifier for the deploymentJobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "onDeploymentJob", [deployment_job_id, account, region, partition]))

    @jsii.member(jsii_name="onRobot")
    def on_robot(
        self,
        robot_name: builtins.str,
        created_on_epoch: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Robomaker":
        '''(experimental) Adds a resource of type robot to the statement.

        https://docs.aws.amazon.com/robomaker/latest/dg/fleets.html

        :param robot_name: - Identifier for the robotName.
        :param created_on_epoch: - Identifier for the createdOnEpoch.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "onRobot", [robot_name, created_on_epoch, account, region, partition]))

    @jsii.member(jsii_name="onRobotApplication")
    def on_robot_application(
        self,
        application_name: builtins.str,
        created_on_epoch: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Robomaker":
        '''(experimental) Adds a resource of type robotApplication to the statement.

        https://docs.aws.amazon.com/robomaker/latest/dg/managing-robot-applications.html

        :param application_name: - Identifier for the applicationName.
        :param created_on_epoch: - Identifier for the createdOnEpoch.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "onRobotApplication", [application_name, created_on_epoch, account, region, partition]))

    @jsii.member(jsii_name="onSimulationApplication")
    def on_simulation_application(
        self,
        application_name: builtins.str,
        created_on_epoch: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Robomaker":
        '''(experimental) Adds a resource of type simulationApplication to the statement.

        https://docs.aws.amazon.com/robomaker/latest/dg/managing-simulation-applications.html

        :param application_name: - Identifier for the applicationName.
        :param created_on_epoch: - Identifier for the createdOnEpoch.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "onSimulationApplication", [application_name, created_on_epoch, account, region, partition]))

    @jsii.member(jsii_name="onSimulationJob")
    def on_simulation_job(
        self,
        simulation_job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Robomaker":
        '''(experimental) Adds a resource of type simulationJob to the statement.

        https://docs.aws.amazon.com/robomaker/latest/dg/simulation.html

        :param simulation_job_id: - Identifier for the simulationJobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "onSimulationJob", [simulation_job_id, account, region, partition]))

    @jsii.member(jsii_name="onSimulationJobBatch")
    def on_simulation_job_batch(
        self,
        simulation_job_batch_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Robomaker":
        '''(experimental) Adds a resource of type simulationJobBatch to the statement.

        https://docs.aws.amazon.com/robomaker/latest/dg/simulation-job-batch.html

        :param simulation_job_batch_id: - Identifier for the simulationJobBatchId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "onSimulationJobBatch", [simulation_job_batch_id, account, region, partition]))

    @jsii.member(jsii_name="onWorld")
    def on_world(
        self,
        world_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Robomaker":
        '''(experimental) Adds a resource of type world to the statement.

        https://docs.aws.amazon.com/robomaker/latest/dg/worlds-managing-generated-worlds.html

        :param world_id: - Identifier for the worldId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "onWorld", [world_id, account, region, partition]))

    @jsii.member(jsii_name="onWorldExportJob")
    def on_world_export_job(
        self,
        world_export_job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Robomaker":
        '''(experimental) Adds a resource of type worldExportJob to the statement.

        https://docs.aws.amazon.com/robomaker/latest/dg/worlds-managing-export-jobs.html

        :param world_export_job_id: - Identifier for the worldExportJobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "onWorldExportJob", [world_export_job_id, account, region, partition]))

    @jsii.member(jsii_name="onWorldGenerationJob")
    def on_world_generation_job(
        self,
        world_generation_job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Robomaker":
        '''(experimental) Adds a resource of type worldGenerationJob to the statement.

        https://docs.aws.amazon.com/robomaker/latest/dg/worlds-managing-generation-jobs.html

        :param world_generation_job_id: - Identifier for the worldGenerationJobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "onWorldGenerationJob", [world_generation_job_id, account, region, partition]))

    @jsii.member(jsii_name="onWorldTemplate")
    def on_world_template(
        self,
        world_template_job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Robomaker":
        '''(experimental) Adds a resource of type worldTemplate to the statement.

        https://docs.aws.amazon.com/robomaker/latest/dg/worlds-managing-simworld-templates.html

        :param world_template_job_id: - Identifier for the worldTemplateJobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "onWorldTemplate", [world_template_job_id, account, region, partition]))

    @jsii.member(jsii_name="toBatchDeleteWorlds")
    def to_batch_delete_worlds(self) -> "Robomaker":
        '''(experimental) Delete one or more worlds in a batch operation.

        Access Level: Write

        https://docs.aws.amazon.com/robomaker/latest/dg/API_BatchDeleteWorlds.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toBatchDeleteWorlds", []))

    @jsii.member(jsii_name="toBatchDescribeSimulationJob")
    def to_batch_describe_simulation_job(self) -> "Robomaker":
        '''(experimental) Describe multiple simulation jobs.

        Access Level: Read

        https://docs.aws.amazon.com/robomaker/latest/dg/API_BatchDescribeSimulationJob.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toBatchDescribeSimulationJob", []))

    @jsii.member(jsii_name="toCancelDeploymentJob")
    def to_cancel_deployment_job(self) -> "Robomaker":
        '''(experimental) Cancel a deployment job.

        Access Level: Write

        https://docs.aws.amazon.com/robomaker/latest/dg/API_CancelDeploymentJob.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toCancelDeploymentJob", []))

    @jsii.member(jsii_name="toCancelSimulationJob")
    def to_cancel_simulation_job(self) -> "Robomaker":
        '''(experimental) Cancel a simulation job.

        Access Level: Write

        https://docs.aws.amazon.com/robomaker/latest/dg/API_CancelSimulationJob.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toCancelSimulationJob", []))

    @jsii.member(jsii_name="toCancelSimulationJobBatch")
    def to_cancel_simulation_job_batch(self) -> "Robomaker":
        '''(experimental) Cancel a simulation job batch.

        Access Level: Write

        https://docs.aws.amazon.com/robomaker/latest/dg/API_CancelSimulationJobBatch.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toCancelSimulationJobBatch", []))

    @jsii.member(jsii_name="toCancelWorldExportJob")
    def to_cancel_world_export_job(self) -> "Robomaker":
        '''(experimental) Cancel a world export job.

        Access Level: Write

        https://docs.aws.amazon.com/robomaker/latest/dg/API_CancelWorldExportJob.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toCancelWorldExportJob", []))

    @jsii.member(jsii_name="toCancelWorldGenerationJob")
    def to_cancel_world_generation_job(self) -> "Robomaker":
        '''(experimental) Cancel a world generation job.

        Access Level: Write

        https://docs.aws.amazon.com/robomaker/latest/dg/API_CancelWorldGenerationJob.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toCancelWorldGenerationJob", []))

    @jsii.member(jsii_name="toCreateDeploymentJob")
    def to_create_deployment_job(self) -> "Robomaker":
        '''(experimental) Create a deployment job.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/robomaker/latest/dg/API_CreateDeploymentJob.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toCreateDeploymentJob", []))

    @jsii.member(jsii_name="toCreateFleet")
    def to_create_fleet(self) -> "Robomaker":
        '''(experimental) Create a deployment fleet that represents a logical group of robots running the same robot application.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/robomaker/latest/dg/API_CreateFleet.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toCreateFleet", []))

    @jsii.member(jsii_name="toCreateRobot")
    def to_create_robot(self) -> "Robomaker":
        '''(experimental) Create a robot that can be registered to a fleet.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/robomaker/latest/dg/API_CreateRobot.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toCreateRobot", []))

    @jsii.member(jsii_name="toCreateRobotApplication")
    def to_create_robot_application(self) -> "Robomaker":
        '''(experimental) Create a robot application.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/robomaker/latest/dg/API_CreateRobotApplication.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toCreateRobotApplication", []))

    @jsii.member(jsii_name="toCreateRobotApplicationVersion")
    def to_create_robot_application_version(self) -> "Robomaker":
        '''(experimental) Create a snapshot of a robot application.

        Access Level: Write

        Dependent actions:

        - s3:GetObject

        https://docs.aws.amazon.com/robomaker/latest/dg/API_CreateRobotApplicationVersion.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toCreateRobotApplicationVersion", []))

    @jsii.member(jsii_name="toCreateSimulationApplication")
    def to_create_simulation_application(self) -> "Robomaker":
        '''(experimental) Create a simulation application.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/robomaker/latest/dg/API_CreateSimulationApplication.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toCreateSimulationApplication", []))

    @jsii.member(jsii_name="toCreateSimulationApplicationVersion")
    def to_create_simulation_application_version(self) -> "Robomaker":
        '''(experimental) Create a snapshot of a simulation application.

        Access Level: Write

        Dependent actions:

        - s3:GetObject

        https://docs.aws.amazon.com/robomaker/latest/dg/API_CreateSimulationApplicationVersion.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toCreateSimulationApplicationVersion", []))

    @jsii.member(jsii_name="toCreateSimulationJob")
    def to_create_simulation_job(self) -> "Robomaker":
        '''(experimental) Create a simulation job.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/robomaker/latest/dg/API_CreateSimulationJob.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toCreateSimulationJob", []))

    @jsii.member(jsii_name="toCreateWorldExportJob")
    def to_create_world_export_job(self) -> "Robomaker":
        '''(experimental) Create a world export job.

        Access Level: Write

        https://docs.aws.amazon.com/robomaker/latest/dg/API_CreateWorldExportJob.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toCreateWorldExportJob", []))

    @jsii.member(jsii_name="toCreateWorldGenerationJob")
    def to_create_world_generation_job(self) -> "Robomaker":
        '''(experimental) Create a world generation job.

        Access Level: Write

        https://docs.aws.amazon.com/robomaker/latest/dg/API_CreateWorldGenerationJob.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toCreateWorldGenerationJob", []))

    @jsii.member(jsii_name="toCreateWorldTemplate")
    def to_create_world_template(self) -> "Robomaker":
        '''(experimental) Create a world template.

        Access Level: Write

        https://docs.aws.amazon.com/robomaker/latest/dg/API_CreateWorldTemplate.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toCreateWorldTemplate", []))

    @jsii.member(jsii_name="toDeleteFleet")
    def to_delete_fleet(self) -> "Robomaker":
        '''(experimental) Delete a deployment fleet.

        Access Level: Write

        https://docs.aws.amazon.com/robomaker/latest/dg/API_DeleteFleet.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toDeleteFleet", []))

    @jsii.member(jsii_name="toDeleteRobot")
    def to_delete_robot(self) -> "Robomaker":
        '''(experimental) Delete a robot.

        Access Level: Write

        https://docs.aws.amazon.com/robomaker/latest/dg/API_DeleteRobot.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toDeleteRobot", []))

    @jsii.member(jsii_name="toDeleteRobotApplication")
    def to_delete_robot_application(self) -> "Robomaker":
        '''(experimental) Delete a robot application.

        Access Level: Write

        https://docs.aws.amazon.com/robomaker/latest/dg/API_DeleteRobotApplication.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toDeleteRobotApplication", []))

    @jsii.member(jsii_name="toDeleteSimulationApplication")
    def to_delete_simulation_application(self) -> "Robomaker":
        '''(experimental) Delete a simulation application.

        Access Level: Write

        https://docs.aws.amazon.com/robomaker/latest/dg/API_DeleteSimulationApplication.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toDeleteSimulationApplication", []))

    @jsii.member(jsii_name="toDeleteWorldTemplate")
    def to_delete_world_template(self) -> "Robomaker":
        '''(experimental) Delete a world template.

        Access Level: Write

        https://docs.aws.amazon.com/robomaker/latest/dg/API_DeleteWorldTemplate.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toDeleteWorldTemplate", []))

    @jsii.member(jsii_name="toDeregisterRobot")
    def to_deregister_robot(self) -> "Robomaker":
        '''(experimental) Deregister a robot from a fleet.

        Access Level: Write

        https://docs.aws.amazon.com/robomaker/latest/dg/API_DeregisterRobot.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toDeregisterRobot", []))

    @jsii.member(jsii_name="toDescribeDeploymentJob")
    def to_describe_deployment_job(self) -> "Robomaker":
        '''(experimental) Describe a deployment job.

        Access Level: Read

        https://docs.aws.amazon.com/robomaker/latest/dg/API_DescribeDeploymentJob.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toDescribeDeploymentJob", []))

    @jsii.member(jsii_name="toDescribeFleet")
    def to_describe_fleet(self) -> "Robomaker":
        '''(experimental) Describe a deployment fleet.

        Access Level: Read

        https://docs.aws.amazon.com/robomaker/latest/dg/API_DescribeFleet.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toDescribeFleet", []))

    @jsii.member(jsii_name="toDescribeRobot")
    def to_describe_robot(self) -> "Robomaker":
        '''(experimental) Describe a robot.

        Access Level: Read

        https://docs.aws.amazon.com/robomaker/latest/dg/API_DescribeRobot.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toDescribeRobot", []))

    @jsii.member(jsii_name="toDescribeRobotApplication")
    def to_describe_robot_application(self) -> "Robomaker":
        '''(experimental) Describe a robot application.

        Access Level: Read

        https://docs.aws.amazon.com/robomaker/latest/dg/API_DescribeRobotApplication.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toDescribeRobotApplication", []))

    @jsii.member(jsii_name="toDescribeSimulationApplication")
    def to_describe_simulation_application(self) -> "Robomaker":
        '''(experimental) Describe a simulation application.

        Access Level: Read

        https://docs.aws.amazon.com/robomaker/latest/dg/API_DescribeSimulationApplication.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toDescribeSimulationApplication", []))

    @jsii.member(jsii_name="toDescribeSimulationJob")
    def to_describe_simulation_job(self) -> "Robomaker":
        '''(experimental) Describe a simulation job.

        Access Level: Read

        https://docs.aws.amazon.com/robomaker/latest/dg/API_DescribeSimulationJob.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toDescribeSimulationJob", []))

    @jsii.member(jsii_name="toDescribeSimulationJobBatch")
    def to_describe_simulation_job_batch(self) -> "Robomaker":
        '''(experimental) Describe a simulation job batch.

        Access Level: Read

        https://docs.aws.amazon.com/robomaker/latest/dg/API_DescribeSimulationJobBatch.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toDescribeSimulationJobBatch", []))

    @jsii.member(jsii_name="toDescribeWorld")
    def to_describe_world(self) -> "Robomaker":
        '''(experimental) Describe a world.

        Access Level: Read

        https://docs.aws.amazon.com/robomaker/latest/dg/API_DescribeWorld.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toDescribeWorld", []))

    @jsii.member(jsii_name="toDescribeWorldExportJob")
    def to_describe_world_export_job(self) -> "Robomaker":
        '''(experimental) Describe a world export job.

        Access Level: Read

        https://docs.aws.amazon.com/robomaker/latest/dg/API_DescribeWorldExportJob.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toDescribeWorldExportJob", []))

    @jsii.member(jsii_name="toDescribeWorldGenerationJob")
    def to_describe_world_generation_job(self) -> "Robomaker":
        '''(experimental) Describe a world generation job.

        Access Level: Read

        https://docs.aws.amazon.com/robomaker/latest/dg/API_DescribeWorldGenerationJob.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toDescribeWorldGenerationJob", []))

    @jsii.member(jsii_name="toDescribeWorldTemplate")
    def to_describe_world_template(self) -> "Robomaker":
        '''(experimental) Describe a world template.

        Access Level: Read

        https://docs.aws.amazon.com/robomaker/latest/dg/API_DescribeWorldTemplate.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toDescribeWorldTemplate", []))

    @jsii.member(jsii_name="toGetWorldTemplateBody")
    def to_get_world_template_body(self) -> "Robomaker":
        '''(experimental) Get the body of a world template.

        Access Level: Read

        https://docs.aws.amazon.com/robomaker/latest/dg/API_GetWorldTemplateBody.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toGetWorldTemplateBody", []))

    @jsii.member(jsii_name="toListDeploymentJobs")
    def to_list_deployment_jobs(self) -> "Robomaker":
        '''(experimental) List deployment jobs.

        Access Level: List

        https://docs.aws.amazon.com/robomaker/latest/dg/API_ListDeploymentJobs.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toListDeploymentJobs", []))

    @jsii.member(jsii_name="toListFleets")
    def to_list_fleets(self) -> "Robomaker":
        '''(experimental) List fleets.

        Access Level: List

        https://docs.aws.amazon.com/robomaker/latest/dg/API_ListFleets.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toListFleets", []))

    @jsii.member(jsii_name="toListRobotApplications")
    def to_list_robot_applications(self) -> "Robomaker":
        '''(experimental) List robot applications.

        Access Level: List

        https://docs.aws.amazon.com/robomaker/latest/dg/API_ListRobotApplications.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toListRobotApplications", []))

    @jsii.member(jsii_name="toListRobots")
    def to_list_robots(self) -> "Robomaker":
        '''(experimental) List robots.

        Access Level: List

        https://docs.aws.amazon.com/robomaker/latest/dg/API_ListRobots.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toListRobots", []))

    @jsii.member(jsii_name="toListSimulationApplications")
    def to_list_simulation_applications(self) -> "Robomaker":
        '''(experimental) List simulation applications.

        Access Level: List

        https://docs.aws.amazon.com/robomaker/latest/dg/API_ListSimulationApplications.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toListSimulationApplications", []))

    @jsii.member(jsii_name="toListSimulationJobBatches")
    def to_list_simulation_job_batches(self) -> "Robomaker":
        '''(experimental) List simulation job batches.

        Access Level: List

        https://docs.aws.amazon.com/robomaker/latest/dg/API_ListSimulationJobBatches.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toListSimulationJobBatches", []))

    @jsii.member(jsii_name="toListSimulationJobs")
    def to_list_simulation_jobs(self) -> "Robomaker":
        '''(experimental) List simulation jobs.

        Access Level: List

        https://docs.aws.amazon.com/robomaker/latest/dg/API_ListSimulationJobs.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toListSimulationJobs", []))

    @jsii.member(jsii_name="toListSupportedAvailabilityZones")
    def to_list_supported_availability_zones(self) -> "Robomaker":
        '''(experimental) Lists supported availability zones.

        Access Level: List

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toListSupportedAvailabilityZones", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Robomaker":
        '''(experimental) List tags for a RoboMaker resource.

        Access Level: List

        https://docs.aws.amazon.com/robomaker/latest/dg/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListWorldExportJobs")
    def to_list_world_export_jobs(self) -> "Robomaker":
        '''(experimental) List world export jobs.

        Access Level: List

        https://docs.aws.amazon.com/robomaker/latest/dg/API_ListWorldExportJobs.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toListWorldExportJobs", []))

    @jsii.member(jsii_name="toListWorldGenerationJobs")
    def to_list_world_generation_jobs(self) -> "Robomaker":
        '''(experimental) List world generation jobs.

        Access Level: List

        https://docs.aws.amazon.com/robomaker/latest/dg/API_ListWorldGenerationJobs.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toListWorldGenerationJobs", []))

    @jsii.member(jsii_name="toListWorlds")
    def to_list_worlds(self) -> "Robomaker":
        '''(experimental) List worlds.

        Access Level: List

        https://docs.aws.amazon.com/robomaker/latest/dg/API_ListWorlds.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toListWorlds", []))

    @jsii.member(jsii_name="toListWorldTemplates")
    def to_list_world_templates(self) -> "Robomaker":
        '''(experimental) List world templates.

        Access Level: List

        https://docs.aws.amazon.com/robomaker/latest/dg/API_ListWorldTemplates.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toListWorldTemplates", []))

    @jsii.member(jsii_name="toRegisterRobot")
    def to_register_robot(self) -> "Robomaker":
        '''(experimental) Register a robot to a fleet.

        Access Level: Write

        https://docs.aws.amazon.com/robomaker/latest/dg/API_RegisterRobot.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toRegisterRobot", []))

    @jsii.member(jsii_name="toRestartSimulationJob")
    def to_restart_simulation_job(self) -> "Robomaker":
        '''(experimental) Restart a running simulation job.

        Access Level: Write

        https://docs.aws.amazon.com/robomaker/latest/dg/API_RestartSimulationJob.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toRestartSimulationJob", []))

    @jsii.member(jsii_name="toStartSimulationJobBatch")
    def to_start_simulation_job_batch(self) -> "Robomaker":
        '''(experimental) Create a simulation job batch.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/robomaker/latest/dg/API_StartSimulationJobBatch.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toStartSimulationJobBatch", []))

    @jsii.member(jsii_name="toSyncDeploymentJob")
    def to_sync_deployment_job(self) -> "Robomaker":
        '''(experimental) Ensures the most recently deployed robot application is deployed to all robots in the fleet.

        Access Level: Write

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/robomaker/latest/dg/API_SyncDeploymentJob.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toSyncDeploymentJob", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Robomaker":
        '''(experimental) Add tags to a RoboMaker resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/robomaker/latest/dg/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Robomaker":
        '''(experimental) Remove tags from a RoboMaker resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/robomaker/latest/dg/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateRobotApplication")
    def to_update_robot_application(self) -> "Robomaker":
        '''(experimental) Update a robot application.

        Access Level: Write

        https://docs.aws.amazon.com/robomaker/latest/dg/API_UpdateRobotApplication.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toUpdateRobotApplication", []))

    @jsii.member(jsii_name="toUpdateRobotDeployment")
    def to_update_robot_deployment(self) -> "Robomaker":
        '''(experimental) Report the deployment status for an individual robot.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toUpdateRobotDeployment", []))

    @jsii.member(jsii_name="toUpdateSimulationApplication")
    def to_update_simulation_application(self) -> "Robomaker":
        '''(experimental) Update a simulation application.

        Access Level: Write

        https://docs.aws.amazon.com/robomaker/latest/dg/API_UpdateSimulationApplication.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toUpdateSimulationApplication", []))

    @jsii.member(jsii_name="toUpdateWorldTemplate")
    def to_update_world_template(self) -> "Robomaker":
        '''(experimental) Update a world template.

        Access Level: Write

        https://docs.aws.amazon.com/robomaker/latest/dg/API_UpdateWorldTemplate.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toUpdateWorldTemplate", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Route53(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Route53"):
    '''(experimental) Statement provider for service `route53 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonroute53.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `route53 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonroute53.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Route53, self, [sid])

    @jsii.member(jsii_name="onChange")
    def on_change(
        self,
        id: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53":
        '''(experimental) Adds a resource of type change to the statement.

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_Change.html

        :param id: - Identifier for the id.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "onChange", [id, partition]))

    @jsii.member(jsii_name="onDelegationset")
    def on_delegationset(
        self,
        id: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53":
        '''(experimental) Adds a resource of type delegationset to the statement.

        https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/route-53-concepts.html#route-53-concepts-reusable-delegation-set

        :param id: - Identifier for the id.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "onDelegationset", [id, partition]))

    @jsii.member(jsii_name="onHealthcheck")
    def on_healthcheck(
        self,
        id: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53":
        '''(experimental) Adds a resource of type healthcheck to the statement.

        https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/route-53-concepts.html#route-53-concepts-health-check

        :param id: - Identifier for the id.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "onHealthcheck", [id, partition]))

    @jsii.member(jsii_name="onHostedzone")
    def on_hostedzone(
        self,
        id: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53":
        '''(experimental) Adds a resource of type hostedzone to the statement.

        https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/route-53-concepts.html#route-53-concepts-hosted-zone

        :param id: - Identifier for the id.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "onHostedzone", [id, partition]))

    @jsii.member(jsii_name="onQueryloggingconfig")
    def on_queryloggingconfig(
        self,
        id: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53":
        '''(experimental) Adds a resource of type queryloggingconfig to the statement.

        https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/query-logs.html

        :param id: - Identifier for the id.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "onQueryloggingconfig", [id, partition]))

    @jsii.member(jsii_name="onTrafficpolicy")
    def on_trafficpolicy(
        self,
        id: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53":
        '''(experimental) Adds a resource of type trafficpolicy to the statement.

        https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/traffic-policies.html

        :param id: - Identifier for the id.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "onTrafficpolicy", [id, partition]))

    @jsii.member(jsii_name="onTrafficpolicyinstance")
    def on_trafficpolicyinstance(
        self,
        id: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53":
        '''(experimental) Adds a resource of type trafficpolicyinstance to the statement.

        https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/traffic-policy-records.html

        :param id: - Identifier for the id.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "onTrafficpolicyinstance", [id, partition]))

    @jsii.member(jsii_name="onVpc")
    def on_vpc(
        self,
        vpc_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53":
        '''(experimental) Adds a resource of type vpc to the statement.

        https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Subnets.html

        :param vpc_id: - Identifier for the vpcId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "onVpc", [vpc_id, account, region, partition]))

    @jsii.member(jsii_name="toAssociateVPCWithHostedZone")
    def to_associate_vpc_with_hosted_zone(self) -> "Route53":
        '''(experimental) Grants permission to associate an additional Amazon VPC with a private hosted zone.

        Access Level: Write

        Dependent actions:

        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_AssociateVPCWithHostedZone.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toAssociateVPCWithHostedZone", []))

    @jsii.member(jsii_name="toChangeResourceRecordSets")
    def to_change_resource_record_sets(self) -> "Route53":
        '''(experimental) Grants permission to create, update, or delete a record, which contains authoritative DNS information for a specified domain or subdomain name.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ChangeResourceRecordSets.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toChangeResourceRecordSets", []))

    @jsii.member(jsii_name="toChangeTagsForResource")
    def to_change_tags_for_resource(self) -> "Route53":
        '''(experimental) Grants permission to add, edit, or delete tags for a health check or a hosted zone.

        Access Level: Tagging

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ChangeTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toChangeTagsForResource", []))

    @jsii.member(jsii_name="toCreateHealthCheck")
    def to_create_health_check(self) -> "Route53":
        '''(experimental) Grants permission to create a new health check, which monitors the health and performance of your web applications, web servers, and other resources.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_CreateHealthCheck.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toCreateHealthCheck", []))

    @jsii.member(jsii_name="toCreateHostedZone")
    def to_create_hosted_zone(self) -> "Route53":
        '''(experimental) Grants permission to create a public hosted zone, which you use to specify how the Domain Name System (DNS) routes traffic on the Internet for a domain, such as example.com, and its subdomains.

        Access Level: Write

        Dependent actions:

        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_CreateHostedZone.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toCreateHostedZone", []))

    @jsii.member(jsii_name="toCreateQueryLoggingConfig")
    def to_create_query_logging_config(self) -> "Route53":
        '''(experimental) Grants permission to create a configuration for DNS query logging.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_CreateQueryLoggingConfig.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toCreateQueryLoggingConfig", []))

    @jsii.member(jsii_name="toCreateReusableDelegationSet")
    def to_create_reusable_delegation_set(self) -> "Route53":
        '''(experimental) Grants permission to create a delegation set (a group of four name servers) that can be reused by multiple hosted zones.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_CreateReusableDelegationSet.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toCreateReusableDelegationSet", []))

    @jsii.member(jsii_name="toCreateTrafficPolicy")
    def to_create_traffic_policy(self) -> "Route53":
        '''(experimental) Grants permission to create a traffic policy, which you use to create multiple DNS records for one domain name (such as example.com) or one subdomain name (such as www.example.com).

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_CreateTrafficPolicy.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toCreateTrafficPolicy", []))

    @jsii.member(jsii_name="toCreateTrafficPolicyInstance")
    def to_create_traffic_policy_instance(self) -> "Route53":
        '''(experimental) Grants permission to create records in a specified hosted zone based on the settings in a specified traffic policy version.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_CreateTrafficPolicyInstance.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toCreateTrafficPolicyInstance", []))

    @jsii.member(jsii_name="toCreateTrafficPolicyVersion")
    def to_create_traffic_policy_version(self) -> "Route53":
        '''(experimental) Grants permission to create a new version of an existing traffic policy.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_CreateTrafficPolicyVersion.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toCreateTrafficPolicyVersion", []))

    @jsii.member(jsii_name="toCreateVPCAssociationAuthorization")
    def to_create_vpc_association_authorization(self) -> "Route53":
        '''(experimental) Grants permission to authorize the AWS account that created a specified VPC to submit an AssociateVPCWithHostedZone request, which associates the VPC with a specified hosted zone that was created by a different account.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_CreateVPCAssociationAuthorization.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toCreateVPCAssociationAuthorization", []))

    @jsii.member(jsii_name="toDeleteHealthCheck")
    def to_delete_health_check(self) -> "Route53":
        '''(experimental) Grants permission to delete a health check.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_DeleteHealthCheck.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toDeleteHealthCheck", []))

    @jsii.member(jsii_name="toDeleteHostedZone")
    def to_delete_hosted_zone(self) -> "Route53":
        '''(experimental) Grants permission to delete a hosted zone.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_DeleteHostedZone.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toDeleteHostedZone", []))

    @jsii.member(jsii_name="toDeleteQueryLoggingConfig")
    def to_delete_query_logging_config(self) -> "Route53":
        '''(experimental) Grants permission to delete a configuration for DNS query logging.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_DeleteQueryLoggingConfig.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toDeleteQueryLoggingConfig", []))

    @jsii.member(jsii_name="toDeleteReusableDelegationSet")
    def to_delete_reusable_delegation_set(self) -> "Route53":
        '''(experimental) Grants permission to delete a reusable delegation set.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_DeleteReusableDelegationSet.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toDeleteReusableDelegationSet", []))

    @jsii.member(jsii_name="toDeleteTrafficPolicy")
    def to_delete_traffic_policy(self) -> "Route53":
        '''(experimental) Grants permission to delete a traffic policy.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_DeleteTrafficPolicy.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toDeleteTrafficPolicy", []))

    @jsii.member(jsii_name="toDeleteTrafficPolicyInstance")
    def to_delete_traffic_policy_instance(self) -> "Route53":
        '''(experimental) Grants permission to delete a traffic policy instance and all the records that Route 53 created when you created the instance.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_DeleteTrafficPolicyInstance.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toDeleteTrafficPolicyInstance", []))

    @jsii.member(jsii_name="toDeleteVPCAssociationAuthorization")
    def to_delete_vpc_association_authorization(self) -> "Route53":
        '''(experimental) Grants permission to remove authorization for associating an Amazon Virtual Private Cloud with a Route 53 private hosted zone.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_DeleteVPCAssociationAuthorization.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toDeleteVPCAssociationAuthorization", []))

    @jsii.member(jsii_name="toDisassociateVPCFromHostedZone")
    def to_disassociate_vpc_from_hosted_zone(self) -> "Route53":
        '''(experimental) Grants permission to disassociate an Amazon Virtual Private Cloud from a Route 53 private hosted zone.

        Access Level: Write

        Dependent actions:

        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_DisassociateVPCFromHostedZone.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toDisassociateVPCFromHostedZone", []))

    @jsii.member(jsii_name="toGetAccountLimit")
    def to_get_account_limit(self) -> "Route53":
        '''(experimental) Grants permission to get the specified limit for the current account, for example, the maximum number of health checks that you can create using the account.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_GetAccountLimit.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toGetAccountLimit", []))

    @jsii.member(jsii_name="toGetChange")
    def to_get_change(self) -> "Route53":
        '''(experimental) Grants permission to get the current status of a request to create, update, or delete one or more records.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_GetChange.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toGetChange", []))

    @jsii.member(jsii_name="toGetCheckerIpRanges")
    def to_get_checker_ip_ranges(self) -> "Route53":
        '''(experimental) Grants permission to get a list of the IP ranges that are used by Route 53 health checkers to check the health of your resources.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_GetCheckerIpRanges.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toGetCheckerIpRanges", []))

    @jsii.member(jsii_name="toGetGeoLocation")
    def to_get_geo_location(self) -> "Route53":
        '''(experimental) Grants permission to get information about whether a specified geographic location is supported for Route 53 geolocation records.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_GetGeoLocation.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toGetGeoLocation", []))

    @jsii.member(jsii_name="toGetHealthCheck")
    def to_get_health_check(self) -> "Route53":
        '''(experimental) Grants permission to get information about a specified health check.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_GetHealthCheck.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toGetHealthCheck", []))

    @jsii.member(jsii_name="toGetHealthCheckCount")
    def to_get_health_check_count(self) -> "Route53":
        '''(experimental) Grants permission to get the number of health checks that are associated with the current AWS account.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_GetHealthCheckCount.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toGetHealthCheckCount", []))

    @jsii.member(jsii_name="toGetHealthCheckLastFailureReason")
    def to_get_health_check_last_failure_reason(self) -> "Route53":
        '''(experimental) Grants permission to get the reason that a specified health check failed most recently.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_GetHealthCheckLastFailureReason.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toGetHealthCheckLastFailureReason", []))

    @jsii.member(jsii_name="toGetHealthCheckStatus")
    def to_get_health_check_status(self) -> "Route53":
        '''(experimental) Grants permission to get the status of a specified health check.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_GetHealthCheckStatus.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toGetHealthCheckStatus", []))

    @jsii.member(jsii_name="toGetHostedZone")
    def to_get_hosted_zone(self) -> "Route53":
        '''(experimental) Grants permission to get information about a specified hosted zone including the four name servers that Route 53 assigned to the hosted zone.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_GetHostedZone.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toGetHostedZone", []))

    @jsii.member(jsii_name="toGetHostedZoneCount")
    def to_get_hosted_zone_count(self) -> "Route53":
        '''(experimental) Grants permission to get the number of hosted zones that are associated with the current AWS account.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_GetHostedZoneCount.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toGetHostedZoneCount", []))

    @jsii.member(jsii_name="toGetHostedZoneLimit")
    def to_get_hosted_zone_limit(self) -> "Route53":
        '''(experimental) Grants permission to get the specified limit for a specified hosted zone.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_GetHostedZoneLimit.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toGetHostedZoneLimit", []))

    @jsii.member(jsii_name="toGetQueryLoggingConfig")
    def to_get_query_logging_config(self) -> "Route53":
        '''(experimental) Grants permission to get information about a specified configuration for DNS query logging.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_GetQueryLoggingConfig.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toGetQueryLoggingConfig", []))

    @jsii.member(jsii_name="toGetReusableDelegationSet")
    def to_get_reusable_delegation_set(self) -> "Route53":
        '''(experimental) Grants permission to get information about a specified reusable delegation set, including the four name servers that are assigned to the delegation set.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_GetReusableDelegationSet.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toGetReusableDelegationSet", []))

    @jsii.member(jsii_name="toGetReusableDelegationSetLimit")
    def to_get_reusable_delegation_set_limit(self) -> "Route53":
        '''(experimental) Grants permission to get the maximum number of hosted zones that you can associate with the specified reusable delegation set.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_GetReusableDelegationSetLimit.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toGetReusableDelegationSetLimit", []))

    @jsii.member(jsii_name="toGetTrafficPolicy")
    def to_get_traffic_policy(self) -> "Route53":
        '''(experimental) Grants permission to get information about a specified traffic policy version.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_GetTrafficPolicy.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toGetTrafficPolicy", []))

    @jsii.member(jsii_name="toGetTrafficPolicyInstance")
    def to_get_traffic_policy_instance(self) -> "Route53":
        '''(experimental) Grants permission to get information about a specified traffic policy instance.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_GetTrafficPolicyInstance.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toGetTrafficPolicyInstance", []))

    @jsii.member(jsii_name="toGetTrafficPolicyInstanceCount")
    def to_get_traffic_policy_instance_count(self) -> "Route53":
        '''(experimental) Grants permission to get the number of traffic policy instances that are associated with the current AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_GetTrafficPolicyInstanceCount.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toGetTrafficPolicyInstanceCount", []))

    @jsii.member(jsii_name="toListGeoLocations")
    def to_list_geo_locations(self) -> "Route53":
        '''(experimental) Grants permission to get a list of geographic locations that Route 53 supports for geolocation.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListGeoLocations.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toListGeoLocations", []))

    @jsii.member(jsii_name="toListHealthChecks")
    def to_list_health_checks(self) -> "Route53":
        '''(experimental) Grants permission to get a list of the health checks that are associated with the current AWS account.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListHealthChecks.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toListHealthChecks", []))

    @jsii.member(jsii_name="toListHostedZones")
    def to_list_hosted_zones(self) -> "Route53":
        '''(experimental) Grants permission to get a list of the public and private hosted zones that are associated with the current AWS account.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListHostedZones.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toListHostedZones", []))

    @jsii.member(jsii_name="toListHostedZonesByName")
    def to_list_hosted_zones_by_name(self) -> "Route53":
        '''(experimental) Grants permission to get a list of your hosted zones in lexicographic order.

        Hosted zones are sorted by name with the labels reversed, for example, com.example.www.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListHostedZonesByName.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toListHostedZonesByName", []))

    @jsii.member(jsii_name="toListHostedZonesByVPC")
    def to_list_hosted_zones_by_vpc(self) -> "Route53":
        '''(experimental) Grants permission to get a list of all the private hosted zones that a specified VPC is associated with.

        Access Level: List

        Dependent actions:

        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListHostedZonesByVPC.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toListHostedZonesByVPC", []))

    @jsii.member(jsii_name="toListQueryLoggingConfigs")
    def to_list_query_logging_configs(self) -> "Route53":
        '''(experimental) Grants permission to list the configurations for DNS query logging that are associated with the current AWS account or the configuration that is associated with a specified hosted zone.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListQueryLoggingConfigs.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toListQueryLoggingConfigs", []))

    @jsii.member(jsii_name="toListResourceRecordSets")
    def to_list_resource_record_sets(self) -> "Route53":
        '''(experimental) Grants permission to list the records in a specified hosted zone.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListResourceRecordSets.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toListResourceRecordSets", []))

    @jsii.member(jsii_name="toListReusableDelegationSets")
    def to_list_reusable_delegation_sets(self) -> "Route53":
        '''(experimental) Grants permission to list the reusable delegation sets that are associated with the current AWS account.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListReusableDelegationSets.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toListReusableDelegationSets", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Route53":
        '''(experimental) Grants permission to list tags for one health check or hosted zone.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTagsForResources")
    def to_list_tags_for_resources(self) -> "Route53":
        '''(experimental) Grants permission to list tags for up to 10 health checks or hosted zones.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListTagsForResources.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toListTagsForResources", []))

    @jsii.member(jsii_name="toListTrafficPolicies")
    def to_list_traffic_policies(self) -> "Route53":
        '''(experimental) Grants permission to get information about the latest version for every traffic policy that is associated with the current AWS account.

        Policies are listed in the order in which they were created.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListTrafficPolicies.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toListTrafficPolicies", []))

    @jsii.member(jsii_name="toListTrafficPolicyInstances")
    def to_list_traffic_policy_instances(self) -> "Route53":
        '''(experimental) Grants permission to get information about the traffic policy instances that you created by using the current AWS account.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListTrafficPolicyInstances.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toListTrafficPolicyInstances", []))

    @jsii.member(jsii_name="toListTrafficPolicyInstancesByHostedZone")
    def to_list_traffic_policy_instances_by_hosted_zone(self) -> "Route53":
        '''(experimental) Grants permission to get information about the traffic policy instances that you created in a specified hosted zone.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListTrafficPolicyInstancesByHostedZone.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toListTrafficPolicyInstancesByHostedZone", []))

    @jsii.member(jsii_name="toListTrafficPolicyInstancesByPolicy")
    def to_list_traffic_policy_instances_by_policy(self) -> "Route53":
        '''(experimental) Grants permission to get information about the traffic policy instances that you created using a specified traffic policy version.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListTrafficPolicyInstancesByPolicy.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toListTrafficPolicyInstancesByPolicy", []))

    @jsii.member(jsii_name="toListTrafficPolicyVersions")
    def to_list_traffic_policy_versions(self) -> "Route53":
        '''(experimental) Grants permission to get information about all the versions for a specified traffic policy.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListTrafficPolicyVersions.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toListTrafficPolicyVersions", []))

    @jsii.member(jsii_name="toListVPCAssociationAuthorizations")
    def to_list_vpc_association_authorizations(self) -> "Route53":
        '''(experimental) Grants permission to get a list of the VPCs that were created by other accounts and that can be associated with a specified hosted zone.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListVPCAssociationAuthorizations.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toListVPCAssociationAuthorizations", []))

    @jsii.member(jsii_name="toTestDNSAnswer")
    def to_test_dns_answer(self) -> "Route53":
        '''(experimental) Grants permission to get the value that Route 53 returns in response to a DNS query for a specified record name and type.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_TestDNSAnswer.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toTestDNSAnswer", []))

    @jsii.member(jsii_name="toUpdateHealthCheck")
    def to_update_health_check(self) -> "Route53":
        '''(experimental) Grants permission to update an existing health check.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_UpdateHealthCheck.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toUpdateHealthCheck", []))

    @jsii.member(jsii_name="toUpdateHostedZoneComment")
    def to_update_hosted_zone_comment(self) -> "Route53":
        '''(experimental) Grants permission to update the comment for a specified hosted zone.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_UpdateHostedZoneComment.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toUpdateHostedZoneComment", []))

    @jsii.member(jsii_name="toUpdateTrafficPolicyComment")
    def to_update_traffic_policy_comment(self) -> "Route53":
        '''(experimental) Grants permission to update the comment for a specified traffic policy version.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_UpdateTrafficPolicyComment.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toUpdateTrafficPolicyComment", []))

    @jsii.member(jsii_name="toUpdateTrafficPolicyInstance")
    def to_update_traffic_policy_instance(self) -> "Route53":
        '''(experimental) Grants permission to update the records in a specified hosted zone that were created based on the settings in a specified traffic policy version.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_UpdateTrafficPolicyInstance.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toUpdateTrafficPolicyInstance", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Route53domains(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Route53domains",
):
    '''(experimental) Statement provider for service `route53domains <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonroute53domains.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `route53domains <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonroute53domains.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Route53domains, self, [sid])

    @jsii.member(jsii_name="toCheckDomainAvailability")
    def to_check_domain_availability(self) -> "Route53domains":
        '''(experimental) Grants permission to check the availability of one domain name.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_CheckDomainAvailability.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toCheckDomainAvailability", []))

    @jsii.member(jsii_name="toDeleteTagsForDomain")
    def to_delete_tags_for_domain(self) -> "Route53domains":
        '''(experimental) Grants permission to delete the specified tags for a domain.

        Access Level: Tagging

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_DeleteTagsForDomain.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toDeleteTagsForDomain", []))

    @jsii.member(jsii_name="toDisableDomainAutoRenew")
    def to_disable_domain_auto_renew(self) -> "Route53domains":
        '''(experimental) Grants permission to configure Amazon Route 53 to automatically renew the specified domain before the domain registration expires.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_DisableDomainAutoRenew.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toDisableDomainAutoRenew", []))

    @jsii.member(jsii_name="toDisableDomainTransferLock")
    def to_disable_domain_transfer_lock(self) -> "Route53domains":
        '''(experimental) Grants permission to remove the transfer lock on the domain (specifically the clientTransferProhibited status) to allow domain transfers.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_DisableDomainTransferLock.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toDisableDomainTransferLock", []))

    @jsii.member(jsii_name="toEnableDomainAutoRenew")
    def to_enable_domain_auto_renew(self) -> "Route53domains":
        '''(experimental) Grants permission to configure Amazon Route 53 to automatically renew the specified domain before the domain registration expires.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_DisableDomainAutoRenew.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toEnableDomainAutoRenew", []))

    @jsii.member(jsii_name="toEnableDomainTransferLock")
    def to_enable_domain_transfer_lock(self) -> "Route53domains":
        '''(experimental) Grants permission to set the transfer lock on the domain (specifically the clientTransferProhibited status) to prevent domain transfers.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_EnableDomainTransferLock.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toEnableDomainTransferLock", []))

    @jsii.member(jsii_name="toGetContactReachabilityStatus")
    def to_get_contact_reachability_status(self) -> "Route53domains":
        '''(experimental) For operations that require confirmation that the email address for the registrant contact is valid, such as registering a new domain, grants permission to get information about whether the registrant contact has responded.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_GetContactReachabilityStatus.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toGetContactReachabilityStatus", []))

    @jsii.member(jsii_name="toGetDomainDetail")
    def to_get_domain_detail(self) -> "Route53domains":
        '''(experimental) Grants permission to get detailed information about a domain.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_GetDomainDetail.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toGetDomainDetail", []))

    @jsii.member(jsii_name="toGetDomainSuggestions")
    def to_get_domain_suggestions(self) -> "Route53domains":
        '''(experimental) Grants permission to get a list of suggested domain names given a string, which can either be a domain name or simply a word or phrase (without spaces).

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_GetDomainSuggestions.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toGetDomainSuggestions", []))

    @jsii.member(jsii_name="toGetOperationDetail")
    def to_get_operation_detail(self) -> "Route53domains":
        '''(experimental) Grants permission to get the current status of an operation that is not completed.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_GetOperationDetail.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toGetOperationDetail", []))

    @jsii.member(jsii_name="toListDomains")
    def to_list_domains(self) -> "Route53domains":
        '''(experimental) Grants permission to list all the domain names registered with Amazon Route 53 for the current AWS account.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_ListDomains.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toListDomains", []))

    @jsii.member(jsii_name="toListOperations")
    def to_list_operations(self) -> "Route53domains":
        '''(experimental) Grants permission to list the operation IDs of operations that are not yet complete.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_ListOperations.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toListOperations", []))

    @jsii.member(jsii_name="toListTagsForDomain")
    def to_list_tags_for_domain(self) -> "Route53domains":
        '''(experimental) Grants permission to list all the tags that are associated with the specified domain.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_ListTagsForDomain.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toListTagsForDomain", []))

    @jsii.member(jsii_name="toRegisterDomain")
    def to_register_domain(self) -> "Route53domains":
        '''(experimental) Grants permission to register domains.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_RegisterDomain.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toRegisterDomain", []))

    @jsii.member(jsii_name="toRenewDomain")
    def to_renew_domain(self) -> "Route53domains":
        '''(experimental) Grants permission to renew domains for the specified number of years.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_RenewDomain.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toRenewDomain", []))

    @jsii.member(jsii_name="toResendContactReachabilityEmail")
    def to_resend_contact_reachability_email(self) -> "Route53domains":
        '''(experimental) For operations that require confirmation that the email address for the registrant contact is valid, such as registering a new domain, grants permission to resend the confirmation email to the current email address for the registrant contact.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_ResendContactReachabilityEmail.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toResendContactReachabilityEmail", []))

    @jsii.member(jsii_name="toRetrieveDomainAuthCode")
    def to_retrieve_domain_auth_code(self) -> "Route53domains":
        '''(experimental) Grants permission to get the AuthCode for the domain.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_RetrieveDomainAuthCode.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toRetrieveDomainAuthCode", []))

    @jsii.member(jsii_name="toTransferDomain")
    def to_transfer_domain(self) -> "Route53domains":
        '''(experimental) Grants permission to transfer a domain from another registrar to Amazon Route 53.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_TransferDomain.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toTransferDomain", []))

    @jsii.member(jsii_name="toUpdateDomainContact")
    def to_update_domain_contact(self) -> "Route53domains":
        '''(experimental) Grants permission to update the contact information for domain.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_UpdateDomainContact.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toUpdateDomainContact", []))

    @jsii.member(jsii_name="toUpdateDomainContactPrivacy")
    def to_update_domain_contact_privacy(self) -> "Route53domains":
        '''(experimental) Grants permission to update the domain contact privacy setting.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_UpdateDomainContactPrivacy.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toUpdateDomainContactPrivacy", []))

    @jsii.member(jsii_name="toUpdateDomainNameservers")
    def to_update_domain_nameservers(self) -> "Route53domains":
        '''(experimental) Grants permission to replace the current set of name servers for a domain with the specified set of name servers.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_UpdateDomainNameservers.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toUpdateDomainNameservers", []))

    @jsii.member(jsii_name="toUpdateTagsForDomain")
    def to_update_tags_for_domain(self) -> "Route53domains":
        '''(experimental) Grants permission to add or update tags for a specified domain.

        Access Level: Tagging

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_UpdateTagsForDomain.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toUpdateTagsForDomain", []))

    @jsii.member(jsii_name="toViewBilling")
    def to_view_billing(self) -> "Route53domains":
        '''(experimental) Grants permission to get all the domain-related billing records for the current AWS account for a specified period.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_ViewBilling.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toViewBilling", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Route53resolver(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Route53resolver",
):
    '''(experimental) Statement provider for service `route53resolver <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonroute53resolver.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `route53resolver <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonroute53resolver.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Route53resolver, self, [sid])

    @jsii.member(jsii_name="onFirewallConfig")
    def on_firewall_config(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53resolver":
        '''(experimental) Adds a resource of type firewall-config to the statement.

        https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/access-control-overview.html#access-control-resources

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "onFirewallConfig", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onFirewallDomainList")
    def on_firewall_domain_list(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53resolver":
        '''(experimental) Adds a resource of type firewall-domain-list to the statement.

        https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/access-control-overview.html#access-control-resources

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "onFirewallDomainList", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onFirewallRuleGroup")
    def on_firewall_rule_group(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53resolver":
        '''(experimental) Adds a resource of type firewall-rule-group to the statement.

        https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/access-control-overview.html#access-control-resources

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "onFirewallRuleGroup", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onFirewallRuleGroupAssociation")
    def on_firewall_rule_group_association(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53resolver":
        '''(experimental) Adds a resource of type firewall-rule-group-association to the statement.

        https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/access-control-overview.html#access-control-resources

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "onFirewallRuleGroupAssociation", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onResolverDnssecConfig")
    def on_resolver_dnssec_config(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53resolver":
        '''(experimental) Adds a resource of type resolver-dnssec-config to the statement.

        https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/access-control-overview.html#access-control-resources

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "onResolverDnssecConfig", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onResolverEndpoint")
    def on_resolver_endpoint(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53resolver":
        '''(experimental) Adds a resource of type resolver-endpoint to the statement.

        https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/access-control-overview.html#access-control-resources

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "onResolverEndpoint", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onResolverQueryLogConfig")
    def on_resolver_query_log_config(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53resolver":
        '''(experimental) Adds a resource of type resolver-query-log-config to the statement.

        https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/access-control-overview.html#access-control-resources

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "onResolverQueryLogConfig", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onResolverRule")
    def on_resolver_rule(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53resolver":
        '''(experimental) Adds a resource of type resolver-rule to the statement.

        https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/access-control-overview.html#access-control-resources

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "onResolverRule", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toAssociateFirewallRuleGroup")
    def to_associate_firewall_rule_group(self) -> "Route53resolver":
        '''(experimental) Grants permission to associate an Amazon VPC with a specified firewall rule group.

        Access Level: Write

        Dependent actions:

        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_AssociateFirewallRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toAssociateFirewallRuleGroup", []))

    @jsii.member(jsii_name="toAssociateResolverEndpointIpAddress")
    def to_associate_resolver_endpoint_ip_address(self) -> "Route53resolver":
        '''(experimental) Grants permission to associate a specified IP address with a Resolver endpoint.

        This is an IP address that DNS queries pass through on the way to your network (outbound) or your VPCs (inbound)

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_AssociateResolverEndpointIpAddress.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toAssociateResolverEndpointIpAddress", []))

    @jsii.member(jsii_name="toAssociateResolverQueryLogConfig")
    def to_associate_resolver_query_log_config(self) -> "Route53resolver":
        '''(experimental) Grants permission to associate an Amazon VPC with a specified query logging configuration.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_AssociateResolverQueryLogConfig.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toAssociateResolverQueryLogConfig", []))

    @jsii.member(jsii_name="toAssociateResolverRule")
    def to_associate_resolver_rule(self) -> "Route53resolver":
        '''(experimental) Grants permission to associate a specified Resolver rule with a specified VPC.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_AssociateResolverRule.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toAssociateResolverRule", []))

    @jsii.member(jsii_name="toCreateFirewallDomainList")
    def to_create_firewall_domain_list(self) -> "Route53resolver":
        '''(experimental) Grants permission to create a Firewall domain list.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_CreateFirewallDomainList.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toCreateFirewallDomainList", []))

    @jsii.member(jsii_name="toCreateFirewallRule")
    def to_create_firewall_rule(self) -> "Route53resolver":
        '''(experimental) Grants permission to create a Firewall rule within a Firewall rule group.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_CreateFirewallRule.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toCreateFirewallRule", []))

    @jsii.member(jsii_name="toCreateFirewallRuleGroup")
    def to_create_firewall_rule_group(self) -> "Route53resolver":
        '''(experimental) Grants permission to create a Firewall rule group.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_CreateFirewallRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toCreateFirewallRuleGroup", []))

    @jsii.member(jsii_name="toCreateResolverEndpoint")
    def to_create_resolver_endpoint(self) -> "Route53resolver":
        '''(experimental) Grants permission to create a Resolver endpoint. There are two types of Resolver endpoints, inbound and outbound.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_CreateResolverEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toCreateResolverEndpoint", []))

    @jsii.member(jsii_name="toCreateResolverQueryLogConfig")
    def to_create_resolver_query_log_config(self) -> "Route53resolver":
        '''(experimental) Grants permission to create a Resolver query logging configuration, which defines where you want Resolver to save DNS query logs that originate in your VPCs.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_CreateResolverQueryLogConfig.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toCreateResolverQueryLogConfig", []))

    @jsii.member(jsii_name="toCreateResolverRule")
    def to_create_resolver_rule(self) -> "Route53resolver":
        '''(experimental) For DNS queries that originate in your VPC, grants permission to define how to route the queries out of the VPC.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_CreateResolverRule.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toCreateResolverRule", []))

    @jsii.member(jsii_name="toDeleteFirewallDomainList")
    def to_delete_firewall_domain_list(self) -> "Route53resolver":
        '''(experimental) Grants permission to delete a Firewall domain list.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_DeleteFirewallDomainList.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toDeleteFirewallDomainList", []))

    @jsii.member(jsii_name="toDeleteFirewallRule")
    def to_delete_firewall_rule(self) -> "Route53resolver":
        '''(experimental) Grants permission to delete a Firewall rule within a Firewall rule group.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_DeleteFirewallRule.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toDeleteFirewallRule", []))

    @jsii.member(jsii_name="toDeleteFirewallRuleGroup")
    def to_delete_firewall_rule_group(self) -> "Route53resolver":
        '''(experimental) Grants permission to delete a Firewall rule group.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_DeleteFirewallRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toDeleteFirewallRuleGroup", []))

    @jsii.member(jsii_name="toDeleteResolverEndpoint")
    def to_delete_resolver_endpoint(self) -> "Route53resolver":
        '''(experimental) Grants permission to delete a Resolver endpoint.

        The effect of deleting a Resolver endpoint depends on whether it's an inbound or an outbound endpoint

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_DeleteResolverEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toDeleteResolverEndpoint", []))

    @jsii.member(jsii_name="toDeleteResolverQueryLogConfig")
    def to_delete_resolver_query_log_config(self) -> "Route53resolver":
        '''(experimental) Grants permission to delete a Resolver query logging configuration.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_DeleteResolverQueryLogConfig.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toDeleteResolverQueryLogConfig", []))

    @jsii.member(jsii_name="toDeleteResolverRule")
    def to_delete_resolver_rule(self) -> "Route53resolver":
        '''(experimental) Grants permission to delete a Resolver rule.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_DeleteResolverRule.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toDeleteResolverRule", []))

    @jsii.member(jsii_name="toDisassociateFirewallRuleGroup")
    def to_disassociate_firewall_rule_group(self) -> "Route53resolver":
        '''(experimental) Grants permission to remove the association between a specified Firewall rule group and a specified VPC.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_DisassociateFirewallRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toDisassociateFirewallRuleGroup", []))

    @jsii.member(jsii_name="toDisassociateResolverEndpointIpAddress")
    def to_disassociate_resolver_endpoint_ip_address(self) -> "Route53resolver":
        '''(experimental) Grants permission to remove a specified IP address from a Resolver endpoint.

        This is an IP address that DNS queries pass through on the way to your network (outbound) or your VPCs (inbound)

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_DisassociateResolverEndpointIpAddress.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toDisassociateResolverEndpointIpAddress", []))

    @jsii.member(jsii_name="toDisassociateResolverQueryLogConfig")
    def to_disassociate_resolver_query_log_config(self) -> "Route53resolver":
        '''(experimental) Grants permission to remove the association between a specified Resolver query logging configuration and a specified VPC.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_DisassociateResolverQueryLogConfig.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toDisassociateResolverQueryLogConfig", []))

    @jsii.member(jsii_name="toDisassociateResolverRule")
    def to_disassociate_resolver_rule(self) -> "Route53resolver":
        '''(experimental) Grants permission to remove the association between a specified Resolver rule and a specified VPC.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_DisassociateResolverRule.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toDisassociateResolverRule", []))

    @jsii.member(jsii_name="toGetFirewallConfig")
    def to_get_firewall_config(self) -> "Route53resolver":
        '''(experimental) Grants permission to get information about a specified Firewall config.

        Access Level: Read

        Dependent actions:

        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_GetFirewallConfig.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toGetFirewallConfig", []))

    @jsii.member(jsii_name="toGetFirewallDomainList")
    def to_get_firewall_domain_list(self) -> "Route53resolver":
        '''(experimental) Grants permission to get information about a specified Firewall domain list.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_GetFirewallDomainList.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toGetFirewallDomainList", []))

    @jsii.member(jsii_name="toGetFirewallRuleGroup")
    def to_get_firewall_rule_group(self) -> "Route53resolver":
        '''(experimental) Grants permission to get information about a specified Firewall rule group.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_GetFirewallRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toGetFirewallRuleGroup", []))

    @jsii.member(jsii_name="toGetFirewallRuleGroupAssociation")
    def to_get_firewall_rule_group_association(self) -> "Route53resolver":
        '''(experimental) Grants permission to get information about an association between a specified Firewall rule group and a VPC.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_GetFirewallRuleGroupAssociation.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toGetFirewallRuleGroupAssociation", []))

    @jsii.member(jsii_name="toGetFirewallRuleGroupPolicy")
    def to_get_firewall_rule_group_policy(self) -> "Route53resolver":
        '''(experimental) Grants permission to get information about a specified Firewall rule group policy, which specifies the Firewall rule group operations and resources that you want to allow another AWS account to use.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_GetFirewallRuleGroupPolicy.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toGetFirewallRuleGroupPolicy", []))

    @jsii.member(jsii_name="toGetResolverDnssecConfig")
    def to_get_resolver_dnssec_config(self) -> "Route53resolver":
        '''(experimental) Grants permission to get the DNSSEC validation support status for DNS queries within the specified resource.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_GetResolverDnssecConfig.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toGetResolverDnssecConfig", []))

    @jsii.member(jsii_name="toGetResolverEndpoint")
    def to_get_resolver_endpoint(self) -> "Route53resolver":
        '''(experimental) Grants permission to get information about a specified Resolver endpoint, such as whether it's an inbound or an outbound endpoint, and the IP addresses in your VPC that DNS queries are forwarded to on the way into or out of your VPC.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_GetResolverEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toGetResolverEndpoint", []))

    @jsii.member(jsii_name="toGetResolverQueryLogConfig")
    def to_get_resolver_query_log_config(self) -> "Route53resolver":
        '''(experimental) Grants permission to get information about a specified Resolver query logging configuration, such as the number of VPCs that the configuration is logging queries for and the location that logs are sent to.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_GetResolverQueryLogConfig.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toGetResolverQueryLogConfig", []))

    @jsii.member(jsii_name="toGetResolverQueryLogConfigAssociation")
    def to_get_resolver_query_log_config_association(self) -> "Route53resolver":
        '''(experimental) Grants permission to get information about a specified association between a Resolver query logging configuration and an Amazon VPC.

        When you associate a VPC with a query logging configuration, Resolver logs DNS queries that originate in that VPC

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_GetResolverQueryLogConfigAssociation.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toGetResolverQueryLogConfigAssociation", []))

    @jsii.member(jsii_name="toGetResolverQueryLogConfigPolicy")
    def to_get_resolver_query_log_config_policy(self) -> "Route53resolver":
        '''(experimental) Grants permission to get information about a specified Resolver query logging policy, which specifies the Resolver query logging operations and resources that you want to allow another AWS account to use.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_GetResolverQueryLogConfigPolicy.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toGetResolverQueryLogConfigPolicy", []))

    @jsii.member(jsii_name="toGetResolverRule")
    def to_get_resolver_rule(self) -> "Route53resolver":
        '''(experimental) Grants permission to get information about a specified Resolver rule, such as the domain name that the rule forwards DNS queries for and the IP address that queries are forwarded to.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_GetResolverRule.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toGetResolverRule", []))

    @jsii.member(jsii_name="toGetResolverRuleAssociation")
    def to_get_resolver_rule_association(self) -> "Route53resolver":
        '''(experimental) Grants permission to get information about an association between a specified Resolver rule and a VPC.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_GetResolverRuleAssociation.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toGetResolverRuleAssociation", []))

    @jsii.member(jsii_name="toGetResolverRulePolicy")
    def to_get_resolver_rule_policy(self) -> "Route53resolver":
        '''(experimental) Grants permission to get information about a Resolver rule policy, which specifies the Resolver operations and resources that you want to allow another AWS account to use.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_GetResolverRulePolicy.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toGetResolverRulePolicy", []))

    @jsii.member(jsii_name="toImportFirewallDomains")
    def to_import_firewall_domains(self) -> "Route53resolver":
        '''(experimental) Grants permission to add, remove or replace Firewall domains in a Firewall domain list.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_ImportFirewallDomains.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toImportFirewallDomains", []))

    @jsii.member(jsii_name="toListFirewallConfigs")
    def to_list_firewall_configs(self) -> "Route53resolver":
        '''(experimental) Grants permission to list all the Firewall config that current AWS account is able to check.

        Access Level: List

        Dependent actions:

        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_ListFirewallConfigs.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toListFirewallConfigs", []))

    @jsii.member(jsii_name="toListFirewallDomainLists")
    def to_list_firewall_domain_lists(self) -> "Route53resolver":
        '''(experimental) Grants permission to list all the Firewall domain list that current AWS account is able to use.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_ListFirewallDomainLists.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toListFirewallDomainLists", []))

    @jsii.member(jsii_name="toListFirewallDomains")
    def to_list_firewall_domains(self) -> "Route53resolver":
        '''(experimental) Grants permission to list all the Firewall domain under a speicfied Firewall domain list.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_ListFirewallDomains.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toListFirewallDomains", []))

    @jsii.member(jsii_name="toListFirewallRuleGroupAssociations")
    def to_list_firewall_rule_group_associations(self) -> "Route53resolver":
        '''(experimental) Grants permission to list information about associations between Amazon VPCs and Firewall rule group.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_ListFirewallRuleGroupAssociations.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toListFirewallRuleGroupAssociations", []))

    @jsii.member(jsii_name="toListFirewallRuleGroups")
    def to_list_firewall_rule_groups(self) -> "Route53resolver":
        '''(experimental) Grants permission to list all the Firewall rule group that current AWS account is able to use.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_ListFirewallRuleGroups.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toListFirewallRuleGroups", []))

    @jsii.member(jsii_name="toListFirewallRules")
    def to_list_firewall_rules(self) -> "Route53resolver":
        '''(experimental) Grants permission to list all the Firewall rule under a speicfied Firewall rule group.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_ListFirewallRules.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toListFirewallRules", []))

    @jsii.member(jsii_name="toListResolverDnssecConfigs")
    def to_list_resolver_dnssec_configs(self) -> "Route53resolver":
        '''(experimental) Grants permission to list the DNSSEC validation support status for DNS queries.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_ListResolverDnssecConfigs.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toListResolverDnssecConfigs", []))

    @jsii.member(jsii_name="toListResolverEndpointIpAddresses")
    def to_list_resolver_endpoint_ip_addresses(self) -> "Route53resolver":
        '''(experimental) For a specified Resolver endpoint, grants permission to list the IP addresses that DNS queries pass through on the way to your network (outbound) or your VPCs (inbound).

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_ListResolverEndpointIpAddresses.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toListResolverEndpointIpAddresses", []))

    @jsii.member(jsii_name="toListResolverEndpoints")
    def to_list_resolver_endpoints(self) -> "Route53resolver":
        '''(experimental) Grants permission to list all the Resolver endpoints that were created using the current AWS account.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_ListResolverEndpoints.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toListResolverEndpoints", []))

    @jsii.member(jsii_name="toListResolverQueryLogConfigAssociations")
    def to_list_resolver_query_log_config_associations(self) -> "Route53resolver":
        '''(experimental) Grants permission to list information about associations between Amazon VPCs and query logging configurations.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_ListResolverQueryLogConfigAssociations.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toListResolverQueryLogConfigAssociations", []))

    @jsii.member(jsii_name="toListResolverQueryLogConfigs")
    def to_list_resolver_query_log_configs(self) -> "Route53resolver":
        '''(experimental) Grants permission to list information about the specified query logging configurations, which define where you want Resolver to save DNS query logs and specify the VPCs that you want to log queries for.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_ListResolverQueryLogConfigs.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toListResolverQueryLogConfigs", []))

    @jsii.member(jsii_name="toListResolverRuleAssociations")
    def to_list_resolver_rule_associations(self) -> "Route53resolver":
        '''(experimental) Grants permission to list the associations that were created between Resolver rules and VPCs using the current AWS account.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_ListResolverRuleAssociations.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toListResolverRuleAssociations", []))

    @jsii.member(jsii_name="toListResolverRules")
    def to_list_resolver_rules(self) -> "Route53resolver":
        '''(experimental) Grants permission to list the Resolver rules that were created using the current AWS account.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_ListResolverRules.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toListResolverRules", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Route53resolver":
        '''(experimental) Grants permission to list the tags that you associated with the specified resource.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutFirewallRuleGroupPolicy")
    def to_put_firewall_rule_group_policy(self) -> "Route53resolver":
        '''(experimental) Grants permission to specify an AWS account that you want to share a Firewall rule group with, the Firewall rule group that you want to share, and the operations that you want the account to be able to perform on the configuration.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_PutFirewallRuleGroupPolicy.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toPutFirewallRuleGroupPolicy", []))

    @jsii.member(jsii_name="toPutResolverQueryLogConfigPolicy")
    def to_put_resolver_query_log_config_policy(self) -> "Route53resolver":
        '''(experimental) Grants permission to specify an AWS account that you want to share a query logging configuration with, the query logging configuration that you want to share, and the operations that you want the account to be able to perform on the configuration.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_PutResolverQueryLogConfigPolicy.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toPutResolverQueryLogConfigPolicy", []))

    @jsii.member(jsii_name="toPutResolverRulePolicy")
    def to_put_resolver_rule_policy(self) -> "Route53resolver":
        '''(experimental) Grants permission to specify an AWS account that you want to share rules with, the Resolver rules that you want to share, and the operations that you want the account to be able to perform on those rules.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_PutResolverRulePolicy.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toPutResolverRulePolicy", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Route53resolver":
        '''(experimental) Grants permission to add one or more tags to a specified resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Route53resolver":
        '''(experimental) Grants permission to remove one or more tags from a specified resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateFirewallConfig")
    def to_update_firewall_config(self) -> "Route53resolver":
        '''(experimental) Grants permission to update selected settings for an Firewall config.

        Access Level: Write

        Dependent actions:

        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_UpdateFirewallConfig.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toUpdateFirewallConfig", []))

    @jsii.member(jsii_name="toUpdateFirewallDomains")
    def to_update_firewall_domains(self) -> "Route53resolver":
        '''(experimental) Grants permission to add, remove or replace Firewall domains in a Firewall domain list.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_UpdateFirewallDomains.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toUpdateFirewallDomains", []))

    @jsii.member(jsii_name="toUpdateFirewallRule")
    def to_update_firewall_rule(self) -> "Route53resolver":
        '''(experimental) Grants permission to update selected settings for an Firewall rule in a Firewall rule group.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_UpdateFirewallRule.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toUpdateFirewallRule", []))

    @jsii.member(jsii_name="toUpdateFirewallRuleGroupAssociation")
    def to_update_firewall_rule_group_association(self) -> "Route53resolver":
        '''(experimental) Grants permission to update selected settings for an Firewall rule group association.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_UpdateFirewallRuleGroupAssociation.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toUpdateFirewallRuleGroupAssociation", []))

    @jsii.member(jsii_name="toUpdateResolverDnssecConfig")
    def to_update_resolver_dnssec_config(self) -> "Route53resolver":
        '''(experimental) Grants permission to update the DNSSEC validation support status for DNS queries within the specified resource.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_UpdateResolverDnssecConfig.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toUpdateResolverDnssecConfig", []))

    @jsii.member(jsii_name="toUpdateResolverEndpoint")
    def to_update_resolver_endpoint(self) -> "Route53resolver":
        '''(experimental) Grants permission to update selected settings for an inbound or an outbound Resolver endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_UpdateResolverEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toUpdateResolverEndpoint", []))

    @jsii.member(jsii_name="toUpdateResolverRule")
    def to_update_resolver_rule(self) -> "Route53resolver":
        '''(experimental) Grants permission to update settings for a specified Resolver rule.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_UpdateResolverRule.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toUpdateResolverRule", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class S3(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.S3"):
    '''(experimental) Statement provider for service `s3 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazons3.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `s3 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazons3.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(S3, self, [sid])

    @jsii.member(jsii_name="ifAccessPointNetworkOrigin")
    def if_access_point_network_origin(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by the network origin (Internet or VPC).

        https://docs.aws.amazon.com/AmazonS3/latest/dev/creating-access-points.html#access-points-policies

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toBypassGovernanceRetention()
        - .toCreateAccessPoint()
        - .toCreateAccessPointForObjectLambda()
        - .toDeleteAccessPoint()
        - .toDeleteAccessPointForObjectLambda()
        - .toDeleteAccessPointPolicy()
        - .toDeleteAccessPointPolicyForObjectLambda()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toDeleteObjectVersion()
        - .toDeleteObjectVersionTagging()
        - .toGetAccessPoint()
        - .toGetAccessPointConfigurationForObjectLambda()
        - .toGetAccessPointForObjectLambda()
        - .toGetAccessPointPolicy()
        - .toGetAccessPointPolicyForObjectLambda()
        - .toGetAccessPointPolicyStatus()
        - .toGetAccessPointPolicyStatusForObjectLambda()
        - .toGetObject()
        - .toGetObjectAcl()
        - .toGetObjectLegalHold()
        - .toGetObjectRetention()
        - .toGetObjectTagging()
        - .toGetObjectVersion()
        - .toGetObjectVersionAcl()
        - .toGetObjectVersionTagging()
        - .toListBucket()
        - .toListBucketMultipartUploads()
        - .toListBucketVersions()
        - .toListMultipartUploadParts()
        - .toPutAccessPointConfigurationForObjectLambda()
        - .toPutAccessPointPolicy()
        - .toPutAccessPointPolicyForObjectLambda()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectLegalHold()
        - .toPutObjectRetention()
        - .toPutObjectTagging()
        - .toPutObjectVersionAcl()
        - .toPutObjectVersionTagging()
        - .toRestoreObject()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifAccessPointNetworkOrigin", [value, operator]))

    @jsii.member(jsii_name="ifAuthType")
    def if_auth_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by authentication method.

        https://docs.aws.amazon.com/AmazonS3/latest/API/bucket-policy-s3-sigv4-conditions.html

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toBypassGovernanceRetention()
        - .toCreateAccessPoint()
        - .toCreateAccessPointForObjectLambda()
        - .toCreateBucket()
        - .toCreateJob()
        - .toDeleteAccessPoint()
        - .toDeleteAccessPointForObjectLambda()
        - .toDeleteAccessPointPolicy()
        - .toDeleteAccessPointPolicyForObjectLambda()
        - .toDeleteBucket()
        - .toDeleteBucketOwnershipControls()
        - .toDeleteBucketPolicy()
        - .toDeleteBucketWebsite()
        - .toDeleteJobTagging()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toDeleteObjectVersion()
        - .toDeleteObjectVersionTagging()
        - .toDeleteStorageLensConfiguration()
        - .toDeleteStorageLensConfigurationTagging()
        - .toDescribeJob()
        - .toGetAccelerateConfiguration()
        - .toGetAccessPoint()
        - .toGetAccessPointConfigurationForObjectLambda()
        - .toGetAccessPointForObjectLambda()
        - .toGetAccessPointPolicy()
        - .toGetAccessPointPolicyForObjectLambda()
        - .toGetAccessPointPolicyStatus()
        - .toGetAccessPointPolicyStatusForObjectLambda()
        - .toGetAccountPublicAccessBlock()
        - .toGetAnalyticsConfiguration()
        - .toGetBucketAcl()
        - .toGetBucketCORS()
        - .toGetBucketLogging()
        - .toGetBucketNotification()
        - .toGetBucketObjectLockConfiguration()
        - .toGetBucketOwnershipControls()
        - .toGetBucketPolicy()
        - .toGetBucketPolicyStatus()
        - .toGetBucketPublicAccessBlock()
        - .toGetBucketRequestPayment()
        - .toGetBucketTagging()
        - .toGetBucketVersioning()
        - .toGetBucketWebsite()
        - .toGetEncryptionConfiguration()
        - .toGetIntelligentTieringConfiguration()
        - .toGetInventoryConfiguration()
        - .toGetJobTagging()
        - .toGetLifecycleConfiguration()
        - .toGetMetricsConfiguration()
        - .toGetObject()
        - .toGetObjectAcl()
        - .toGetObjectLegalHold()
        - .toGetObjectRetention()
        - .toGetObjectTagging()
        - .toGetObjectTorrent()
        - .toGetObjectVersion()
        - .toGetObjectVersionAcl()
        - .toGetObjectVersionForReplication()
        - .toGetObjectVersionTagging()
        - .toGetObjectVersionTorrent()
        - .toGetReplicationConfiguration()
        - .toGetStorageLensConfiguration()
        - .toGetStorageLensConfigurationTagging()
        - .toGetStorageLensDashboard()
        - .toListAccessPoints()
        - .toListAccessPointsForObjectLambda()
        - .toListAllMyBuckets()
        - .toListBucket()
        - .toListBucketMultipartUploads()
        - .toListBucketVersions()
        - .toListJobs()
        - .toListMultipartUploadParts()
        - .toListStorageLensConfigurations()
        - .toObjectOwnerOverrideToBucketOwner()
        - .toPutAccelerateConfiguration()
        - .toPutAccessPointConfigurationForObjectLambda()
        - .toPutAccessPointPolicy()
        - .toPutAccessPointPolicyForObjectLambda()
        - .toPutAccountPublicAccessBlock()
        - .toPutAnalyticsConfiguration()
        - .toPutBucketAcl()
        - .toPutBucketCORS()
        - .toPutBucketLogging()
        - .toPutBucketNotification()
        - .toPutBucketObjectLockConfiguration()
        - .toPutBucketOwnershipControls()
        - .toPutBucketPolicy()
        - .toPutBucketPublicAccessBlock()
        - .toPutBucketRequestPayment()
        - .toPutBucketTagging()
        - .toPutBucketVersioning()
        - .toPutBucketWebsite()
        - .toPutEncryptionConfiguration()
        - .toPutIntelligentTieringConfiguration()
        - .toPutInventoryConfiguration()
        - .toPutJobTagging()
        - .toPutLifecycleConfiguration()
        - .toPutMetricsConfiguration()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectLegalHold()
        - .toPutObjectRetention()
        - .toPutObjectTagging()
        - .toPutObjectVersionAcl()
        - .toPutObjectVersionTagging()
        - .toPutReplicationConfiguration()
        - .toPutStorageLensConfiguration()
        - .toPutStorageLensConfigurationTagging()
        - .toReplicateDelete()
        - .toReplicateObject()
        - .toReplicateTags()
        - .toRestoreObject()
        - .toUpdateJobPriority()
        - .toUpdateJobStatus()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifAuthType", [value, operator]))

    @jsii.member(jsii_name="ifDataAccessPointAccount")
    def if_data_access_point_account(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by the AWS Account ID that owns the access point.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/creating-access-points.html#access-points-policies

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toBypassGovernanceRetention()
        - .toCreateAccessPoint()
        - .toCreateAccessPointForObjectLambda()
        - .toDeleteAccessPoint()
        - .toDeleteAccessPointForObjectLambda()
        - .toDeleteAccessPointPolicy()
        - .toDeleteAccessPointPolicyForObjectLambda()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toDeleteObjectVersion()
        - .toDeleteObjectVersionTagging()
        - .toGetAccessPoint()
        - .toGetAccessPointConfigurationForObjectLambda()
        - .toGetAccessPointForObjectLambda()
        - .toGetAccessPointPolicy()
        - .toGetAccessPointPolicyForObjectLambda()
        - .toGetAccessPointPolicyStatus()
        - .toGetAccessPointPolicyStatusForObjectLambda()
        - .toGetObject()
        - .toGetObjectAcl()
        - .toGetObjectLegalHold()
        - .toGetObjectRetention()
        - .toGetObjectTagging()
        - .toGetObjectVersion()
        - .toGetObjectVersionAcl()
        - .toGetObjectVersionTagging()
        - .toListBucket()
        - .toListBucketMultipartUploads()
        - .toListBucketVersions()
        - .toListMultipartUploadParts()
        - .toPutAccessPointConfigurationForObjectLambda()
        - .toPutAccessPointPolicy()
        - .toPutAccessPointPolicyForObjectLambda()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectLegalHold()
        - .toPutObjectRetention()
        - .toPutObjectTagging()
        - .toPutObjectVersionAcl()
        - .toPutObjectVersionTagging()
        - .toRestoreObject()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifDataAccessPointAccount", [value, operator]))

    @jsii.member(jsii_name="ifDataAccessPointArn")
    def if_data_access_point_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by an access point Amazon Resource Name (ARN).

        https://docs.aws.amazon.com/AmazonS3/latest/dev/creating-access-points.html#access-points-policies

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toBypassGovernanceRetention()
        - .toCreateAccessPoint()
        - .toCreateAccessPointForObjectLambda()
        - .toDeleteAccessPoint()
        - .toDeleteAccessPointForObjectLambda()
        - .toDeleteAccessPointPolicy()
        - .toDeleteAccessPointPolicyForObjectLambda()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toDeleteObjectVersion()
        - .toDeleteObjectVersionTagging()
        - .toGetAccessPoint()
        - .toGetAccessPointConfigurationForObjectLambda()
        - .toGetAccessPointForObjectLambda()
        - .toGetAccessPointPolicy()
        - .toGetAccessPointPolicyForObjectLambda()
        - .toGetAccessPointPolicyStatus()
        - .toGetAccessPointPolicyStatusForObjectLambda()
        - .toGetObject()
        - .toGetObjectAcl()
        - .toGetObjectLegalHold()
        - .toGetObjectRetention()
        - .toGetObjectTagging()
        - .toGetObjectVersion()
        - .toGetObjectVersionAcl()
        - .toGetObjectVersionTagging()
        - .toListBucket()
        - .toListBucketMultipartUploads()
        - .toListBucketVersions()
        - .toListMultipartUploadParts()
        - .toPutAccessPointConfigurationForObjectLambda()
        - .toPutAccessPointPolicy()
        - .toPutAccessPointPolicyForObjectLambda()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectLegalHold()
        - .toPutObjectRetention()
        - .toPutObjectTagging()
        - .toPutObjectVersionAcl()
        - .toPutObjectVersionTagging()
        - .toRestoreObject()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifDataAccessPointArn", [value, operator]))

    @jsii.member(jsii_name="ifDelimiter")
    def if_delimiter(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by delimiter parameter.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/walkthrough1.html

        Applies to actions:

        - .toListBucket()
        - .toListBucketVersions()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifDelimiter", [value, operator]))

    @jsii.member(jsii_name="ifExistingJobOperation")
    def if_existing_job_operation(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access to updating the job priority by operation.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/batch-ops-job-tags-examples.html

        Applies to actions:

        - .toDeleteJobTagging()
        - .toPutJobTagging()
        - .toUpdateJobPriority()
        - .toUpdateJobStatus()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifExistingJobOperation", [value, operator]))

    @jsii.member(jsii_name="ifExistingJobPriority")
    def if_existing_job_priority(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access to cancelling existing jobs by priority range.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/batch-ops-job-tags-examples.html

        Applies to actions:

        - .toDeleteJobTagging()
        - .toPutJobTagging()
        - .toUpdateJobPriority()
        - .toUpdateJobStatus()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifExistingJobPriority", [value, operator]))

    @jsii.member(jsii_name="ifExistingObjectTag")
    def if_existing_object_tag(
        self,
        key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by existing object tag key and value.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/object-tagging.html#tagging-and-policies

        Applies to actions:

        - .toDeleteObjectTagging()
        - .toDeleteObjectVersionTagging()
        - .toGetObject()
        - .toGetObjectAcl()
        - .toGetObjectTagging()
        - .toGetObjectVersion()
        - .toGetObjectVersionAcl()
        - .toGetObjectVersionTagging()
        - .toPutObjectAcl()
        - .toPutObjectTagging()
        - .toPutObjectVersionAcl()
        - .toPutObjectVersionTagging()

        :param key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifExistingObjectTag", [key, value, operator]))

    @jsii.member(jsii_name="ifJobSuspendedCause")
    def if_job_suspended_cause(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access to cancelling suspended jobs by a specific job suspended cause (for example, AWAITING_CONFIRMATION).

        https://docs.aws.amazon.com/AmazonS3/latest/dev/batch-ops-job-tags-examples.html

        Applies to actions:

        - .toUpdateJobStatus()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifJobSuspendedCause", [value, operator]))

    @jsii.member(jsii_name="ifLocationconstraint")
    def if_locationconstraint(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by a specific Region.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/amazon-s3-policy-keys.html#condition-key-bucket-ops-1

        Applies to actions:

        - .toCreateAccessPoint()
        - .toCreateBucket()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifLocationconstraint", [value, operator]))

    @jsii.member(jsii_name="ifLocationConstraint")
    def if_location_constraint(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by a specific Region.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/amazon-s3-policy-keys.html#condition-key-bucket-ops-1

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifLocationConstraint", [value, operator]))

    @jsii.member(jsii_name="ifMaxKeys")
    def if_max_keys(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by maximum number of keys returned in a ListBucket request.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/amazon-s3-policy-keys.html#example-numeric-condition-operators

        Applies to actions:

        - .toListBucket()
        - .toListBucketVersions()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifMaxKeys", [value, operator]))

    @jsii.member(jsii_name="ifObjectLockLegalHold")
    def if_object_lock_legal_hold(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by object legal hold status.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html#object-lock-legal-holds

        Applies to actions:

        - .toBypassGovernanceRetention()
        - .toPutObject()
        - .toPutObjectLegalHold()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifObjectLockLegalHold", [value, operator]))

    @jsii.member(jsii_name="ifObjectLockMode")
    def if_object_lock_mode(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by object retention mode (COMPLIANCE or GOVERNANCE).

        https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html#object-lock-retention-modes

        Applies to actions:

        - .toBypassGovernanceRetention()
        - .toPutObject()
        - .toPutObjectRetention()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifObjectLockMode", [value, operator]))

    @jsii.member(jsii_name="ifObjectLockRemainingRetentionDays")
    def if_object_lock_remaining_retention_days(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by remaining object retention days.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-managing.html#object-lock-managing-retention-limits

        Applies to actions:

        - .toBypassGovernanceRetention()
        - .toPutObject()
        - .toPutObjectRetention()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifObjectLockRemainingRetentionDays", [value, operator]))

    @jsii.member(jsii_name="ifObjectLockRetainUntilDate")
    def if_object_lock_retain_until_date(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by object retain-until date.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html#object-lock-retention-periods

        Applies to actions:

        - .toBypassGovernanceRetention()
        - .toPutObject()
        - .toPutObjectRetention()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifObjectLockRetainUntilDate", [value, operator]))

    @jsii.member(jsii_name="ifPrefix")
    def if_prefix(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by key name prefix.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/amazon-s3-policy-keys.html#condition-key-bucket-ops-2

        Applies to actions:

        - .toListBucket()
        - .toListBucketVersions()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifPrefix", [value, operator]))

    @jsii.member(jsii_name="ifRequestJobOperation")
    def if_request_job_operation(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access to creating jobs by operation.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/batch-ops-job-tags-examples.html

        Applies to actions:

        - .toCreateJob()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifRequestJobOperation", [value, operator]))

    @jsii.member(jsii_name="ifRequestJobPriority")
    def if_request_job_priority(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access to creating new jobs by priority range.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/batch-ops-job-tags-examples.html

        Applies to actions:

        - .toCreateJob()
        - .toUpdateJobPriority()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifRequestJobPriority", [value, operator]))

    @jsii.member(jsii_name="ifRequestObjectTag")
    def if_request_object_tag(
        self,
        key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by the tag keys and values to be added to objects.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/object-tagging.html#tagging-and-policies

        Applies to actions:

        - .toBypassGovernanceRetention()
        - .toPutObject()
        - .toPutObjectTagging()
        - .toPutObjectVersionTagging()

        :param key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifRequestObjectTag", [key, value, operator]))

    @jsii.member(jsii_name="ifRequestObjectTagKeys")
    def if_request_object_tag_keys(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by the tag keys to be added to objects.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/object-tagging.html#tagging-and-policies

        Applies to actions:

        - .toBypassGovernanceRetention()
        - .toPutObject()
        - .toPutObjectTagging()
        - .toPutObjectVersionTagging()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifRequestObjectTagKeys", [value, operator]))

    @jsii.member(jsii_name="ifResourceAccount")
    def if_resource_account(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by the resource owner AWS account ID.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/amazon-s3-policy-keys.html#condition-key-bucket-ops-2

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toBypassGovernanceRetention()
        - .toCreateAccessPoint()
        - .toCreateAccessPointForObjectLambda()
        - .toCreateBucket()
        - .toCreateJob()
        - .toDeleteAccessPoint()
        - .toDeleteAccessPointForObjectLambda()
        - .toDeleteAccessPointPolicy()
        - .toDeleteAccessPointPolicyForObjectLambda()
        - .toDeleteBucket()
        - .toDeleteBucketOwnershipControls()
        - .toDeleteBucketPolicy()
        - .toDeleteBucketWebsite()
        - .toDeleteJobTagging()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toDeleteObjectVersion()
        - .toDeleteObjectVersionTagging()
        - .toDeleteStorageLensConfiguration()
        - .toDeleteStorageLensConfigurationTagging()
        - .toDescribeJob()
        - .toGetAccelerateConfiguration()
        - .toGetAccessPoint()
        - .toGetAccessPointConfigurationForObjectLambda()
        - .toGetAccessPointForObjectLambda()
        - .toGetAccessPointPolicy()
        - .toGetAccessPointPolicyForObjectLambda()
        - .toGetAccessPointPolicyStatus()
        - .toGetAccessPointPolicyStatusForObjectLambda()
        - .toGetAccountPublicAccessBlock()
        - .toGetAnalyticsConfiguration()
        - .toGetBucketAcl()
        - .toGetBucketCORS()
        - .toGetBucketLogging()
        - .toGetBucketNotification()
        - .toGetBucketObjectLockConfiguration()
        - .toGetBucketOwnershipControls()
        - .toGetBucketPolicy()
        - .toGetBucketPolicyStatus()
        - .toGetBucketPublicAccessBlock()
        - .toGetBucketRequestPayment()
        - .toGetBucketTagging()
        - .toGetBucketVersioning()
        - .toGetBucketWebsite()
        - .toGetEncryptionConfiguration()
        - .toGetIntelligentTieringConfiguration()
        - .toGetInventoryConfiguration()
        - .toGetJobTagging()
        - .toGetLifecycleConfiguration()
        - .toGetMetricsConfiguration()
        - .toGetObject()
        - .toGetObjectAcl()
        - .toGetObjectLegalHold()
        - .toGetObjectRetention()
        - .toGetObjectTagging()
        - .toGetObjectTorrent()
        - .toGetObjectVersion()
        - .toGetObjectVersionAcl()
        - .toGetObjectVersionForReplication()
        - .toGetObjectVersionTagging()
        - .toGetObjectVersionTorrent()
        - .toGetReplicationConfiguration()
        - .toGetStorageLensConfiguration()
        - .toGetStorageLensConfigurationTagging()
        - .toGetStorageLensDashboard()
        - .toListAccessPoints()
        - .toListAccessPointsForObjectLambda()
        - .toListAllMyBuckets()
        - .toListBucket()
        - .toListBucketMultipartUploads()
        - .toListBucketVersions()
        - .toListJobs()
        - .toListMultipartUploadParts()
        - .toListStorageLensConfigurations()
        - .toObjectOwnerOverrideToBucketOwner()
        - .toPutAccelerateConfiguration()
        - .toPutAccessPointConfigurationForObjectLambda()
        - .toPutAccessPointPolicy()
        - .toPutAccessPointPolicyForObjectLambda()
        - .toPutAccountPublicAccessBlock()
        - .toPutAnalyticsConfiguration()
        - .toPutBucketAcl()
        - .toPutBucketCORS()
        - .toPutBucketLogging()
        - .toPutBucketNotification()
        - .toPutBucketObjectLockConfiguration()
        - .toPutBucketOwnershipControls()
        - .toPutBucketPolicy()
        - .toPutBucketPublicAccessBlock()
        - .toPutBucketRequestPayment()
        - .toPutBucketTagging()
        - .toPutBucketVersioning()
        - .toPutBucketWebsite()
        - .toPutEncryptionConfiguration()
        - .toPutIntelligentTieringConfiguration()
        - .toPutInventoryConfiguration()
        - .toPutJobTagging()
        - .toPutLifecycleConfiguration()
        - .toPutMetricsConfiguration()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectLegalHold()
        - .toPutObjectRetention()
        - .toPutObjectTagging()
        - .toPutObjectVersionAcl()
        - .toPutObjectVersionTagging()
        - .toPutReplicationConfiguration()
        - .toPutStorageLensConfiguration()
        - .toPutStorageLensConfigurationTagging()
        - .toReplicateDelete()
        - .toReplicateObject()
        - .toReplicateTags()
        - .toRestoreObject()
        - .toUpdateJobPriority()
        - .toUpdateJobStatus()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifResourceAccount", [value, operator]))

    @jsii.member(jsii_name="ifSignatureAge")
    def if_signature_age(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by the age in milliseconds of the request signature.

        https://docs.aws.amazon.com/AmazonS3/latest/API/bucket-policy-s3-sigv4-conditions.html

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toBypassGovernanceRetention()
        - .toCreateAccessPoint()
        - .toCreateAccessPointForObjectLambda()
        - .toCreateBucket()
        - .toCreateJob()
        - .toDeleteAccessPoint()
        - .toDeleteAccessPointForObjectLambda()
        - .toDeleteAccessPointPolicy()
        - .toDeleteAccessPointPolicyForObjectLambda()
        - .toDeleteBucket()
        - .toDeleteBucketOwnershipControls()
        - .toDeleteBucketPolicy()
        - .toDeleteBucketWebsite()
        - .toDeleteJobTagging()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toDeleteObjectVersion()
        - .toDeleteObjectVersionTagging()
        - .toDeleteStorageLensConfiguration()
        - .toDeleteStorageLensConfigurationTagging()
        - .toDescribeJob()
        - .toGetAccelerateConfiguration()
        - .toGetAccessPoint()
        - .toGetAccessPointConfigurationForObjectLambda()
        - .toGetAccessPointForObjectLambda()
        - .toGetAccessPointPolicy()
        - .toGetAccessPointPolicyForObjectLambda()
        - .toGetAccessPointPolicyStatus()
        - .toGetAccessPointPolicyStatusForObjectLambda()
        - .toGetAccountPublicAccessBlock()
        - .toGetAnalyticsConfiguration()
        - .toGetBucketAcl()
        - .toGetBucketCORS()
        - .toGetBucketLogging()
        - .toGetBucketNotification()
        - .toGetBucketObjectLockConfiguration()
        - .toGetBucketOwnershipControls()
        - .toGetBucketPolicy()
        - .toGetBucketPolicyStatus()
        - .toGetBucketPublicAccessBlock()
        - .toGetBucketRequestPayment()
        - .toGetBucketTagging()
        - .toGetBucketVersioning()
        - .toGetBucketWebsite()
        - .toGetEncryptionConfiguration()
        - .toGetIntelligentTieringConfiguration()
        - .toGetInventoryConfiguration()
        - .toGetJobTagging()
        - .toGetLifecycleConfiguration()
        - .toGetMetricsConfiguration()
        - .toGetObject()
        - .toGetObjectAcl()
        - .toGetObjectLegalHold()
        - .toGetObjectRetention()
        - .toGetObjectTagging()
        - .toGetObjectTorrent()
        - .toGetObjectVersion()
        - .toGetObjectVersionAcl()
        - .toGetObjectVersionForReplication()
        - .toGetObjectVersionTagging()
        - .toGetObjectVersionTorrent()
        - .toGetReplicationConfiguration()
        - .toGetStorageLensConfiguration()
        - .toGetStorageLensConfigurationTagging()
        - .toGetStorageLensDashboard()
        - .toListAccessPoints()
        - .toListAccessPointsForObjectLambda()
        - .toListAllMyBuckets()
        - .toListBucket()
        - .toListBucketMultipartUploads()
        - .toListBucketVersions()
        - .toListJobs()
        - .toListMultipartUploadParts()
        - .toListStorageLensConfigurations()
        - .toObjectOwnerOverrideToBucketOwner()
        - .toPutAccelerateConfiguration()
        - .toPutAccessPointConfigurationForObjectLambda()
        - .toPutAccessPointPolicy()
        - .toPutAccessPointPolicyForObjectLambda()
        - .toPutAccountPublicAccessBlock()
        - .toPutAnalyticsConfiguration()
        - .toPutBucketAcl()
        - .toPutBucketCORS()
        - .toPutBucketLogging()
        - .toPutBucketNotification()
        - .toPutBucketObjectLockConfiguration()
        - .toPutBucketOwnershipControls()
        - .toPutBucketPolicy()
        - .toPutBucketPublicAccessBlock()
        - .toPutBucketRequestPayment()
        - .toPutBucketTagging()
        - .toPutBucketVersioning()
        - .toPutBucketWebsite()
        - .toPutEncryptionConfiguration()
        - .toPutIntelligentTieringConfiguration()
        - .toPutInventoryConfiguration()
        - .toPutJobTagging()
        - .toPutLifecycleConfiguration()
        - .toPutMetricsConfiguration()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectLegalHold()
        - .toPutObjectRetention()
        - .toPutObjectTagging()
        - .toPutObjectVersionAcl()
        - .toPutObjectVersionTagging()
        - .toPutReplicationConfiguration()
        - .toPutStorageLensConfiguration()
        - .toPutStorageLensConfigurationTagging()
        - .toReplicateDelete()
        - .toReplicateObject()
        - .toReplicateTags()
        - .toRestoreObject()
        - .toUpdateJobPriority()
        - .toUpdateJobStatus()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifSignatureAge", [value, operator]))

    @jsii.member(jsii_name="ifSignatureversion")
    def if_signatureversion(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by the version of AWS Signature used on the request.

        https://docs.aws.amazon.com/AmazonS3/latest/API/bucket-policy-s3-sigv4-conditions.html

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toBypassGovernanceRetention()
        - .toCreateAccessPoint()
        - .toCreateAccessPointForObjectLambda()
        - .toCreateBucket()
        - .toCreateJob()
        - .toDeleteAccessPoint()
        - .toDeleteAccessPointForObjectLambda()
        - .toDeleteAccessPointPolicy()
        - .toDeleteAccessPointPolicyForObjectLambda()
        - .toDeleteBucket()
        - .toDeleteBucketOwnershipControls()
        - .toDeleteBucketPolicy()
        - .toDeleteBucketWebsite()
        - .toDeleteJobTagging()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toDeleteObjectVersion()
        - .toDeleteObjectVersionTagging()
        - .toDeleteStorageLensConfiguration()
        - .toDeleteStorageLensConfigurationTagging()
        - .toDescribeJob()
        - .toGetAccelerateConfiguration()
        - .toGetAccessPoint()
        - .toGetAccessPointConfigurationForObjectLambda()
        - .toGetAccessPointForObjectLambda()
        - .toGetAccessPointPolicy()
        - .toGetAccessPointPolicyForObjectLambda()
        - .toGetAccessPointPolicyStatus()
        - .toGetAccessPointPolicyStatusForObjectLambda()
        - .toGetAccountPublicAccessBlock()
        - .toGetAnalyticsConfiguration()
        - .toGetBucketAcl()
        - .toGetBucketCORS()
        - .toGetBucketLogging()
        - .toGetBucketNotification()
        - .toGetBucketObjectLockConfiguration()
        - .toGetBucketOwnershipControls()
        - .toGetBucketPolicy()
        - .toGetBucketPolicyStatus()
        - .toGetBucketPublicAccessBlock()
        - .toGetBucketRequestPayment()
        - .toGetBucketTagging()
        - .toGetBucketVersioning()
        - .toGetBucketWebsite()
        - .toGetEncryptionConfiguration()
        - .toGetIntelligentTieringConfiguration()
        - .toGetInventoryConfiguration()
        - .toGetJobTagging()
        - .toGetLifecycleConfiguration()
        - .toGetMetricsConfiguration()
        - .toGetObject()
        - .toGetObjectAcl()
        - .toGetObjectLegalHold()
        - .toGetObjectRetention()
        - .toGetObjectTagging()
        - .toGetObjectTorrent()
        - .toGetObjectVersion()
        - .toGetObjectVersionAcl()
        - .toGetObjectVersionForReplication()
        - .toGetObjectVersionTagging()
        - .toGetObjectVersionTorrent()
        - .toGetReplicationConfiguration()
        - .toGetStorageLensConfiguration()
        - .toGetStorageLensConfigurationTagging()
        - .toGetStorageLensDashboard()
        - .toListAccessPoints()
        - .toListAccessPointsForObjectLambda()
        - .toListAllMyBuckets()
        - .toListBucket()
        - .toListBucketMultipartUploads()
        - .toListBucketVersions()
        - .toListJobs()
        - .toListMultipartUploadParts()
        - .toListStorageLensConfigurations()
        - .toObjectOwnerOverrideToBucketOwner()
        - .toPutAccelerateConfiguration()
        - .toPutAccessPointConfigurationForObjectLambda()
        - .toPutAccessPointPolicy()
        - .toPutAccessPointPolicyForObjectLambda()
        - .toPutAccountPublicAccessBlock()
        - .toPutAnalyticsConfiguration()
        - .toPutBucketAcl()
        - .toPutBucketCORS()
        - .toPutBucketLogging()
        - .toPutBucketNotification()
        - .toPutBucketObjectLockConfiguration()
        - .toPutBucketOwnershipControls()
        - .toPutBucketPolicy()
        - .toPutBucketPublicAccessBlock()
        - .toPutBucketRequestPayment()
        - .toPutBucketTagging()
        - .toPutBucketVersioning()
        - .toPutBucketWebsite()
        - .toPutEncryptionConfiguration()
        - .toPutIntelligentTieringConfiguration()
        - .toPutInventoryConfiguration()
        - .toPutJobTagging()
        - .toPutLifecycleConfiguration()
        - .toPutMetricsConfiguration()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectLegalHold()
        - .toPutObjectRetention()
        - .toPutObjectTagging()
        - .toPutObjectVersionAcl()
        - .toPutObjectVersionTagging()
        - .toPutReplicationConfiguration()
        - .toPutStorageLensConfiguration()
        - .toPutStorageLensConfigurationTagging()
        - .toReplicateDelete()
        - .toReplicateObject()
        - .toReplicateTags()
        - .toRestoreObject()
        - .toUpdateJobPriority()
        - .toUpdateJobStatus()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifSignatureversion", [value, operator]))

    @jsii.member(jsii_name="ifTlsVersion")
    def if_tls_version(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by the TLS version used by the client.

        https://docs.aws.amazon.com/AmazonS3/latest/API/bucket-policy-s3-sigv4-conditions.html

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toBypassGovernanceRetention()
        - .toCreateAccessPoint()
        - .toCreateAccessPointForObjectLambda()
        - .toCreateBucket()
        - .toCreateJob()
        - .toDeleteAccessPoint()
        - .toDeleteAccessPointForObjectLambda()
        - .toDeleteAccessPointPolicy()
        - .toDeleteAccessPointPolicyForObjectLambda()
        - .toDeleteBucket()
        - .toDeleteBucketOwnershipControls()
        - .toDeleteBucketPolicy()
        - .toDeleteBucketWebsite()
        - .toDeleteJobTagging()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toDeleteObjectVersion()
        - .toDeleteObjectVersionTagging()
        - .toDeleteStorageLensConfiguration()
        - .toDeleteStorageLensConfigurationTagging()
        - .toDescribeJob()
        - .toGetAccelerateConfiguration()
        - .toGetAccessPoint()
        - .toGetAccessPointConfigurationForObjectLambda()
        - .toGetAccessPointForObjectLambda()
        - .toGetAccessPointPolicy()
        - .toGetAccessPointPolicyForObjectLambda()
        - .toGetAccessPointPolicyStatus()
        - .toGetAccessPointPolicyStatusForObjectLambda()
        - .toGetAccountPublicAccessBlock()
        - .toGetAnalyticsConfiguration()
        - .toGetBucketAcl()
        - .toGetBucketCORS()
        - .toGetBucketLogging()
        - .toGetBucketNotification()
        - .toGetBucketObjectLockConfiguration()
        - .toGetBucketOwnershipControls()
        - .toGetBucketPolicy()
        - .toGetBucketPolicyStatus()
        - .toGetBucketPublicAccessBlock()
        - .toGetBucketRequestPayment()
        - .toGetBucketTagging()
        - .toGetBucketVersioning()
        - .toGetBucketWebsite()
        - .toGetEncryptionConfiguration()
        - .toGetIntelligentTieringConfiguration()
        - .toGetInventoryConfiguration()
        - .toGetJobTagging()
        - .toGetLifecycleConfiguration()
        - .toGetMetricsConfiguration()
        - .toGetObject()
        - .toGetObjectAcl()
        - .toGetObjectLegalHold()
        - .toGetObjectRetention()
        - .toGetObjectTagging()
        - .toGetObjectTorrent()
        - .toGetObjectVersion()
        - .toGetObjectVersionAcl()
        - .toGetObjectVersionForReplication()
        - .toGetObjectVersionTagging()
        - .toGetObjectVersionTorrent()
        - .toGetReplicationConfiguration()
        - .toGetStorageLensConfiguration()
        - .toGetStorageLensConfigurationTagging()
        - .toGetStorageLensDashboard()
        - .toListAccessPoints()
        - .toListAccessPointsForObjectLambda()
        - .toListAllMyBuckets()
        - .toListBucket()
        - .toListBucketMultipartUploads()
        - .toListBucketVersions()
        - .toListJobs()
        - .toListMultipartUploadParts()
        - .toListStorageLensConfigurations()
        - .toObjectOwnerOverrideToBucketOwner()
        - .toPutAccelerateConfiguration()
        - .toPutAccessPointConfigurationForObjectLambda()
        - .toPutAccessPointPolicy()
        - .toPutAccessPointPolicyForObjectLambda()
        - .toPutAccountPublicAccessBlock()
        - .toPutAnalyticsConfiguration()
        - .toPutBucketAcl()
        - .toPutBucketCORS()
        - .toPutBucketLogging()
        - .toPutBucketNotification()
        - .toPutBucketObjectLockConfiguration()
        - .toPutBucketOwnershipControls()
        - .toPutBucketPolicy()
        - .toPutBucketPublicAccessBlock()
        - .toPutBucketRequestPayment()
        - .toPutBucketTagging()
        - .toPutBucketVersioning()
        - .toPutBucketWebsite()
        - .toPutEncryptionConfiguration()
        - .toPutIntelligentTieringConfiguration()
        - .toPutInventoryConfiguration()
        - .toPutJobTagging()
        - .toPutLifecycleConfiguration()
        - .toPutMetricsConfiguration()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectLegalHold()
        - .toPutObjectRetention()
        - .toPutObjectTagging()
        - .toPutObjectVersionAcl()
        - .toPutObjectVersionTagging()
        - .toPutReplicationConfiguration()
        - .toPutStorageLensConfiguration()
        - .toPutStorageLensConfigurationTagging()
        - .toReplicateDelete()
        - .toReplicateObject()
        - .toReplicateTags()
        - .toRestoreObject()
        - .toUpdateJobPriority()
        - .toUpdateJobStatus()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifTlsVersion", [value, operator]))

    @jsii.member(jsii_name="ifVersionid")
    def if_versionid(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by a specific object version.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/amazon-s3-policy-keys.html#getobjectversion-limit-access-to-specific-version-3

        Applies to actions:

        - .toDeleteObjectVersion()
        - .toDeleteObjectVersionTagging()
        - .toGetObjectVersion()
        - .toGetObjectVersionAcl()
        - .toGetObjectVersionTagging()
        - .toGetObjectVersionTorrent()
        - .toPutObjectVersionAcl()
        - .toPutObjectVersionTagging()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifVersionid", [value, operator]))

    @jsii.member(jsii_name="ifVersionId")
    def if_version_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by a specific object version.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/amazon-s3-policy-keys.html#getobjectversion-limit-access-to-specific-version-3

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifVersionId", [value, operator]))

    @jsii.member(jsii_name="ifXAmzAcl")
    def if_x_amz_acl(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by canned ACL in the request's x-amz-acl header.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#permissions

        Applies to actions:

        - .toBypassGovernanceRetention()
        - .toCreateAccessPoint()
        - .toCreateBucket()
        - .toPutBucketAcl()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectVersionAcl()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifXAmzAcl", [value, operator]))

    @jsii.member(jsii_name="ifXAmzContentSha256")
    def if_x_amz_content_sha256(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access to unsigned content in your bucket.

        https://docs.aws.amazon.com/AmazonS3/latest/API/bucket-policy-s3-sigv4-conditions.html

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toBypassGovernanceRetention()
        - .toCreateAccessPoint()
        - .toCreateAccessPointForObjectLambda()
        - .toCreateBucket()
        - .toCreateJob()
        - .toDeleteAccessPoint()
        - .toDeleteAccessPointForObjectLambda()
        - .toDeleteAccessPointPolicy()
        - .toDeleteAccessPointPolicyForObjectLambda()
        - .toDeleteBucket()
        - .toDeleteBucketOwnershipControls()
        - .toDeleteBucketPolicy()
        - .toDeleteBucketWebsite()
        - .toDeleteJobTagging()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toDeleteObjectVersion()
        - .toDeleteObjectVersionTagging()
        - .toDeleteStorageLensConfiguration()
        - .toDeleteStorageLensConfigurationTagging()
        - .toDescribeJob()
        - .toGetAccelerateConfiguration()
        - .toGetAccessPoint()
        - .toGetAccessPointConfigurationForObjectLambda()
        - .toGetAccessPointForObjectLambda()
        - .toGetAccessPointPolicy()
        - .toGetAccessPointPolicyForObjectLambda()
        - .toGetAccessPointPolicyStatus()
        - .toGetAccessPointPolicyStatusForObjectLambda()
        - .toGetAccountPublicAccessBlock()
        - .toGetAnalyticsConfiguration()
        - .toGetBucketAcl()
        - .toGetBucketCORS()
        - .toGetBucketLogging()
        - .toGetBucketNotification()
        - .toGetBucketOwnershipControls()
        - .toGetBucketPolicy()
        - .toGetBucketPolicyStatus()
        - .toGetBucketPublicAccessBlock()
        - .toGetBucketRequestPayment()
        - .toGetBucketTagging()
        - .toGetBucketVersioning()
        - .toGetBucketWebsite()
        - .toGetEncryptionConfiguration()
        - .toGetIntelligentTieringConfiguration()
        - .toGetInventoryConfiguration()
        - .toGetJobTagging()
        - .toGetLifecycleConfiguration()
        - .toGetMetricsConfiguration()
        - .toGetObject()
        - .toGetObjectAcl()
        - .toGetObjectLegalHold()
        - .toGetObjectRetention()
        - .toGetObjectTagging()
        - .toGetObjectTorrent()
        - .toGetObjectVersion()
        - .toGetObjectVersionAcl()
        - .toGetObjectVersionForReplication()
        - .toGetObjectVersionTagging()
        - .toGetObjectVersionTorrent()
        - .toGetReplicationConfiguration()
        - .toGetStorageLensConfiguration()
        - .toGetStorageLensConfigurationTagging()
        - .toGetStorageLensDashboard()
        - .toListAccessPoints()
        - .toListAccessPointsForObjectLambda()
        - .toListAllMyBuckets()
        - .toListBucket()
        - .toListBucketMultipartUploads()
        - .toListBucketVersions()
        - .toListJobs()
        - .toListMultipartUploadParts()
        - .toListStorageLensConfigurations()
        - .toObjectOwnerOverrideToBucketOwner()
        - .toPutAccelerateConfiguration()
        - .toPutAccessPointConfigurationForObjectLambda()
        - .toPutAccessPointPolicy()
        - .toPutAccessPointPolicyForObjectLambda()
        - .toPutAccountPublicAccessBlock()
        - .toPutAnalyticsConfiguration()
        - .toPutBucketAcl()
        - .toPutBucketCORS()
        - .toPutBucketLogging()
        - .toPutBucketNotification()
        - .toPutBucketOwnershipControls()
        - .toPutBucketPolicy()
        - .toPutBucketPublicAccessBlock()
        - .toPutBucketRequestPayment()
        - .toPutBucketTagging()
        - .toPutBucketVersioning()
        - .toPutBucketWebsite()
        - .toPutEncryptionConfiguration()
        - .toPutIntelligentTieringConfiguration()
        - .toPutInventoryConfiguration()
        - .toPutJobTagging()
        - .toPutLifecycleConfiguration()
        - .toPutMetricsConfiguration()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectLegalHold()
        - .toPutObjectRetention()
        - .toPutObjectTagging()
        - .toPutObjectVersionAcl()
        - .toPutObjectVersionTagging()
        - .toPutReplicationConfiguration()
        - .toPutStorageLensConfiguration()
        - .toPutStorageLensConfigurationTagging()
        - .toReplicateDelete()
        - .toReplicateObject()
        - .toReplicateTags()
        - .toRestoreObject()
        - .toUpdateJobPriority()
        - .toUpdateJobStatus()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifXAmzContentSha256", [value, operator]))

    @jsii.member(jsii_name="ifXAmzCopySource")
    def if_x_amz_copy_source(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access to requests with a specific bucket, prefix, or object as the copy source.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/amazon-s3-policy-keys.html#putobject-limit-copy-source-3

        Applies to actions:

        - .toBypassGovernanceRetention()
        - .toPutObject()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifXAmzCopySource", [value, operator]))

    @jsii.member(jsii_name="ifXAmzGrantFullControl")
    def if_x_amz_grant_full_control(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access to requests with the x-amz-grant-full-control (full control) header.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#permissions

        Applies to actions:

        - .toBypassGovernanceRetention()
        - .toCreateBucket()
        - .toPutBucketAcl()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectVersionAcl()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifXAmzGrantFullControl", [value, operator]))

    @jsii.member(jsii_name="ifXAmzGrantRead")
    def if_x_amz_grant_read(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access to requests with the x-amz-grant-read (read access) header.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#permissions

        Applies to actions:

        - .toBypassGovernanceRetention()
        - .toCreateBucket()
        - .toPutBucketAcl()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectVersionAcl()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifXAmzGrantRead", [value, operator]))

    @jsii.member(jsii_name="ifXAmzGrantReadAcp")
    def if_x_amz_grant_read_acp(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access to requests with the x-amz-grant-read-acp (read permissions for the ACL) header.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#permissions

        Applies to actions:

        - .toBypassGovernanceRetention()
        - .toCreateBucket()
        - .toPutBucketAcl()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectVersionAcl()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifXAmzGrantReadAcp", [value, operator]))

    @jsii.member(jsii_name="ifXAmzGrantWrite")
    def if_x_amz_grant_write(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access to requests with the x-amz-grant-write (write access) header.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#permissions

        Applies to actions:

        - .toBypassGovernanceRetention()
        - .toCreateBucket()
        - .toPutBucketAcl()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectVersionAcl()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifXAmzGrantWrite", [value, operator]))

    @jsii.member(jsii_name="ifXAmzGrantWriteAcp")
    def if_x_amz_grant_write_acp(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access to requests with the x-amz-grant-write-acp (write permissions for the ACL) header.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#permissions

        Applies to actions:

        - .toBypassGovernanceRetention()
        - .toCreateBucket()
        - .toPutBucketAcl()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectVersionAcl()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifXAmzGrantWriteAcp", [value, operator]))

    @jsii.member(jsii_name="ifXAmzMetadataDirective")
    def if_x_amz_metadata_directive(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by object metadata behavior (COPY or REPLACE) when objects are copied.

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_CopyObject.html

        Applies to actions:

        - .toBypassGovernanceRetention()
        - .toPutObject()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifXAmzMetadataDirective", [value, operator]))

    @jsii.member(jsii_name="ifXAmzServerSideEncryption")
    def if_x_amz_server_side_encryption(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by server-side encryption.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingServerSideEncryption.html

        Applies to actions:

        - .toBypassGovernanceRetention()
        - .toPutObject()
        - .toReplicateObject()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifXAmzServerSideEncryption", [value, operator]))

    @jsii.member(jsii_name="ifXAmzServerSideEncryptionAwsKmsKeyId")
    def if_x_amz_server_side_encryption_aws_kms_key_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by AWS KMS customer managed CMK for server-side encryption.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingKMSEncryption.html#require-sse-kms

        Applies to actions:

        - .toBypassGovernanceRetention()
        - .toPutObject()
        - .toReplicateObject()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifXAmzServerSideEncryptionAwsKmsKeyId", [value, operator]))

    @jsii.member(jsii_name="ifXAmzStorageClass")
    def if_x_amz_storage_class(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by storage class.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/storage-class-intro.html#sc-howtoset

        Applies to actions:

        - .toBypassGovernanceRetention()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectVersionAcl()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifXAmzStorageClass", [value, operator]))

    @jsii.member(jsii_name="ifXAmzWebsiteRedirectLocation")
    def if_x_amz_website_redirect_location(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by a specific website redirect location for buckets that are configured as static websites.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/how-to-page-redirect.html#page-redirect-using-rest-api

        Applies to actions:

        - .toBypassGovernanceRetention()
        - .toPutObject()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "ifXAmzWebsiteRedirectLocation", [value, operator]))

    @jsii.member(jsii_name="onAccesspoint")
    def on_accesspoint(
        self,
        access_point_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "S3":
        '''(experimental) Adds a resource of type accesspoint to the statement.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/access-points.html

        :param access_point_name: - Identifier for the accessPointName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "onAccesspoint", [access_point_name, account, region, partition]))

    @jsii.member(jsii_name="onBucket")
    def on_bucket(
        self,
        bucket_name: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "S3":
        '''(experimental) Adds a resource of type bucket to the statement.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingBucket.html

        :param bucket_name: - Identifier for the bucketName.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "onBucket", [bucket_name, partition]))

    @jsii.member(jsii_name="onJob")
    def on_job(
        self,
        job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "S3":
        '''(experimental) Adds a resource of type job to the statement.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/batch-ops-managing-jobs.html

        :param job_id: - Identifier for the jobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "onJob", [job_id, account, region, partition]))

    @jsii.member(jsii_name="onObject")
    def on_object(
        self,
        bucket_name: builtins.str,
        object_name: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "S3":
        '''(experimental) Adds a resource of type object to the statement.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingObjects.html

        :param bucket_name: - Identifier for the bucketName.
        :param object_name: - Identifier for the objectName.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "onObject", [bucket_name, object_name, partition]))

    @jsii.member(jsii_name="onObjectlambdaaccesspoint")
    def on_objectlambdaaccesspoint(
        self,
        access_point_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "S3":
        '''(experimental) Adds a resource of type objectlambdaaccesspoint to the statement.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/transforming-objects.html

        :param access_point_name: - Identifier for the accessPointName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "onObjectlambdaaccesspoint", [access_point_name, account, region, partition]))

    @jsii.member(jsii_name="onStoragelensconfiguration")
    def on_storagelensconfiguration(
        self,
        config_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "S3":
        '''(experimental) Adds a resource of type storagelensconfiguration to the statement.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/storage_lens.html

        :param config_id: - Identifier for the configId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "onStoragelensconfiguration", [config_id, account, region, partition]))

    @jsii.member(jsii_name="toAbortMultipartUpload")
    def to_abort_multipart_upload(self) -> "S3":
        '''(experimental) Grants permission to abort a multipart upload.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointArn()
        - .ifDataAccessPointAccount()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_AbortMultipartUpload.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toAbortMultipartUpload", []))

    @jsii.member(jsii_name="toBypassGovernanceRetention")
    def to_bypass_governance_retention(self) -> "S3":
        '''(experimental) Grants permission to allow circumvention of governance-mode object retention settings.

        Access Level: Permissions management

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifRequestObjectTag()
        - .ifRequestObjectTagKeys()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzAcl()
        - .ifXAmzContentSha256()
        - .ifXAmzCopySource()
        - .ifXAmzGrantFullControl()
        - .ifXAmzGrantRead()
        - .ifXAmzGrantReadAcp()
        - .ifXAmzGrantWrite()
        - .ifXAmzGrantWriteAcp()
        - .ifXAmzMetadataDirective()
        - .ifXAmzServerSideEncryption()
        - .ifXAmzServerSideEncryptionAwsKmsKeyId()
        - .ifXAmzStorageClass()
        - .ifXAmzWebsiteRedirectLocation()
        - .ifObjectLockMode()
        - .ifObjectLockRetainUntilDate()
        - .ifObjectLockRemainingRetentionDays()
        - .ifObjectLockLegalHold()

        https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-managing.html#object-lock-managing-bypass

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toBypassGovernanceRetention", []))

    @jsii.member(jsii_name="toCreateAccessPoint")
    def to_create_access_point(self) -> "S3":
        '''(experimental) Grants permission to create a new access point.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifLocationconstraint()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzAcl()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_CreateAccessPoint.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toCreateAccessPoint", []))

    @jsii.member(jsii_name="toCreateAccessPointForObjectLambda")
    def to_create_access_point_for_object_lambda(self) -> "S3":
        '''(experimental) Grants permission to create an object lambda enabled accesspoint.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_CreateAccessPointForObjectLambda.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toCreateAccessPointForObjectLambda", []))

    @jsii.member(jsii_name="toCreateBucket")
    def to_create_bucket(self) -> "S3":
        '''(experimental) Grants permission to create a new bucket.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifLocationconstraint()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzAcl()
        - .ifXAmzContentSha256()
        - .ifXAmzGrantFullControl()
        - .ifXAmzGrantRead()
        - .ifXAmzGrantReadAcp()
        - .ifXAmzGrantWrite()
        - .ifXAmzGrantWriteAcp()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateBucket.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toCreateBucket", []))

    @jsii.member(jsii_name="toCreateJob")
    def to_create_job(self) -> "S3":
        '''(experimental) Grants permission to create a new Amazon S3 Batch Operations job.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()
        - .ifRequestJobPriority()
        - .ifRequestJobOperation()
        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_CreateJob.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toCreateJob", []))

    @jsii.member(jsii_name="toDeleteAccessPoint")
    def to_delete_access_point(self) -> "S3":
        '''(experimental) Grants permission to delete the access point named in the URI.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointArn()
        - .ifDataAccessPointAccount()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DeleteAccessPoint.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toDeleteAccessPoint", []))

    @jsii.member(jsii_name="toDeleteAccessPointForObjectLambda")
    def to_delete_access_point_for_object_lambda(self) -> "S3":
        '''(experimental) Grants permission to delete the object lambda enabled access point named in the URI.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointArn()
        - .ifDataAccessPointAccount()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DeleteAccessPointForObjectLambda.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toDeleteAccessPointForObjectLambda", []))

    @jsii.member(jsii_name="toDeleteAccessPointPolicy")
    def to_delete_access_point_policy(self) -> "S3":
        '''(experimental) Grants permission to delete the policy on a specified access point.

        Access Level: Permissions management

        Possible conditions:

        - .ifDataAccessPointArn()
        - .ifDataAccessPointAccount()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DeleteAccessPointPolicy.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toDeleteAccessPointPolicy", []))

    @jsii.member(jsii_name="toDeleteAccessPointPolicyForObjectLambda")
    def to_delete_access_point_policy_for_object_lambda(self) -> "S3":
        '''(experimental) Grants permission to delete the policy on a specified object lambda enabled access point.

        Access Level: Permissions management

        Possible conditions:

        - .ifDataAccessPointArn()
        - .ifDataAccessPointAccount()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DeleteAccessPointPolicyForObjectLambda.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toDeleteAccessPointPolicyForObjectLambda", []))

    @jsii.member(jsii_name="toDeleteBucket")
    def to_delete_bucket(self) -> "S3":
        '''(experimental) Grants permission to delete the bucket named in the URI.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucket.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toDeleteBucket", []))

    @jsii.member(jsii_name="toDeleteBucketOwnershipControls")
    def to_delete_bucket_ownership_controls(self) -> "S3":
        '''(experimental) Grants permission to delete ownership controls on a bucket.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketOwnershipControls.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toDeleteBucketOwnershipControls", []))

    @jsii.member(jsii_name="toDeleteBucketPolicy")
    def to_delete_bucket_policy(self) -> "S3":
        '''(experimental) Grants permission to delete the policy on a specified bucket.

        Access Level: Permissions management

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketPolicy.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toDeleteBucketPolicy", []))

    @jsii.member(jsii_name="toDeleteBucketWebsite")
    def to_delete_bucket_website(self) -> "S3":
        '''(experimental) Grants permission to remove the website configuration for a bucket.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketWebsite.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toDeleteBucketWebsite", []))

    @jsii.member(jsii_name="toDeleteJobTagging")
    def to_delete_job_tagging(self) -> "S3":
        '''(experimental) Grants permission to remove tags from an existing Amazon S3 Batch Operations job.

        Access Level: Tagging

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()
        - .ifExistingJobPriority()
        - .ifExistingJobOperation()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DeleteJobTagging.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toDeleteJobTagging", []))

    @jsii.member(jsii_name="toDeleteObject")
    def to_delete_object(self) -> "S3":
        '''(experimental) Grants permission to remove the null version of an object and insert a delete marker, which becomes the current version of the object.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObject.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toDeleteObject", []))

    @jsii.member(jsii_name="toDeleteObjectTagging")
    def to_delete_object_tagging(self) -> "S3":
        '''(experimental) Grants permission to use the tagging subresource to remove the entire tag set from the specified object.

        Access Level: Tagging

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObjectTagging.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toDeleteObjectTagging", []))

    @jsii.member(jsii_name="toDeleteObjectVersion")
    def to_delete_object_version(self) -> "S3":
        '''(experimental) Grants permission to remove a specific version of an object.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifVersionid()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObject.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toDeleteObjectVersion", []))

    @jsii.member(jsii_name="toDeleteObjectVersionTagging")
    def to_delete_object_version_tagging(self) -> "S3":
        '''(experimental) Grants permission to remove the entire tag set for a specific version of the object.

        Access Level: Tagging

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifVersionid()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObjectTagging.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toDeleteObjectVersionTagging", []))

    @jsii.member(jsii_name="toDeleteStorageLensConfiguration")
    def to_delete_storage_lens_configuration(self) -> "S3":
        '''(experimental) Grants permission to delete an existing Amazon S3 Storage Lens configuration.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DeleteStorageLensConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toDeleteStorageLensConfiguration", []))

    @jsii.member(jsii_name="toDeleteStorageLensConfigurationTagging")
    def to_delete_storage_lens_configuration_tagging(self) -> "S3":
        '''(experimental) Grants permission to remove tags from an existing Amazon S3 Storage Lens configuration.

        Access Level: Tagging

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DeleteStorageLensConfigurationTagging.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toDeleteStorageLensConfigurationTagging", []))

    @jsii.member(jsii_name="toDescribeJob")
    def to_describe_job(self) -> "S3":
        '''(experimental) Grants permission to retrieve the configuration parameters and status for a batch operations job.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DescribeJob.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toDescribeJob", []))

    @jsii.member(jsii_name="toGetAccelerateConfiguration")
    def to_get_accelerate_configuration(self) -> "S3":
        '''(experimental) Grants permission to uses the accelerate subresource to return the Transfer Acceleration state of a bucket, which is either Enabled or Suspended.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketAccelerateConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetAccelerateConfiguration", []))

    @jsii.member(jsii_name="toGetAccessPoint")
    def to_get_access_point(self) -> "S3":
        '''(experimental) Grants permission to return configuration information about the specified access point.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetAccessPoint.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetAccessPoint", []))

    @jsii.member(jsii_name="toGetAccessPointConfigurationForObjectLambda")
    def to_get_access_point_configuration_for_object_lambda(self) -> "S3":
        '''(experimental) Grants permission to retrieve the configuration of the object lambda enabled access point.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointArn()
        - .ifDataAccessPointAccount()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetAccessPointConfigurationForObjectLambda.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetAccessPointConfigurationForObjectLambda", []))

    @jsii.member(jsii_name="toGetAccessPointForObjectLambda")
    def to_get_access_point_for_object_lambda(self) -> "S3":
        '''(experimental) Grants permission to create an object lambda enabled accesspoint.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetAccessPointForObjectLambda.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetAccessPointForObjectLambda", []))

    @jsii.member(jsii_name="toGetAccessPointPolicy")
    def to_get_access_point_policy(self) -> "S3":
        '''(experimental) Grants permission to returns the access point policy associated with the specified access point.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetAccessPointPolicy.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetAccessPointPolicy", []))

    @jsii.member(jsii_name="toGetAccessPointPolicyForObjectLambda")
    def to_get_access_point_policy_for_object_lambda(self) -> "S3":
        '''(experimental) Grants permission to returns the access point policy associated with the specified object lambda enabled access point.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetAccessPointPolicyForObjectLambda.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetAccessPointPolicyForObjectLambda", []))

    @jsii.member(jsii_name="toGetAccessPointPolicyStatus")
    def to_get_access_point_policy_status(self) -> "S3":
        '''(experimental) Grants permission to return the policy status for a specific access point policy.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetAccessPointPolicyStatus.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetAccessPointPolicyStatus", []))

    @jsii.member(jsii_name="toGetAccessPointPolicyStatusForObjectLambda")
    def to_get_access_point_policy_status_for_object_lambda(self) -> "S3":
        '''(experimental) Grants permission to return the policy status for a specific object lambda access point policy.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetAccessPointPolicyStatusForObjectLambda.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetAccessPointPolicyStatusForObjectLambda", []))

    @jsii.member(jsii_name="toGetAccountPublicAccessBlock")
    def to_get_account_public_access_block(self) -> "S3":
        '''(experimental) Grants permission to retrieve the PublicAccessBlock configuration for an AWS account.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetPublicAccessBlock.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetAccountPublicAccessBlock", []))

    @jsii.member(jsii_name="toGetAnalyticsConfiguration")
    def to_get_analytics_configuration(self) -> "S3":
        '''(experimental) Grants permission to get an analytics configuration from an Amazon S3 bucket, identified by the analytics configuration ID.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketAnalyticsConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetAnalyticsConfiguration", []))

    @jsii.member(jsii_name="toGetBucketAcl")
    def to_get_bucket_acl(self) -> "S3":
        '''(experimental) Grants permission to use the acl subresource to return the access control list (ACL) of an Amazon S3 bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketAcl.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetBucketAcl", []))

    @jsii.member(jsii_name="toGetBucketCORS")
    def to_get_bucket_cors(self) -> "S3":
        '''(experimental) Grants permission to return the CORS configuration information set for an Amazon S3 bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketCors.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetBucketCORS", []))

    @jsii.member(jsii_name="toGetBucketLocation")
    def to_get_bucket_location(self) -> "S3":
        '''(experimental) Grants permission to return the Region that an Amazon S3 bucket resides in.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketLocation.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetBucketLocation", []))

    @jsii.member(jsii_name="toGetBucketLogging")
    def to_get_bucket_logging(self) -> "S3":
        '''(experimental) Grants permission to return the logging status of an Amazon S3 bucket and the permissions users have to view or modify that status.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketLogging.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetBucketLogging", []))

    @jsii.member(jsii_name="toGetBucketNotification")
    def to_get_bucket_notification(self) -> "S3":
        '''(experimental) Grants permission to get the notification configuration of an Amazon S3 bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketNotification.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetBucketNotification", []))

    @jsii.member(jsii_name="toGetBucketObjectLockConfiguration")
    def to_get_bucket_object_lock_configuration(self) -> "S3":
        '''(experimental) Grants permission to get the Object Lock configuration of an Amazon S3 bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifSignatureversion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectLockConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetBucketObjectLockConfiguration", []))

    @jsii.member(jsii_name="toGetBucketOwnershipControls")
    def to_get_bucket_ownership_controls(self) -> "S3":
        '''(experimental) Grants permission to retrieve ownership controls on a bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketOwnershipControls.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetBucketOwnershipControls", []))

    @jsii.member(jsii_name="toGetBucketPolicy")
    def to_get_bucket_policy(self) -> "S3":
        '''(experimental) Grants permission to return the policy of the specified bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketPolicy.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetBucketPolicy", []))

    @jsii.member(jsii_name="toGetBucketPolicyStatus")
    def to_get_bucket_policy_status(self) -> "S3":
        '''(experimental) Grants permission to retrieve the policy status for a specific Amazon S3 bucket, which indicates whether the bucket is public.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketPolicyStatus.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetBucketPolicyStatus", []))

    @jsii.member(jsii_name="toGetBucketPublicAccessBlock")
    def to_get_bucket_public_access_block(self) -> "S3":
        '''(experimental) Grants permission to retrieve the PublicAccessBlock configuration for an Amazon S3 bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetPublicAccessBlock.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetBucketPublicAccessBlock", []))

    @jsii.member(jsii_name="toGetBucketRequestPayment")
    def to_get_bucket_request_payment(self) -> "S3":
        '''(experimental) Grants permission to return the request payment configuration for an Amazon S3 bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketRequestPayment.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetBucketRequestPayment", []))

    @jsii.member(jsii_name="toGetBucketTagging")
    def to_get_bucket_tagging(self) -> "S3":
        '''(experimental) Grants permission to return the tag set associated with an Amazon S3 bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketTagging.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetBucketTagging", []))

    @jsii.member(jsii_name="toGetBucketVersioning")
    def to_get_bucket_versioning(self) -> "S3":
        '''(experimental) Grants permission to return the versioning state of an Amazon S3 bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketVersioning.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetBucketVersioning", []))

    @jsii.member(jsii_name="toGetBucketWebsite")
    def to_get_bucket_website(self) -> "S3":
        '''(experimental) Grants permission to return the website configuration for an Amazon S3 bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketWebsite.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetBucketWebsite", []))

    @jsii.member(jsii_name="toGetEncryptionConfiguration")
    def to_get_encryption_configuration(self) -> "S3":
        '''(experimental) Grants permission to return the default encryption configuration an Amazon S3 bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketEncryption.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetEncryptionConfiguration", []))

    @jsii.member(jsii_name="toGetIntelligentTieringConfiguration")
    def to_get_intelligent_tiering_configuration(self) -> "S3":
        '''(experimental) Grants permission to get an or list all Amazon S3 Intelligent Tiering configuration in a S3 Bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketIntelligentTieringConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetIntelligentTieringConfiguration", []))

    @jsii.member(jsii_name="toGetInventoryConfiguration")
    def to_get_inventory_configuration(self) -> "S3":
        '''(experimental) Grants permission to return an inventory configuration from an Amazon S3 bucket, identified by the inventory configuration ID.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketInventoryConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetInventoryConfiguration", []))

    @jsii.member(jsii_name="toGetJobTagging")
    def to_get_job_tagging(self) -> "S3":
        '''(experimental) Grants permission to return the tag set of an existing Amazon S3 Batch Operations job.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetJobTagging.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetJobTagging", []))

    @jsii.member(jsii_name="toGetLifecycleConfiguration")
    def to_get_lifecycle_configuration(self) -> "S3":
        '''(experimental) Grants permission to return the lifecycle configuration information set on an Amazon S3 bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketLifecycleConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetLifecycleConfiguration", []))

    @jsii.member(jsii_name="toGetMetricsConfiguration")
    def to_get_metrics_configuration(self) -> "S3":
        '''(experimental) Grants permission to get a metrics configuration from an Amazon S3 bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketMetricsConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetMetricsConfiguration", []))

    @jsii.member(jsii_name="toGetObject")
    def to_get_object(self) -> "S3":
        '''(experimental) Grants permission to retrieve objects from Amazon S3.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObject.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetObject", []))

    @jsii.member(jsii_name="toGetObjectAcl")
    def to_get_object_acl(self) -> "S3":
        '''(experimental) Grants permission to return the access control list (ACL) of an object.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectAcl.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetObjectAcl", []))

    @jsii.member(jsii_name="toGetObjectLegalHold")
    def to_get_object_legal_hold(self) -> "S3":
        '''(experimental) Grants permission to get an object's current Legal Hold status.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectLegalHold.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetObjectLegalHold", []))

    @jsii.member(jsii_name="toGetObjectRetention")
    def to_get_object_retention(self) -> "S3":
        '''(experimental) Grants permission to retrieve the retention settings for an object.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectRetention.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetObjectRetention", []))

    @jsii.member(jsii_name="toGetObjectTagging")
    def to_get_object_tagging(self) -> "S3":
        '''(experimental) Grants permission to return the tag set of an object.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectTagging.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetObjectTagging", []))

    @jsii.member(jsii_name="toGetObjectTorrent")
    def to_get_object_torrent(self) -> "S3":
        '''(experimental) Grants permission to return torrent files from an Amazon S3 bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectTorrent.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetObjectTorrent", []))

    @jsii.member(jsii_name="toGetObjectVersion")
    def to_get_object_version(self) -> "S3":
        '''(experimental) Grants permission to retrieve a specific version of an object.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifVersionid()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObject.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetObjectVersion", []))

    @jsii.member(jsii_name="toGetObjectVersionAcl")
    def to_get_object_version_acl(self) -> "S3":
        '''(experimental) Grants permission to return the access control list (ACL) of a specific object version.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifVersionid()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectAcl.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetObjectVersionAcl", []))

    @jsii.member(jsii_name="toGetObjectVersionForReplication")
    def to_get_object_version_for_replication(self) -> "S3":
        '''(experimental) Grants permission to replicate both unencrypted objects and objects encrypted with SSE-S3 or SSE-KMS.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/dev/replication-config-for-kms-objects.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetObjectVersionForReplication", []))

    @jsii.member(jsii_name="toGetObjectVersionTagging")
    def to_get_object_version_tagging(self) -> "S3":
        '''(experimental) Grants permission to return the tag set for a specific version of the object.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifVersionid()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/dev/setting-repl-config-perm-overview.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetObjectVersionTagging", []))

    @jsii.member(jsii_name="toGetObjectVersionTorrent")
    def to_get_object_version_torrent(self) -> "S3":
        '''(experimental) Grants permission to get Torrent files about a different version using the versionId subresource.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifVersionid()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectTorrent.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetObjectVersionTorrent", []))

    @jsii.member(jsii_name="toGetReplicationConfiguration")
    def to_get_replication_configuration(self) -> "S3":
        '''(experimental) Grants permission to get the replication configuration information set on an Amazon S3 bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketReplication.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetReplicationConfiguration", []))

    @jsii.member(jsii_name="toGetStorageLensConfiguration")
    def to_get_storage_lens_configuration(self) -> "S3":
        '''(experimental) Grants permission to get an Amazon S3 Storage Lens configuration.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetStorageLensConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetStorageLensConfiguration", []))

    @jsii.member(jsii_name="toGetStorageLensConfigurationTagging")
    def to_get_storage_lens_configuration_tagging(self) -> "S3":
        '''(experimental) Grants permission to get the tag set of an existing Amazon S3 Storage Lens configuration.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetStorageLensConfigurationTagging.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetStorageLensConfigurationTagging", []))

    @jsii.member(jsii_name="toGetStorageLensDashboard")
    def to_get_storage_lens_dashboard(self) -> "S3":
        '''(experimental) Grants permission to get an Amazon S3 Storage Lens dashboard.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/dev/storage_lens_dashboard.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetStorageLensDashboard", []))

    @jsii.member(jsii_name="toListAccessPoints")
    def to_list_access_points(self) -> "S3":
        '''(experimental) Grants permission to list access points.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_ListAccessPoints.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toListAccessPoints", []))

    @jsii.member(jsii_name="toListAccessPointsForObjectLambda")
    def to_list_access_points_for_object_lambda(self) -> "S3":
        '''(experimental) Grants permission to list object lambda enabled accesspoints.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_ListAccessPointsForObjectLambda.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toListAccessPointsForObjectLambda", []))

    @jsii.member(jsii_name="toListAllMyBuckets")
    def to_list_all_my_buckets(self) -> "S3":
        '''(experimental) Grants permission to list all buckets owned by the authenticated sender of the request.

        Access Level: List

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListBuckets.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toListAllMyBuckets", []))

    @jsii.member(jsii_name="toListBucket")
    def to_list_bucket(self) -> "S3":
        '''(experimental) Grants permission to list some or all of the objects in an Amazon S3 bucket (up to 1000).

        Access Level: List

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifDelimiter()
        - .ifMaxKeys()
        - .ifPrefix()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectsV2.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toListBucket", []))

    @jsii.member(jsii_name="toListBucketMultipartUploads")
    def to_list_bucket_multipart_uploads(self) -> "S3":
        '''(experimental) Grants permission to list in-progress multipart uploads.

        Access Level: List

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListMultipartUploads.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toListBucketMultipartUploads", []))

    @jsii.member(jsii_name="toListBucketVersions")
    def to_list_bucket_versions(self) -> "S3":
        '''(experimental) Grants permission to list metadata about all the versions of objects in an Amazon S3 bucket.

        Access Level: List

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifDelimiter()
        - .ifMaxKeys()
        - .ifPrefix()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectVersions.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toListBucketVersions", []))

    @jsii.member(jsii_name="toListJobs")
    def to_list_jobs(self) -> "S3":
        '''(experimental) Grants permission to list current jobs and jobs that have ended recently.

        Access Level: List

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_ListJobs.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toListJobs", []))

    @jsii.member(jsii_name="toListMultipartUploadParts")
    def to_list_multipart_upload_parts(self) -> "S3":
        '''(experimental) Grants permission to list the parts that have been uploaded for a specific multipart upload.

        Access Level: List

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListParts.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toListMultipartUploadParts", []))

    @jsii.member(jsii_name="toListStorageLensConfigurations")
    def to_list_storage_lens_configurations(self) -> "S3":
        '''(experimental) Grants permission to list Amazon S3 Storage Lens configurations.

        Access Level: List

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_ListStorageLensConfigurations.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toListStorageLensConfigurations", []))

    @jsii.member(jsii_name="toObjectOwnerOverrideToBucketOwner")
    def to_object_owner_override_to_bucket_owner(self) -> "S3":
        '''(experimental) Grants permission to change replica ownership.

        Access Level: Permissions management

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/dev/replication-change-owner.html#repl-ownership-add-role-permission

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toObjectOwnerOverrideToBucketOwner", []))

    @jsii.member(jsii_name="toPutAccelerateConfiguration")
    def to_put_accelerate_configuration(self) -> "S3":
        '''(experimental) Grants permission to use the accelerate subresource to set the Transfer Acceleration state of an existing S3 bucket.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketAccelerateConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutAccelerateConfiguration", []))

    @jsii.member(jsii_name="toPutAccessPointConfigurationForObjectLambda")
    def to_put_access_point_configuration_for_object_lambda(self) -> "S3":
        '''(experimental) Grants permission to set the configuration of the object lambda enabled access point.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointArn()
        - .ifDataAccessPointAccount()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_PutAccessPointConfigurationForObjectLambda.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutAccessPointConfigurationForObjectLambda", []))

    @jsii.member(jsii_name="toPutAccessPointPolicy")
    def to_put_access_point_policy(self) -> "S3":
        '''(experimental) Grants permission to associate an access policy with a specified access point.

        Access Level: Permissions management

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_PutAccessPointPolicy.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutAccessPointPolicy", []))

    @jsii.member(jsii_name="toPutAccessPointPolicyForObjectLambda")
    def to_put_access_point_policy_for_object_lambda(self) -> "S3":
        '''(experimental) Grants permission to associate an access policy with a specified object lambda enabled access point.

        Access Level: Permissions management

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_PutAccessPointPolicyForObjectLambda.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutAccessPointPolicyForObjectLambda", []))

    @jsii.member(jsii_name="toPutAccountPublicAccessBlock")
    def to_put_account_public_access_block(self) -> "S3":
        '''(experimental) Grants permission to create or modify the PublicAccessBlock configuration for an AWS account.

        Access Level: Permissions management

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_PutPublicAccessBlock.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutAccountPublicAccessBlock", []))

    @jsii.member(jsii_name="toPutAnalyticsConfiguration")
    def to_put_analytics_configuration(self) -> "S3":
        '''(experimental) Grants permission to set an analytics configuration for the bucket, specified by the analytics configuration ID.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketAnalyticsConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutAnalyticsConfiguration", []))

    @jsii.member(jsii_name="toPutBucketAcl")
    def to_put_bucket_acl(self) -> "S3":
        '''(experimental) Grants permission to set the permissions on an existing bucket using access control lists (ACLs).

        Access Level: Permissions management

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzAcl()
        - .ifXAmzContentSha256()
        - .ifXAmzGrantFullControl()
        - .ifXAmzGrantRead()
        - .ifXAmzGrantReadAcp()
        - .ifXAmzGrantWrite()
        - .ifXAmzGrantWriteAcp()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketAcl.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutBucketAcl", []))

    @jsii.member(jsii_name="toPutBucketCORS")
    def to_put_bucket_cors(self) -> "S3":
        '''(experimental) Grants permission to set the CORS configuration for an Amazon S3 bucket.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketCors.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutBucketCORS", []))

    @jsii.member(jsii_name="toPutBucketLogging")
    def to_put_bucket_logging(self) -> "S3":
        '''(experimental) Grants permission to set the logging parameters for an Amazon S3 bucket.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketLogging.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutBucketLogging", []))

    @jsii.member(jsii_name="toPutBucketNotification")
    def to_put_bucket_notification(self) -> "S3":
        '''(experimental) Grants permission to receive notifications when certain events happen in an Amazon S3 bucket.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketNotification.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutBucketNotification", []))

    @jsii.member(jsii_name="toPutBucketObjectLockConfiguration")
    def to_put_bucket_object_lock_configuration(self) -> "S3":
        '''(experimental) Grants permission to put Object Lock configuration on a specific bucket.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifTlsVersion()
        - .ifSignatureversion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectLockConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutBucketObjectLockConfiguration", []))

    @jsii.member(jsii_name="toPutBucketOwnershipControls")
    def to_put_bucket_ownership_controls(self) -> "S3":
        '''(experimental) Grants permission to add or replace ownership controls on a bucket.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketOwnershipControls.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutBucketOwnershipControls", []))

    @jsii.member(jsii_name="toPutBucketPolicy")
    def to_put_bucket_policy(self) -> "S3":
        '''(experimental) Grants permission to add or replace a bucket policy on a bucket.

        Access Level: Permissions management

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketPolicy.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutBucketPolicy", []))

    @jsii.member(jsii_name="toPutBucketPublicAccessBlock")
    def to_put_bucket_public_access_block(self) -> "S3":
        '''(experimental) Grants permission to create or modify the PublicAccessBlock configuration for a specific Amazon S3 bucket.

        Access Level: Permissions management

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutPublicAccessBlock.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutBucketPublicAccessBlock", []))

    @jsii.member(jsii_name="toPutBucketRequestPayment")
    def to_put_bucket_request_payment(self) -> "S3":
        '''(experimental) Grants permission to set the request payment configuration of a bucket.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketRequestPayment.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutBucketRequestPayment", []))

    @jsii.member(jsii_name="toPutBucketTagging")
    def to_put_bucket_tagging(self) -> "S3":
        '''(experimental) Grants permission to add a set of tags to an existing Amazon S3 bucket.

        Access Level: Tagging

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketTagging.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutBucketTagging", []))

    @jsii.member(jsii_name="toPutBucketVersioning")
    def to_put_bucket_versioning(self) -> "S3":
        '''(experimental) Grants permission to set the versioning state of an existing Amazon S3 bucket.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketVersioning.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutBucketVersioning", []))

    @jsii.member(jsii_name="toPutBucketWebsite")
    def to_put_bucket_website(self) -> "S3":
        '''(experimental) Grants permission to set the configuration of the website that is specified in the website subresource.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketWebsite.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutBucketWebsite", []))

    @jsii.member(jsii_name="toPutEncryptionConfiguration")
    def to_put_encryption_configuration(self) -> "S3":
        '''(experimental) Grants permission to set the encryption configuration for an Amazon S3 bucket.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketEncryption.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutEncryptionConfiguration", []))

    @jsii.member(jsii_name="toPutIntelligentTieringConfiguration")
    def to_put_intelligent_tiering_configuration(self) -> "S3":
        '''(experimental) Grants permission to create new or update or delete an existing Amazon S3 Intelligent Tiering configuration.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketIntelligentTieringConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutIntelligentTieringConfiguration", []))

    @jsii.member(jsii_name="toPutInventoryConfiguration")
    def to_put_inventory_configuration(self) -> "S3":
        '''(experimental) Grants permission to add an inventory configuration to the bucket, identified by the inventory ID.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketInventoryConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutInventoryConfiguration", []))

    @jsii.member(jsii_name="toPutJobTagging")
    def to_put_job_tagging(self) -> "S3":
        '''(experimental) Grants permission to replace tags on an existing Amazon S3 Batch Operations job.

        Access Level: Tagging

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()
        - .ifExistingJobPriority()
        - .ifExistingJobOperation()
        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_PutJobTagging.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutJobTagging", []))

    @jsii.member(jsii_name="toPutLifecycleConfiguration")
    def to_put_lifecycle_configuration(self) -> "S3":
        '''(experimental) Grants permission to create a new lifecycle configuration for the bucket or replace an existing lifecycle configuration.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketLifecycleConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutLifecycleConfiguration", []))

    @jsii.member(jsii_name="toPutMetricsConfiguration")
    def to_put_metrics_configuration(self) -> "S3":
        '''(experimental) Grants permission to set or update a metrics configuration for the CloudWatch request metrics from an Amazon S3 bucket.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketMetricsConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutMetricsConfiguration", []))

    @jsii.member(jsii_name="toPutObject")
    def to_put_object(self) -> "S3":
        '''(experimental) Grants permission to add an object to a bucket.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifRequestObjectTag()
        - .ifRequestObjectTagKeys()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzAcl()
        - .ifXAmzContentSha256()
        - .ifXAmzCopySource()
        - .ifXAmzGrantFullControl()
        - .ifXAmzGrantRead()
        - .ifXAmzGrantReadAcp()
        - .ifXAmzGrantWrite()
        - .ifXAmzGrantWriteAcp()
        - .ifXAmzMetadataDirective()
        - .ifXAmzServerSideEncryption()
        - .ifXAmzServerSideEncryptionAwsKmsKeyId()
        - .ifXAmzStorageClass()
        - .ifXAmzWebsiteRedirectLocation()
        - .ifObjectLockMode()
        - .ifObjectLockRetainUntilDate()
        - .ifObjectLockRemainingRetentionDays()
        - .ifObjectLockLegalHold()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObject.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutObject", []))

    @jsii.member(jsii_name="toPutObjectAcl")
    def to_put_object_acl(self) -> "S3":
        '''(experimental) Grants permission to set the access control list (ACL) permissions for new or existing objects in an S3 bucket.

        Access Level: Permissions management

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzAcl()
        - .ifXAmzContentSha256()
        - .ifXAmzGrantFullControl()
        - .ifXAmzGrantRead()
        - .ifXAmzGrantReadAcp()
        - .ifXAmzGrantWrite()
        - .ifXAmzGrantWriteAcp()
        - .ifXAmzStorageClass()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectAcl.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutObjectAcl", []))

    @jsii.member(jsii_name="toPutObjectLegalHold")
    def to_put_object_legal_hold(self) -> "S3":
        '''(experimental) Grants permission to apply a Legal Hold configuration to the specified object.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()
        - .ifObjectLockLegalHold()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectLegalHold.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutObjectLegalHold", []))

    @jsii.member(jsii_name="toPutObjectRetention")
    def to_put_object_retention(self) -> "S3":
        '''(experimental) Grants permission to place an Object Retention configuration on an object.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()
        - .ifObjectLockMode()
        - .ifObjectLockRetainUntilDate()
        - .ifObjectLockRemainingRetentionDays()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectRetention.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutObjectRetention", []))

    @jsii.member(jsii_name="toPutObjectTagging")
    def to_put_object_tagging(self) -> "S3":
        '''(experimental) Grants permission to set the supplied tag-set to an object that already exists in a bucket.

        Access Level: Tagging

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifRequestObjectTag()
        - .ifRequestObjectTagKeys()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectTagging.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutObjectTagging", []))

    @jsii.member(jsii_name="toPutObjectVersionAcl")
    def to_put_object_version_acl(self) -> "S3":
        '''(experimental) Grants permission to use the acl subresource to set the access control list (ACL) permissions for an object that already exists in a bucket.

        Access Level: Permissions management

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifVersionid()
        - .ifXAmzAcl()
        - .ifXAmzContentSha256()
        - .ifXAmzGrantFullControl()
        - .ifXAmzGrantRead()
        - .ifXAmzGrantReadAcp()
        - .ifXAmzGrantWrite()
        - .ifXAmzGrantWriteAcp()
        - .ifXAmzStorageClass()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectAcl.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutObjectVersionAcl", []))

    @jsii.member(jsii_name="toPutObjectVersionTagging")
    def to_put_object_version_tagging(self) -> "S3":
        '''(experimental) Grants permission to set the supplied tag-set for a specific version of an object.

        Access Level: Tagging

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifRequestObjectTag()
        - .ifRequestObjectTagKeys()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifVersionid()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectTagging.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutObjectVersionTagging", []))

    @jsii.member(jsii_name="toPutReplicationConfiguration")
    def to_put_replication_configuration(self) -> "S3":
        '''(experimental) Grants permission to create a new replication configuration or replace an existing one.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketReplication.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutReplicationConfiguration", []))

    @jsii.member(jsii_name="toPutStorageLensConfiguration")
    def to_put_storage_lens_configuration(self) -> "S3":
        '''(experimental) Grants permission to create or update an Amazon S3 Storage Lens configuration.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()
        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_PutStorageLensConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutStorageLensConfiguration", []))

    @jsii.member(jsii_name="toPutStorageLensConfigurationTagging")
    def to_put_storage_lens_configuration_tagging(self) -> "S3":
        '''(experimental) Grants permission to put or replace tags on an existing Amazon S3 Storage Lens configuration.

        Access Level: Tagging

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()
        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_PutStorageLensConfigurationTagging.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutStorageLensConfigurationTagging", []))

    @jsii.member(jsii_name="toReplicateDelete")
    def to_replicate_delete(self) -> "S3":
        '''(experimental) Grants permission to replicate delete markers to the destination bucket.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/dev/setting-repl-config-perm-overview.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toReplicateDelete", []))

    @jsii.member(jsii_name="toReplicateObject")
    def to_replicate_object(self) -> "S3":
        '''(experimental) Grants permission to replicate objects and object tags to the destination bucket.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()
        - .ifXAmzServerSideEncryption()
        - .ifXAmzServerSideEncryptionAwsKmsKeyId()

        https://docs.aws.amazon.com/AmazonS3/latest/dev/setting-repl-config-perm-overview.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toReplicateObject", []))

    @jsii.member(jsii_name="toReplicateTags")
    def to_replicate_tags(self) -> "S3":
        '''(experimental) Grants permission to replicate object tags to the destination bucket.

        Access Level: Tagging

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/dev/setting-repl-config-perm-overview.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toReplicateTags", []))

    @jsii.member(jsii_name="toRestoreObject")
    def to_restore_object(self) -> "S3":
        '''(experimental) Grants permission to restore an archived copy of an object back into Amazon S3.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_RestoreObject.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toRestoreObject", []))

    @jsii.member(jsii_name="toUpdateJobPriority")
    def to_update_job_priority(self) -> "S3":
        '''(experimental) Grants permission to update the priority of an existing job.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()
        - .ifRequestJobPriority()
        - .ifExistingJobPriority()
        - .ifExistingJobOperation()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_UpdateJobPriority.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toUpdateJobPriority", []))

    @jsii.member(jsii_name="toUpdateJobStatus")
    def to_update_job_status(self) -> "S3":
        '''(experimental) Grants permission to update the status for the specified job.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()
        - .ifExistingJobPriority()
        - .ifExistingJobOperation()
        - .ifJobSuspendedCause()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_UpdateJobStatus.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toUpdateJobStatus", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class S3ObjectLambda(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.S3ObjectLambda",
):
    '''(experimental) Statement provider for service `s3-object-lambda <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazons3objectlambda.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `s3-object-lambda <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazons3objectlambda.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(S3ObjectLambda, self, [sid])

    @jsii.member(jsii_name="ifAuthType")
    def if_auth_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3ObjectLambda":
        '''(experimental) Filters access by authentication method.

        https://docs.aws.amazon.com/AmazonS3/latest/API/bucket-policy-s3-sigv4-conditions.html

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toGetObject()
        - .toGetObjectAcl()
        - .toGetObjectLegalHold()
        - .toGetObjectRetention()
        - .toGetObjectTagging()
        - .toGetObjectVersion()
        - .toListBucket()
        - .toListMultipartUploadParts()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectLegalHold()
        - .toPutObjectRetention()
        - .toPutObjectTagging()
        - .toRestoreObject()
        - .toWriteGetObjectResponse()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "ifAuthType", [value, operator]))

    @jsii.member(jsii_name="ifSignatureAge")
    def if_signature_age(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3ObjectLambda":
        '''(experimental) Filters access by the age in milliseconds of the request signature.

        https://docs.aws.amazon.com/AmazonS3/latest/API/bucket-policy-s3-sigv4-conditions.html

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toGetObject()
        - .toGetObjectAcl()
        - .toGetObjectLegalHold()
        - .toGetObjectRetention()
        - .toGetObjectTagging()
        - .toGetObjectVersion()
        - .toListBucket()
        - .toListMultipartUploadParts()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectLegalHold()
        - .toPutObjectRetention()
        - .toPutObjectTagging()
        - .toRestoreObject()
        - .toWriteGetObjectResponse()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "ifSignatureAge", [value, operator]))

    @jsii.member(jsii_name="ifTlsVersion")
    def if_tls_version(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3ObjectLambda":
        '''(experimental) Filters access by the TLS version used by the client.

        https://docs.aws.amazon.com/AmazonS3/latest/API/bucket-policy-s3-sigv4-conditions.html

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toGetObject()
        - .toGetObjectAcl()
        - .toGetObjectLegalHold()
        - .toGetObjectRetention()
        - .toGetObjectTagging()
        - .toGetObjectVersion()
        - .toListBucket()
        - .toListMultipartUploadParts()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectLegalHold()
        - .toPutObjectRetention()
        - .toPutObjectTagging()
        - .toRestoreObject()
        - .toWriteGetObjectResponse()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "ifTlsVersion", [value, operator]))

    @jsii.member(jsii_name="ifVersionid")
    def if_versionid(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3ObjectLambda":
        '''(experimental) Filters access by a specific object version.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/amazon-s3-policy-keys.html/#getobjectversion-limit-access-to-specific-version-3

        Applies to actions:

        - .toGetObjectVersion()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "ifVersionid", [value, operator]))

    @jsii.member(jsii_name="onObjectlambdaaccesspoint")
    def on_objectlambdaaccesspoint(
        self,
        access_point_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "S3ObjectLambda":
        '''(experimental) Adds a resource of type objectlambdaaccesspoint to the statement.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/transforming-objects.html

        :param access_point_name: - Identifier for the accessPointName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "onObjectlambdaaccesspoint", [access_point_name, account, region, partition]))

    @jsii.member(jsii_name="toAbortMultipartUpload")
    def to_abort_multipart_upload(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to abort a multipart upload.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_AbortMultipartUpload.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toAbortMultipartUpload", []))

    @jsii.member(jsii_name="toDeleteObject")
    def to_delete_object(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to remove the null version of an object and insert a delete marker, which becomes the current version of the object.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObject.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toDeleteObject", []))

    @jsii.member(jsii_name="toDeleteObjectTagging")
    def to_delete_object_tagging(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to use the tagging subresource to remove the entire tag set from the specified object.

        Access Level: Tagging

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObjectTagging.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toDeleteObjectTagging", []))

    @jsii.member(jsii_name="toGetObject")
    def to_get_object(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to retrieve objects from Amazon S3.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObject.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toGetObject", []))

    @jsii.member(jsii_name="toGetObjectAcl")
    def to_get_object_acl(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to return the access control list (ACL) of an object.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectAcl.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toGetObjectAcl", []))

    @jsii.member(jsii_name="toGetObjectLegalHold")
    def to_get_object_legal_hold(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to get an object's current Legal Hold status.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectLegalHold.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toGetObjectLegalHold", []))

    @jsii.member(jsii_name="toGetObjectRetention")
    def to_get_object_retention(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to retrieve the retention settings for an object.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectRetention.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toGetObjectRetention", []))

    @jsii.member(jsii_name="toGetObjectTagging")
    def to_get_object_tagging(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to return the tag set of an object.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectTagging.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toGetObjectTagging", []))

    @jsii.member(jsii_name="toGetObjectVersion")
    def to_get_object_version(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to retrieve a specific version of an object.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()
        - .ifVersionid()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObject.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toGetObjectVersion", []))

    @jsii.member(jsii_name="toListBucket")
    def to_list_bucket(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to list some or all of the objects in an Amazon S3 bucket (up to 1000).

        Access Level: List

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectsV2.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toListBucket", []))

    @jsii.member(jsii_name="toListMultipartUploadParts")
    def to_list_multipart_upload_parts(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to list the parts that have been uploaded for a specific multipart upload.

        Access Level: List

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListParts.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toListMultipartUploadParts", []))

    @jsii.member(jsii_name="toPutObject")
    def to_put_object(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to add an object to a bucket.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObject.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toPutObject", []))

    @jsii.member(jsii_name="toPutObjectAcl")
    def to_put_object_acl(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to set the access control list (ACL) permissions for new or existing objects in an S3 bucket.

        Access Level: Permissions management

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectAcl.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toPutObjectAcl", []))

    @jsii.member(jsii_name="toPutObjectLegalHold")
    def to_put_object_legal_hold(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to apply a Legal Hold configuration to the specified object.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectLegalHold.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toPutObjectLegalHold", []))

    @jsii.member(jsii_name="toPutObjectRetention")
    def to_put_object_retention(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to place an Object Retention configuration on an object.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectRetention.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toPutObjectRetention", []))

    @jsii.member(jsii_name="toPutObjectTagging")
    def to_put_object_tagging(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to set the supplied tag-set to an object that already exists in a bucket.

        Access Level: Tagging

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectTagging.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toPutObjectTagging", []))

    @jsii.member(jsii_name="toRestoreObject")
    def to_restore_object(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to restore an archived copy of an object back into Amazon S3.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_RestoreObject.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toRestoreObject", []))

    @jsii.member(jsii_name="toWriteGetObjectResponse")
    def to_write_get_object_response(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to provide data for GetObject requests send to S3 Object Lambda.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_WriteGetObjectResponse.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toWriteGetObjectResponse", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class S3Outposts(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.S3Outposts",
):
    '''(experimental) Statement provider for service `s3-outposts <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazons3onoutposts.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `s3-outposts <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazons3onoutposts.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(S3Outposts, self, [sid])

    @jsii.member(jsii_name="ifAccessPointNetworkOrigin")
    def if_access_point_network_origin(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3Outposts":
        '''(experimental) Filters access by the network origin (Internet or VPC).

        https://docs.aws.amazon.com/AmazonS3/latest/dev/creating-access-points.html#access-points-policies

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toCreateAccessPoint()
        - .toDeleteAccessPoint()
        - .toDeleteAccessPointPolicy()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toGetAccessPoint()
        - .toGetAccessPointPolicy()
        - .toGetObject()
        - .toGetObjectTagging()
        - .toListBucket()
        - .toListBucketMultipartUploads()
        - .toListMultipartUploadParts()
        - .toPutAccessPointPolicy()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectTagging()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "ifAccessPointNetworkOrigin", [value, operator]))

    @jsii.member(jsii_name="ifAuthType")
    def if_auth_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3Outposts":
        '''(experimental) Filters access by restricting incoming requests to a specific authentication method.

        https://docs.aws.amazon.com/AmazonS3/latest/API/bucket-policy-s3-sigv4-conditions.html

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toCreateAccessPoint()
        - .toCreateBucket()
        - .toDeleteAccessPoint()
        - .toDeleteAccessPointPolicy()
        - .toDeleteBucket()
        - .toDeleteBucketPolicy()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toGetAccessPoint()
        - .toGetAccessPointPolicy()
        - .toGetBucket()
        - .toGetBucketPolicy()
        - .toGetBucketTagging()
        - .toGetLifecycleConfiguration()
        - .toGetObject()
        - .toGetObjectTagging()
        - .toListAccessPoints()
        - .toListBucket()
        - .toListBucketMultipartUploads()
        - .toListMultipartUploadParts()
        - .toListRegionalBuckets()
        - .toPutAccessPointPolicy()
        - .toPutBucketPolicy()
        - .toPutBucketTagging()
        - .toPutLifecycleConfiguration()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectTagging()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "ifAuthType", [value, operator]))

    @jsii.member(jsii_name="ifDataAccessPointAccount")
    def if_data_access_point_account(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3Outposts":
        '''(experimental) Filters access by the AWS Account ID that owns the access point.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/creating-access-points.html#access-points-policies

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toCreateAccessPoint()
        - .toDeleteAccessPoint()
        - .toDeleteAccessPointPolicy()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toGetAccessPoint()
        - .toGetAccessPointPolicy()
        - .toGetObject()
        - .toGetObjectTagging()
        - .toListBucket()
        - .toListBucketMultipartUploads()
        - .toListMultipartUploadParts()
        - .toPutAccessPointPolicy()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectTagging()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "ifDataAccessPointAccount", [value, operator]))

    @jsii.member(jsii_name="ifDataAccessPointArn")
    def if_data_access_point_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3Outposts":
        '''(experimental) Filters access by an access point Amazon Resource Name (ARN).

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toCreateAccessPoint()
        - .toDeleteAccessPoint()
        - .toDeleteAccessPointPolicy()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toGetAccessPoint()
        - .toGetAccessPointPolicy()
        - .toGetObject()
        - .toGetObjectTagging()
        - .toListBucket()
        - .toListBucketMultipartUploads()
        - .toListMultipartUploadParts()
        - .toPutAccessPointPolicy()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectTagging()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "ifDataAccessPointArn", [value, operator]))

    @jsii.member(jsii_name="ifDelimiter")
    def if_delimiter(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3Outposts":
        '''(experimental) Filters access by requiring the delimiter parameter.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/walkthrough1.html

        Applies to actions:

        - .toListBucket()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "ifDelimiter", [value, operator]))

    @jsii.member(jsii_name="ifExistingObjectTag")
    def if_existing_object_tag(
        self,
        key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3Outposts":
        '''(experimental) Filters access by requiring that an existing object tag has a specific tag key and value.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/object-tagging.html#tagging-and-policies

        Applies to actions:

        - .toDeleteObjectTagging()
        - .toGetObject()
        - .toGetObjectTagging()
        - .toPutObjectAcl()
        - .toPutObjectTagging()

        :param key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "ifExistingObjectTag", [key, value, operator]))

    @jsii.member(jsii_name="ifMaxKeys")
    def if_max_keys(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3Outposts":
        '''(experimental) Filters access by limiting the maximum number of keys returned in a ListBucket request.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/amazon-s3-policy-keys.html#example-numeric-condition-operators

        Applies to actions:

        - .toListBucket()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "ifMaxKeys", [value, operator]))

    @jsii.member(jsii_name="ifPrefix")
    def if_prefix(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3Outposts":
        '''(experimental) Filters access by key name prefix.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/amazon-s3-policy-keys.html#condition-key-bucket-ops-2

        Applies to actions:

        - .toListBucket()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "ifPrefix", [value, operator]))

    @jsii.member(jsii_name="ifRequestObjectTag")
    def if_request_object_tag(
        self,
        key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3Outposts":
        '''(experimental) Filters access by restricting the tag keys and values allowed on objects.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/object-tagging.html#tagging-and-policies

        Applies to actions:

        - .toPutObject()
        - .toPutObjectTagging()

        :param key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "ifRequestObjectTag", [key, value, operator]))

    @jsii.member(jsii_name="ifRequestObjectTagKeys")
    def if_request_object_tag_keys(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3Outposts":
        '''(experimental) Filters access by restricting the tag keys allowed on objects.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/object-tagging.html#tagging-and-policies

        Applies to actions:

        - .toPutObject()
        - .toPutObjectTagging()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "ifRequestObjectTagKeys", [value, operator]))

    @jsii.member(jsii_name="ifSignatureAge")
    def if_signature_age(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3Outposts":
        '''(experimental) Filters access by identifying the length of time, in milliseconds, that a signature is valid in an authenticated request.

        https://docs.aws.amazon.com/AmazonS3/latest/API/bucket-policy-s3-sigv4-conditions.html

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toCreateAccessPoint()
        - .toCreateBucket()
        - .toDeleteAccessPoint()
        - .toDeleteAccessPointPolicy()
        - .toDeleteBucket()
        - .toDeleteBucketPolicy()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toGetAccessPoint()
        - .toGetAccessPointPolicy()
        - .toGetBucket()
        - .toGetBucketPolicy()
        - .toGetBucketTagging()
        - .toGetLifecycleConfiguration()
        - .toGetObject()
        - .toGetObjectTagging()
        - .toListAccessPoints()
        - .toListBucket()
        - .toListBucketMultipartUploads()
        - .toListMultipartUploadParts()
        - .toListRegionalBuckets()
        - .toPutAccessPointPolicy()
        - .toPutBucketPolicy()
        - .toPutBucketTagging()
        - .toPutLifecycleConfiguration()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectTagging()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "ifSignatureAge", [value, operator]))

    @jsii.member(jsii_name="ifSignatureversion")
    def if_signatureversion(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3Outposts":
        '''(experimental) Filters access by identifying the version of AWS Signature that is supported for authenticated requests.

        https://docs.aws.amazon.com/AmazonS3/latest/API/bucket-policy-s3-sigv4-conditions.html

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toCreateAccessPoint()
        - .toCreateBucket()
        - .toDeleteAccessPoint()
        - .toDeleteAccessPointPolicy()
        - .toDeleteBucket()
        - .toDeleteBucketPolicy()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toGetAccessPoint()
        - .toGetAccessPointPolicy()
        - .toGetBucket()
        - .toGetBucketPolicy()
        - .toGetBucketTagging()
        - .toGetLifecycleConfiguration()
        - .toGetObject()
        - .toGetObjectTagging()
        - .toListAccessPoints()
        - .toListBucket()
        - .toListBucketMultipartUploads()
        - .toListMultipartUploadParts()
        - .toListRegionalBuckets()
        - .toPutAccessPointPolicy()
        - .toPutBucketPolicy()
        - .toPutBucketTagging()
        - .toPutLifecycleConfiguration()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectTagging()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "ifSignatureversion", [value, operator]))

    @jsii.member(jsii_name="ifXAmzAcl")
    def if_x_amz_acl(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3Outposts":
        '''(experimental) Filters access by requiring the x-amz-acl header with a specific canned ACL in a request.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#permissions

        Applies to actions:

        - .toPutObject()
        - .toPutObjectAcl()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "ifXAmzAcl", [value, operator]))

    @jsii.member(jsii_name="ifXAmzContentSha256")
    def if_x_amz_content_sha256(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3Outposts":
        '''(experimental) Filters access by disallowing unsigned content in your bucket.

        https://docs.aws.amazon.com/AmazonS3/latest/API/bucket-policy-s3-sigv4-conditions.html

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toCreateAccessPoint()
        - .toCreateBucket()
        - .toDeleteAccessPoint()
        - .toDeleteAccessPointPolicy()
        - .toDeleteBucket()
        - .toDeleteBucketPolicy()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toGetAccessPoint()
        - .toGetAccessPointPolicy()
        - .toGetBucket()
        - .toGetBucketPolicy()
        - .toGetBucketTagging()
        - .toGetLifecycleConfiguration()
        - .toGetObject()
        - .toGetObjectTagging()
        - .toListAccessPoints()
        - .toListBucket()
        - .toListBucketMultipartUploads()
        - .toListMultipartUploadParts()
        - .toListRegionalBuckets()
        - .toPutAccessPointPolicy()
        - .toPutBucketPolicy()
        - .toPutBucketTagging()
        - .toPutLifecycleConfiguration()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectTagging()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "ifXAmzContentSha256", [value, operator]))

    @jsii.member(jsii_name="ifXAmzCopySource")
    def if_x_amz_copy_source(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3Outposts":
        '''(experimental) Filters access by restricting the copy source to a specific bucket, prefix, or object.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/amazon-s3-policy-keys.html#putobject-limit-copy-source-3

        Applies to actions:

        - .toPutObject()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "ifXAmzCopySource", [value, operator]))

    @jsii.member(jsii_name="ifXAmzMetadataDirective")
    def if_x_amz_metadata_directive(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3Outposts":
        '''(experimental) Filters access by enabling enforcement of object metadata behavior (COPY or REPLACE) when objects are copied.

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_CopyObject.html

        Applies to actions:

        - .toPutObject()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "ifXAmzMetadataDirective", [value, operator]))

    @jsii.member(jsii_name="ifXAmzServerSideEncryption")
    def if_x_amz_server_side_encryption(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3Outposts":
        '''(experimental) Filters access by requiring server-side encryption.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingServerSideEncryption.html

        Applies to actions:

        - .toPutObject()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "ifXAmzServerSideEncryption", [value, operator]))

    @jsii.member(jsii_name="ifXAmzStorageClass")
    def if_x_amz_storage_class(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3Outposts":
        '''(experimental) Filters access by storage class.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/storage-class-intro.html#sc-howtoset

        Applies to actions:

        - .toPutObject()
        - .toPutObjectAcl()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "ifXAmzStorageClass", [value, operator]))

    @jsii.member(jsii_name="onAccesspoint")
    def on_accesspoint(
        self,
        outpost_id: builtins.str,
        access_point_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "S3Outposts":
        '''(experimental) Adds a resource of type accesspoint to the statement.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/access-points.html

        :param outpost_id: - Identifier for the outpostId.
        :param access_point_name: - Identifier for the accessPointName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "onAccesspoint", [outpost_id, access_point_name, account, region, partition]))

    @jsii.member(jsii_name="onBucket")
    def on_bucket(
        self,
        outpost_id: builtins.str,
        bucket_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "S3Outposts":
        '''(experimental) Adds a resource of type bucket to the statement.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingBucket.html

        :param outpost_id: - Identifier for the outpostId.
        :param bucket_name: - Identifier for the bucketName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "onBucket", [outpost_id, bucket_name, account, region, partition]))

    @jsii.member(jsii_name="onEndpoint")
    def on_endpoint(
        self,
        outpost_id: builtins.str,
        endpoint_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "S3Outposts":
        '''(experimental) Adds a resource of type endpoint to the statement.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/outposts-endpoints.html

        :param outpost_id: - Identifier for the outpostId.
        :param endpoint_id: - Identifier for the endpointId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "onEndpoint", [outpost_id, endpoint_id, account, region, partition]))

    @jsii.member(jsii_name="onObject")
    def on_object(
        self,
        outpost_id: builtins.str,
        bucket_name: builtins.str,
        object_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "S3Outposts":
        '''(experimental) Adds a resource of type object to the statement.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingObjects.html

        :param outpost_id: - Identifier for the outpostId.
        :param bucket_name: - Identifier for the bucketName.
        :param object_name: - Identifier for the objectName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "onObject", [outpost_id, bucket_name, object_name, account, region, partition]))

    @jsii.member(jsii_name="toAbortMultipartUpload")
    def to_abort_multipart_upload(self) -> "S3Outposts":
        '''(experimental) Grants permission to abort a multipart upload.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointArn()
        - .ifDataAccessPointAccount()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_AbortMultipartUpload.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toAbortMultipartUpload", []))

    @jsii.member(jsii_name="toCreateAccessPoint")
    def to_create_access_point(self) -> "S3Outposts":
        '''(experimental) Grants permission to create a new access point.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_CreateAccessPoint.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toCreateAccessPoint", []))

    @jsii.member(jsii_name="toCreateBucket")
    def to_create_bucket(self) -> "S3Outposts":
        '''(experimental) Grants permission to create a new bucket.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_CreateBucket.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toCreateBucket", []))

    @jsii.member(jsii_name="toCreateEndpoint")
    def to_create_endpoint(self) -> "S3Outposts":
        '''(experimental) Grants permission to create a new endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_s3outposts_CreateEndpoint.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toCreateEndpoint", []))

    @jsii.member(jsii_name="toDeleteAccessPoint")
    def to_delete_access_point(self) -> "S3Outposts":
        '''(experimental) Grants permission to delete the access point named in the URI.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointArn()
        - .ifDataAccessPointAccount()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DeleteAccessPoint.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toDeleteAccessPoint", []))

    @jsii.member(jsii_name="toDeleteAccessPointPolicy")
    def to_delete_access_point_policy(self) -> "S3Outposts":
        '''(experimental) Grants permission to delete the policy on a specified access point.

        Access Level: Permissions management

        Possible conditions:

        - .ifDataAccessPointArn()
        - .ifDataAccessPointAccount()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DeleteAccessPointPolicy.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toDeleteAccessPointPolicy", []))

    @jsii.member(jsii_name="toDeleteBucket")
    def to_delete_bucket(self) -> "S3Outposts":
        '''(experimental) Grants permission to delete the bucket named in the URI.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DeleteBucket.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toDeleteBucket", []))

    @jsii.member(jsii_name="toDeleteBucketPolicy")
    def to_delete_bucket_policy(self) -> "S3Outposts":
        '''(experimental) Grants permission to delete the policy on a specified bucket.

        Access Level: Permissions management

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DeleteBucketPolicy.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toDeleteBucketPolicy", []))

    @jsii.member(jsii_name="toDeleteEndpoint")
    def to_delete_endpoint(self) -> "S3Outposts":
        '''(experimental) Grants permission to delete the endpoint named in the URI.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_s3outposts_DeleteEndpoint.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toDeleteEndpoint", []))

    @jsii.member(jsii_name="toDeleteObject")
    def to_delete_object(self) -> "S3Outposts":
        '''(experimental) Grants permission to remove the null version of an object and insert a delete marker, which becomes the current version of the object.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObject.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toDeleteObject", []))

    @jsii.member(jsii_name="toDeleteObjectTagging")
    def to_delete_object_tagging(self) -> "S3Outposts":
        '''(experimental) Grants permission to use the tagging subresource to remove the entire tag set from the specified object.

        Access Level: Tagging

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObjectTagging.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toDeleteObjectTagging", []))

    @jsii.member(jsii_name="toGetAccessPoint")
    def to_get_access_point(self) -> "S3Outposts":
        '''(experimental) Grants permission to return configuration information about the specified access point.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetAccessPoint.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toGetAccessPoint", []))

    @jsii.member(jsii_name="toGetAccessPointPolicy")
    def to_get_access_point_policy(self) -> "S3Outposts":
        '''(experimental) Grants permission to returns the access point policy associated with the specified access point.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetAccessPointPolicy.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toGetAccessPointPolicy", []))

    @jsii.member(jsii_name="toGetBucket")
    def to_get_bucket(self) -> "S3Outposts":
        '''(experimental) Grants permission to return the bucket configuration associated with an Amazon S3 bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetBucket.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toGetBucket", []))

    @jsii.member(jsii_name="toGetBucketPolicy")
    def to_get_bucket_policy(self) -> "S3Outposts":
        '''(experimental) Grants permission to return the policy of the specified bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetBucketPolicy.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toGetBucketPolicy", []))

    @jsii.member(jsii_name="toGetBucketTagging")
    def to_get_bucket_tagging(self) -> "S3Outposts":
        '''(experimental) Grants permission to return the tag set associated with an Amazon S3 bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetBucketTagging.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toGetBucketTagging", []))

    @jsii.member(jsii_name="toGetLifecycleConfiguration")
    def to_get_lifecycle_configuration(self) -> "S3Outposts":
        '''(experimental) Grants permission to return the lifecycle configuration information set on an Amazon S3 bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetBucketLifecycleConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toGetLifecycleConfiguration", []))

    @jsii.member(jsii_name="toGetObject")
    def to_get_object(self) -> "S3Outposts":
        '''(experimental) Grants permission to retrieve objects from Amazon S3.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObject.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toGetObject", []))

    @jsii.member(jsii_name="toGetObjectTagging")
    def to_get_object_tagging(self) -> "S3Outposts":
        '''(experimental) Grants permission to return the tag set of an object.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectTagging.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toGetObjectTagging", []))

    @jsii.member(jsii_name="toListAccessPoints")
    def to_list_access_points(self) -> "S3Outposts":
        '''(experimental) Grants permission to list access points.

        Access Level: List

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_ListAccessPoints.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toListAccessPoints", []))

    @jsii.member(jsii_name="toListBucket")
    def to_list_bucket(self) -> "S3Outposts":
        '''(experimental) Grants permission to list some or all of the objects in an Amazon S3 bucket (up to 1000).

        Access Level: List

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifDelimiter()
        - .ifMaxKeys()
        - .ifPrefix()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectsV2.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toListBucket", []))

    @jsii.member(jsii_name="toListBucketMultipartUploads")
    def to_list_bucket_multipart_uploads(self) -> "S3Outposts":
        '''(experimental) Grants permission to list in-progress multipart uploads.

        Access Level: List

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListMultipartUploads.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toListBucketMultipartUploads", []))

    @jsii.member(jsii_name="toListEndpoints")
    def to_list_endpoints(self) -> "S3Outposts":
        '''(experimental) Grants permission to list endpoints.

        Access Level: List

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_s3outposts_ListEndpoints.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toListEndpoints", []))

    @jsii.member(jsii_name="toListMultipartUploadParts")
    def to_list_multipart_upload_parts(self) -> "S3Outposts":
        '''(experimental) Grants permission to list the parts that have been uploaded for a specific multipart upload.

        Access Level: List

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListParts.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toListMultipartUploadParts", []))

    @jsii.member(jsii_name="toListRegionalBuckets")
    def to_list_regional_buckets(self) -> "S3Outposts":
        '''(experimental) Grants permission to list all buckets owned by the authenticated sender of the request.

        Access Level: List

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_ListRegionalBuckets.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toListRegionalBuckets", []))

    @jsii.member(jsii_name="toPutAccessPointPolicy")
    def to_put_access_point_policy(self) -> "S3Outposts":
        '''(experimental) Grants permission to associate an access policy with a specified access point.

        Access Level: Permissions management

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_PutAccessPointPolicy.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toPutAccessPointPolicy", []))

    @jsii.member(jsii_name="toPutBucketPolicy")
    def to_put_bucket_policy(self) -> "S3Outposts":
        '''(experimental) Grants permission to add or replace a bucket policy on a bucket.

        Access Level: Permissions management

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_PutBucketPolicy.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toPutBucketPolicy", []))

    @jsii.member(jsii_name="toPutBucketTagging")
    def to_put_bucket_tagging(self) -> "S3Outposts":
        '''(experimental) Grants permission to add a set of tags to an existing Amazon S3 bucket.

        Access Level: Tagging

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_PutBucketTagging.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toPutBucketTagging", []))

    @jsii.member(jsii_name="toPutLifecycleConfiguration")
    def to_put_lifecycle_configuration(self) -> "S3Outposts":
        '''(experimental) Grants permission to create a new lifecycle configuration for the bucket or replace an existing lifecycle configuration.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_PutBucketLifecycleConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toPutLifecycleConfiguration", []))

    @jsii.member(jsii_name="toPutObject")
    def to_put_object(self) -> "S3Outposts":
        '''(experimental) Grants permission to add an object to a bucket.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifRequestObjectTag()
        - .ifRequestObjectTagKeys()
        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzAcl()
        - .ifXAmzContentSha256()
        - .ifXAmzCopySource()
        - .ifXAmzMetadataDirective()
        - .ifXAmzServerSideEncryption()
        - .ifXAmzStorageClass()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObject.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toPutObject", []))

    @jsii.member(jsii_name="toPutObjectAcl")
    def to_put_object_acl(self) -> "S3Outposts":
        '''(experimental) Grants permission to set the access control list (ACL) permissions for an object that already exists in a bucket.

        Access Level: Permissions management

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzAcl()
        - .ifXAmzContentSha256()
        - .ifXAmzStorageClass()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectAcl.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toPutObjectAcl", []))

    @jsii.member(jsii_name="toPutObjectTagging")
    def to_put_object_tagging(self) -> "S3Outposts":
        '''(experimental) Grants permission to set the supplied tag-set to an object that already exists in a bucket.

        Access Level: Tagging

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifRequestObjectTag()
        - .ifRequestObjectTagKeys()
        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectTagging.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toPutObjectTagging", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Sagemaker(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Sagemaker",
):
    '''(experimental) Statement provider for service `sagemaker <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsagemaker.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `sagemaker <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsagemaker.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Sagemaker, self, [sid])

    @jsii.member(jsii_name="ifAcceleratorTypes")
    def if_accelerator_types(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) The list of all accelerator types associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateEndpointConfig()
        - .toCreateNotebookInstance()
        - .toUpdateNotebookInstance()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "ifAcceleratorTypes", [value, operator]))

    @jsii.member(jsii_name="ifAppNetworkAccessType")
    def if_app_network_access_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) App network access type associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateDomain()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "ifAppNetworkAccessType", [value, operator]))

    @jsii.member(jsii_name="ifDirectInternetAccess")
    def if_direct_internet_access(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) The direct internet access associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateNotebookInstance()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "ifDirectInternetAccess", [value, operator]))

    @jsii.member(jsii_name="ifDomainSharingOutputKmsKey")
    def if_domain_sharing_output_kms_key(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) The Domain sharing output KMS key associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateDomain()
        - .toCreateUserProfile()
        - .toUpdateDomain()
        - .toUpdateUserProfile()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "ifDomainSharingOutputKmsKey", [value, operator]))

    @jsii.member(jsii_name="ifFeatureGroupOfflineStoreKmsKey")
    def if_feature_group_offline_store_kms_key(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) The offline store kms key associated with the feature group resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateFeatureGroup()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "ifFeatureGroupOfflineStoreKmsKey", [value, operator]))

    @jsii.member(jsii_name="ifFeatureGroupOfflineStoreS3Uri")
    def if_feature_group_offline_store_s3_uri(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) The offline store s3 uri associated with the feature group resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateFeatureGroup()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "ifFeatureGroupOfflineStoreS3Uri", [value, operator]))

    @jsii.member(jsii_name="ifFeatureGroupOnlineStoreKmsKey")
    def if_feature_group_online_store_kms_key(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) The online store kms key associated with the feature group resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateFeatureGroup()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "ifFeatureGroupOnlineStoreKmsKey", [value, operator]))

    @jsii.member(jsii_name="ifFileSystemAccessMode")
    def if_file_system_access_mode(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) File system access mode associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateHyperParameterTuningJob()
        - .toCreateTrainingJob()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "ifFileSystemAccessMode", [value, operator]))

    @jsii.member(jsii_name="ifFileSystemDirectoryPath")
    def if_file_system_directory_path(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) File system directory path associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateHyperParameterTuningJob()
        - .toCreateTrainingJob()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "ifFileSystemDirectoryPath", [value, operator]))

    @jsii.member(jsii_name="ifFileSystemId")
    def if_file_system_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) A file system ID associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateHyperParameterTuningJob()
        - .toCreateTrainingJob()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "ifFileSystemId", [value, operator]))

    @jsii.member(jsii_name="ifFileSystemType")
    def if_file_system_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) File system type associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateHyperParameterTuningJob()
        - .toCreateTrainingJob()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "ifFileSystemType", [value, operator]))

    @jsii.member(jsii_name="ifHomeEfsFileSystemKmsKey")
    def if_home_efs_file_system_kms_key(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) This key is deprecated. It has been replaced by sagemaker:VolumeKmsKey.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "ifHomeEfsFileSystemKmsKey", [value, operator]))

    @jsii.member(jsii_name="ifImageArns")
    def if_image_arns(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by the list of all image arns associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateApp()
        - .toCreateDomain()
        - .toCreateUserProfile()
        - .toUpdateDomain()
        - .toUpdateUserProfile()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "ifImageArns", [value, operator]))

    @jsii.member(jsii_name="ifImageVersionArns")
    def if_image_version_arns(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by the list of all image version arns associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateApp()
        - .toCreateDomain()
        - .toCreateUserProfile()
        - .toUpdateDomain()
        - .toUpdateUserProfile()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "ifImageVersionArns", [value, operator]))

    @jsii.member(jsii_name="ifInstanceTypes")
    def if_instance_types(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) The list of all instance types associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateApp()
        - .toCreateDataQualityJobDefinition()
        - .toCreateDomain()
        - .toCreateEndpointConfig()
        - .toCreateHyperParameterTuningJob()
        - .toCreateModelBiasJobDefinition()
        - .toCreateModelExplainabilityJobDefinition()
        - .toCreateModelQualityJobDefinition()
        - .toCreateMonitoringSchedule()
        - .toCreateNotebookInstance()
        - .toCreateProcessingJob()
        - .toCreateTrainingJob()
        - .toCreateTransformJob()
        - .toCreateUserProfile()
        - .toUpdateDomain()
        - .toUpdateMonitoringSchedule()
        - .toUpdateNotebookInstance()
        - .toUpdateTrainingJob()
        - .toUpdateUserProfile()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "ifInstanceTypes", [value, operator]))

    @jsii.member(jsii_name="ifInterContainerTrafficEncryption")
    def if_inter_container_traffic_encryption(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Sagemaker":
        '''(experimental) The inter container traffic encryption associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateAutoMLJob()
        - .toCreateDataQualityJobDefinition()
        - .toCreateHyperParameterTuningJob()
        - .toCreateModelBiasJobDefinition()
        - .toCreateModelExplainabilityJobDefinition()
        - .toCreateModelQualityJobDefinition()
        - .toCreateMonitoringSchedule()
        - .toCreateProcessingJob()
        - .toCreateTrainingJob()
        - .toUpdateMonitoringSchedule()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "ifInterContainerTrafficEncryption", [value]))

    @jsii.member(jsii_name="ifMaxRuntimeInSeconds")
    def if_max_runtime_in_seconds(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) The max runtime in seconds associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateDataQualityJobDefinition()
        - .toCreateHyperParameterTuningJob()
        - .toCreateModelBiasJobDefinition()
        - .toCreateModelExplainabilityJobDefinition()
        - .toCreateModelQualityJobDefinition()
        - .toCreateMonitoringSchedule()
        - .toCreateProcessingJob()
        - .toCreateTrainingJob()
        - .toUpdateMonitoringSchedule()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "ifMaxRuntimeInSeconds", [value, operator]))

    @jsii.member(jsii_name="ifModelArn")
    def if_model_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) The model arn associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateEndpointConfig()
        - .toCreateTransformJob()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "ifModelArn", [value, operator]))

    @jsii.member(jsii_name="ifNetworkIsolation")
    def if_network_isolation(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Sagemaker":
        '''(experimental) The network isolation associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateDataQualityJobDefinition()
        - .toCreateHyperParameterTuningJob()
        - .toCreateModel()
        - .toCreateModelBiasJobDefinition()
        - .toCreateModelExplainabilityJobDefinition()
        - .toCreateModelQualityJobDefinition()
        - .toCreateMonitoringSchedule()
        - .toCreateProcessingJob()
        - .toCreateTrainingJob()
        - .toUpdateMonitoringSchedule()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "ifNetworkIsolation", [value]))

    @jsii.member(jsii_name="ifOutputKmsKey")
    def if_output_kms_key(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) The output kms key associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateAutoMLJob()
        - .toCreateDataQualityJobDefinition()
        - .toCreateHyperParameterTuningJob()
        - .toCreateLabelingJob()
        - .toCreateModelBiasJobDefinition()
        - .toCreateModelExplainabilityJobDefinition()
        - .toCreateModelQualityJobDefinition()
        - .toCreateMonitoringSchedule()
        - .toCreateProcessingJob()
        - .toCreateTrainingJob()
        - .toCreateTransformJob()
        - .toUpdateMonitoringSchedule()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "ifOutputKmsKey", [value, operator]))

    @jsii.member(jsii_name="ifResourceTag")
    def if_resource_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) A tag key and value pair.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to resource types:

        - device
        - device-fleet
        - edge-packaging-job
        - flow-definition
        - human-task-ui
        - labeling-job
        - workteam
        - workforce
        - domain
        - user-profile
        - app
        - app-image-config
        - notebook-instance
        - code-repository
        - image
        - algorithm
        - training-job
        - processing-job
        - hyper-parameter-tuning-job
        - project
        - model-package
        - model-package-group
        - model
        - endpoint-config
        - endpoint
        - transform-job
        - automl-job
        - monitoring-schedule
        - data-quality-job-definition
        - model-quality-job-definition
        - model-bias-job-definition
        - model-explainability-job-definition
        - experiment
        - experiment-trial
        - experiment-trial-component
        - feature-group
        - pipeline
        - artifact
        - context
        - action

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "ifResourceTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifResourceTagExists")
    def if_resource_tag_exists(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) The preface string for a tag key and value pair attached to a resource.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "ifResourceTagExists", [value, operator]))

    @jsii.member(jsii_name="ifRootAccess")
    def if_root_access(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) The root access associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateNotebookInstance()
        - .toUpdateNotebookInstance()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "ifRootAccess", [value, operator]))

    @jsii.member(jsii_name="ifTargetModel")
    def if_target_model(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) The target model associated with the Multi-Model Endpoint in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toInvokeEndpoint()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "ifTargetModel", [value, operator]))

    @jsii.member(jsii_name="ifVolumeKmsKey")
    def if_volume_kms_key(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) The volume kms key associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateAutoMLJob()
        - .toCreateDataQualityJobDefinition()
        - .toCreateDomain()
        - .toCreateEndpointConfig()
        - .toCreateHyperParameterTuningJob()
        - .toCreateLabelingJob()
        - .toCreateModelBiasJobDefinition()
        - .toCreateModelExplainabilityJobDefinition()
        - .toCreateModelQualityJobDefinition()
        - .toCreateMonitoringSchedule()
        - .toCreateNotebookInstance()
        - .toCreateProcessingJob()
        - .toCreateTrainingJob()
        - .toCreateTransformJob()
        - .toUpdateMonitoringSchedule()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "ifVolumeKmsKey", [value, operator]))

    @jsii.member(jsii_name="ifVpcSecurityGroupIds")
    def if_vpc_security_group_ids(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) The list of all vpc security group ids associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateAutoMLJob()
        - .toCreateDataQualityJobDefinition()
        - .toCreateDomain()
        - .toCreateHyperParameterTuningJob()
        - .toCreateModel()
        - .toCreateModelBiasJobDefinition()
        - .toCreateModelExplainabilityJobDefinition()
        - .toCreateModelQualityJobDefinition()
        - .toCreateMonitoringSchedule()
        - .toCreateNotebookInstance()
        - .toCreateProcessingJob()
        - .toCreateTrainingJob()
        - .toCreateUserProfile()
        - .toUpdateDomain()
        - .toUpdateMonitoringSchedule()
        - .toUpdateUserProfile()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "ifVpcSecurityGroupIds", [value, operator]))

    @jsii.member(jsii_name="ifVpcSubnets")
    def if_vpc_subnets(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) The list of all vpc subnets associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateAutoMLJob()
        - .toCreateDataQualityJobDefinition()
        - .toCreateDomain()
        - .toCreateHyperParameterTuningJob()
        - .toCreateModel()
        - .toCreateModelBiasJobDefinition()
        - .toCreateModelExplainabilityJobDefinition()
        - .toCreateModelQualityJobDefinition()
        - .toCreateMonitoringSchedule()
        - .toCreateNotebookInstance()
        - .toCreateProcessingJob()
        - .toCreateTrainingJob()
        - .toUpdateMonitoringSchedule()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "ifVpcSubnets", [value, operator]))

    @jsii.member(jsii_name="ifWorkteamArn")
    def if_workteam_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) The workteam arn associated to the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateFlowDefinition()
        - .toCreateLabelingJob()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "ifWorkteamArn", [value, operator]))

    @jsii.member(jsii_name="ifWorkteamType")
    def if_workteam_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) The workteam type associated to the request. This can be public-crowd, private-crowd or vendor-crowd.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateFlowDefinition()
        - .toCreateLabelingJob()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "ifWorkteamType", [value, operator]))

    @jsii.member(jsii_name="onAction")
    def on_action(
        self,
        action_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type action to the statement.

        :param action_name: - Identifier for the actionName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onAction", [action_name, account, region, partition]))

    @jsii.member(jsii_name="onAlgorithm")
    def on_algorithm(
        self,
        algorithm_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type algorithm to the statement.

        :param algorithm_name: - Identifier for the algorithmName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onAlgorithm", [algorithm_name, account, region, partition]))

    @jsii.member(jsii_name="onApp")
    def on_app(
        self,
        domain_id: builtins.str,
        user_profile_name: builtins.str,
        app_type: builtins.str,
        app_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type app to the statement.

        :param domain_id: - Identifier for the domainId.
        :param user_profile_name: - Identifier for the userProfileName.
        :param app_type: - Identifier for the appType.
        :param app_name: - Identifier for the appName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onApp", [domain_id, user_profile_name, app_type, app_name, account, region, partition]))

    @jsii.member(jsii_name="onAppImageConfig")
    def on_app_image_config(
        self,
        app_image_config_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type app-image-config to the statement.

        :param app_image_config_name: - Identifier for the appImageConfigName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onAppImageConfig", [app_image_config_name, account, region, partition]))

    @jsii.member(jsii_name="onArtifact")
    def on_artifact(
        self,
        hash_of_artifact_source: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type artifact to the statement.

        :param hash_of_artifact_source: - Identifier for the hashOfArtifactSource.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onArtifact", [hash_of_artifact_source, account, region, partition]))

    @jsii.member(jsii_name="onAutomlJob")
    def on_automl_job(
        self,
        auto_ml_job_job_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type automl-job to the statement.

        :param auto_ml_job_job_name: - Identifier for the autoMLJobJobName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onAutomlJob", [auto_ml_job_job_name, account, region, partition]))

    @jsii.member(jsii_name="onCodeRepository")
    def on_code_repository(
        self,
        code_repository_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type code-repository to the statement.

        :param code_repository_name: - Identifier for the codeRepositoryName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onCodeRepository", [code_repository_name, account, region, partition]))

    @jsii.member(jsii_name="onCompilationJob")
    def on_compilation_job(
        self,
        compilation_job_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type compilation-job to the statement.

        :param compilation_job_name: - Identifier for the compilationJobName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onCompilationJob", [compilation_job_name, account, region, partition]))

    @jsii.member(jsii_name="onContext")
    def on_context(
        self,
        context_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type context to the statement.

        :param context_name: - Identifier for the contextName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onContext", [context_name, account, region, partition]))

    @jsii.member(jsii_name="onDataQualityJobDefinition")
    def on_data_quality_job_definition(
        self,
        data_quality_job_definition_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type data-quality-job-definition to the statement.

        :param data_quality_job_definition_name: - Identifier for the dataQualityJobDefinitionName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onDataQualityJobDefinition", [data_quality_job_definition_name, account, region, partition]))

    @jsii.member(jsii_name="onDevice")
    def on_device(
        self,
        device_fleet_name: builtins.str,
        device_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type device to the statement.

        :param device_fleet_name: - Identifier for the deviceFleetName.
        :param device_name: - Identifier for the deviceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onDevice", [device_fleet_name, device_name, account, region, partition]))

    @jsii.member(jsii_name="onDeviceFleet")
    def on_device_fleet(
        self,
        device_fleet_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type device-fleet to the statement.

        :param device_fleet_name: - Identifier for the deviceFleetName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onDeviceFleet", [device_fleet_name, account, region, partition]))

    @jsii.member(jsii_name="onDomain")
    def on_domain(
        self,
        domain_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type domain to the statement.

        :param domain_id: - Identifier for the domainId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onDomain", [domain_id, account, region, partition]))

    @jsii.member(jsii_name="onEdgePackagingJob")
    def on_edge_packaging_job(
        self,
        edge_packaging_job_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type edge-packaging-job to the statement.

        :param edge_packaging_job_name: - Identifier for the edgePackagingJobName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onEdgePackagingJob", [edge_packaging_job_name, account, region, partition]))

    @jsii.member(jsii_name="onEndpoint")
    def on_endpoint(
        self,
        endpoint_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type endpoint to the statement.

        :param endpoint_name: - Identifier for the endpointName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onEndpoint", [endpoint_name, account, region, partition]))

    @jsii.member(jsii_name="onEndpointConfig")
    def on_endpoint_config(
        self,
        endpoint_config_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type endpoint-config to the statement.

        :param endpoint_config_name: - Identifier for the endpointConfigName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onEndpointConfig", [endpoint_config_name, account, region, partition]))

    @jsii.member(jsii_name="onExperiment")
    def on_experiment(
        self,
        experiment_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type experiment to the statement.

        :param experiment_name: - Identifier for the experimentName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onExperiment", [experiment_name, account, region, partition]))

    @jsii.member(jsii_name="onExperimentTrial")
    def on_experiment_trial(
        self,
        trial_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type experiment-trial to the statement.

        :param trial_name: - Identifier for the trialName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onExperimentTrial", [trial_name, account, region, partition]))

    @jsii.member(jsii_name="onExperimentTrialComponent")
    def on_experiment_trial_component(
        self,
        trial_component_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type experiment-trial-component to the statement.

        :param trial_component_name: - Identifier for the trialComponentName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onExperimentTrialComponent", [trial_component_name, account, region, partition]))

    @jsii.member(jsii_name="onFeatureGroup")
    def on_feature_group(
        self,
        feature_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type feature-group to the statement.

        :param feature_group_name: - Identifier for the featureGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onFeatureGroup", [feature_group_name, account, region, partition]))

    @jsii.member(jsii_name="onFlowDefinition")
    def on_flow_definition(
        self,
        flow_definition_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type flow-definition to the statement.

        :param flow_definition_name: - Identifier for the flowDefinitionName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onFlowDefinition", [flow_definition_name, account, region, partition]))

    @jsii.member(jsii_name="onHumanLoop")
    def on_human_loop(
        self,
        human_loop_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type human-loop to the statement.

        :param human_loop_name: - Identifier for the humanLoopName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onHumanLoop", [human_loop_name, account, region, partition]))

    @jsii.member(jsii_name="onHumanTaskUi")
    def on_human_task_ui(
        self,
        human_task_ui_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type human-task-ui to the statement.

        :param human_task_ui_name: - Identifier for the humanTaskUiName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onHumanTaskUi", [human_task_ui_name, account, region, partition]))

    @jsii.member(jsii_name="onHyperParameterTuningJob")
    def on_hyper_parameter_tuning_job(
        self,
        hyper_parameter_tuning_job_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type hyper-parameter-tuning-job to the statement.

        :param hyper_parameter_tuning_job_name: - Identifier for the hyperParameterTuningJobName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onHyperParameterTuningJob", [hyper_parameter_tuning_job_name, account, region, partition]))

    @jsii.member(jsii_name="onImage")
    def on_image(
        self,
        image_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type image to the statement.

        :param image_name: - Identifier for the imageName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onImage", [image_name, account, region, partition]))

    @jsii.member(jsii_name="onImageVersion")
    def on_image_version(
        self,
        image_name: builtins.str,
        version: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type image-version to the statement.

        :param image_name: - Identifier for the imageName.
        :param version: - Identifier for the version.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onImageVersion", [image_name, version, account, region, partition]))

    @jsii.member(jsii_name="onLabelingJob")
    def on_labeling_job(
        self,
        labeling_job_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type labeling-job to the statement.

        :param labeling_job_name: - Identifier for the labelingJobName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onLabelingJob", [labeling_job_name, account, region, partition]))

    @jsii.member(jsii_name="onModel")
    def on_model(
        self,
        model_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type model to the statement.

        :param model_name: - Identifier for the modelName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onModel", [model_name, account, region, partition]))

    @jsii.member(jsii_name="onModelBiasJobDefinition")
    def on_model_bias_job_definition(
        self,
        model_bias_job_definition_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type model-bias-job-definition to the statement.

        :param model_bias_job_definition_name: - Identifier for the modelBiasJobDefinitionName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onModelBiasJobDefinition", [model_bias_job_definition_name, account, region, partition]))

    @jsii.member(jsii_name="onModelExplainabilityJobDefinition")
    def on_model_explainability_job_definition(
        self,
        model_explainability_job_definition_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type model-explainability-job-definition to the statement.

        :param model_explainability_job_definition_name: - Identifier for the modelExplainabilityJobDefinitionName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onModelExplainabilityJobDefinition", [model_explainability_job_definition_name, account, region, partition]))

    @jsii.member(jsii_name="onModelPackage")
    def on_model_package(
        self,
        model_package_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type model-package to the statement.

        :param model_package_name: - Identifier for the modelPackageName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onModelPackage", [model_package_name, account, region, partition]))

    @jsii.member(jsii_name="onModelPackageGroup")
    def on_model_package_group(
        self,
        model_package_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type model-package-group to the statement.

        :param model_package_group_name: - Identifier for the modelPackageGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onModelPackageGroup", [model_package_group_name, account, region, partition]))

    @jsii.member(jsii_name="onModelQualityJobDefinition")
    def on_model_quality_job_definition(
        self,
        model_quality_job_definition_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type model-quality-job-definition to the statement.

        :param model_quality_job_definition_name: - Identifier for the modelQualityJobDefinitionName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onModelQualityJobDefinition", [model_quality_job_definition_name, account, region, partition]))

    @jsii.member(jsii_name="onMonitoringSchedule")
    def on_monitoring_schedule(
        self,
        monitoring_schedule_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type monitoring-schedule to the statement.

        :param monitoring_schedule_name: - Identifier for the monitoringScheduleName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onMonitoringSchedule", [monitoring_schedule_name, account, region, partition]))

    @jsii.member(jsii_name="onNotebookInstance")
    def on_notebook_instance(
        self,
        notebook_instance_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type notebook-instance to the statement.

        :param notebook_instance_name: - Identifier for the notebookInstanceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onNotebookInstance", [notebook_instance_name, account, region, partition]))

    @jsii.member(jsii_name="onNotebookInstanceLifecycleConfig")
    def on_notebook_instance_lifecycle_config(
        self,
        notebook_instance_lifecycle_config_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type notebook-instance-lifecycle-config to the statement.

        :param notebook_instance_lifecycle_config_name: - Identifier for the notebookInstanceLifecycleConfigName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onNotebookInstanceLifecycleConfig", [notebook_instance_lifecycle_config_name, account, region, partition]))

    @jsii.member(jsii_name="onPipeline")
    def on_pipeline(
        self,
        pipeline_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type pipeline to the statement.

        :param pipeline_name: - Identifier for the pipelineName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onPipeline", [pipeline_name, account, region, partition]))

    @jsii.member(jsii_name="onPipelineExecution")
    def on_pipeline_execution(
        self,
        pipeline_name: builtins.str,
        random_string: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type pipeline-execution to the statement.

        :param pipeline_name: - Identifier for the pipelineName.
        :param random_string: - Identifier for the randomString.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onPipelineExecution", [pipeline_name, random_string, account, region, partition]))

    @jsii.member(jsii_name="onProcessingJob")
    def on_processing_job(
        self,
        processing_job_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type processing-job to the statement.

        :param processing_job_name: - Identifier for the processingJobName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onProcessingJob", [processing_job_name, account, region, partition]))

    @jsii.member(jsii_name="onProject")
    def on_project(
        self,
        project_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type project to the statement.

        :param project_name: - Identifier for the projectName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onProject", [project_name, account, region, partition]))

    @jsii.member(jsii_name="onTrainingJob")
    def on_training_job(
        self,
        training_job_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type training-job to the statement.

        :param training_job_name: - Identifier for the trainingJobName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onTrainingJob", [training_job_name, account, region, partition]))

    @jsii.member(jsii_name="onTransformJob")
    def on_transform_job(
        self,
        transform_job_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type transform-job to the statement.

        :param transform_job_name: - Identifier for the transformJobName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onTransformJob", [transform_job_name, account, region, partition]))

    @jsii.member(jsii_name="onUserProfile")
    def on_user_profile(
        self,
        domain_id: builtins.str,
        user_profile_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type user-profile to the statement.

        :param domain_id: - Identifier for the domainId.
        :param user_profile_name: - Identifier for the userProfileName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onUserProfile", [domain_id, user_profile_name, account, region, partition]))

    @jsii.member(jsii_name="onWorkforce")
    def on_workforce(
        self,
        workforce_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type workforce to the statement.

        :param workforce_name: - Identifier for the workforceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onWorkforce", [workforce_name, account, region, partition]))

    @jsii.member(jsii_name="onWorkteam")
    def on_workteam(
        self,
        workteam_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type workteam to the statement.

        :param workteam_name: - Identifier for the workteamName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "onWorkteam", [workteam_name, account, region, partition]))

    @jsii.member(jsii_name="toAddAssociation")
    def to_add_association(self) -> "Sagemaker":
        '''(experimental) Grants permission to associate a lineage entity (artifact, context, action, experiment, experiment-trial-component) to another.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_AddAssociation.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toAddAssociation", []))

    @jsii.member(jsii_name="toAddTags")
    def to_add_tags(self) -> "Sagemaker":
        '''(experimental) Adds or overwrites one or more tags for the specified Amazon SageMaker resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_AddTags.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toAddTags", []))

    @jsii.member(jsii_name="toAssociateTrialComponent")
    def to_associate_trial_component(self) -> "Sagemaker":
        '''(experimental) Associate a trial component with a trial.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_AssociateTrialComponent.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toAssociateTrialComponent", []))

    @jsii.member(jsii_name="toBatchGetMetrics")
    def to_batch_get_metrics(self) -> "Sagemaker":
        '''(experimental) Retrieve metrics associated with SageMaker Resources such as Training Jobs.

        This API is not publicly exposed at this point, however admins can control this action

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toBatchGetMetrics", []))

    @jsii.member(jsii_name="toBatchPutMetrics")
    def to_batch_put_metrics(self) -> "Sagemaker":
        '''(experimental) Publish metrics associated with a SageMaker Resource such as a Training Job.

        This API is not publicly exposed at this point, however admins can control this action

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toBatchPutMetrics", []))

    @jsii.member(jsii_name="toCreateAction")
    def to_create_action(self) -> "Sagemaker":
        '''(experimental) Grants permission to create an action.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateAction.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateAction", []))

    @jsii.member(jsii_name="toCreateAlgorithm")
    def to_create_algorithm(self) -> "Sagemaker":
        '''(experimental) Grants permission to create an algorithm.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateAlgorithm.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateAlgorithm", []))

    @jsii.member(jsii_name="toCreateApp")
    def to_create_app(self) -> "Sagemaker":
        '''(experimental) Grants permission to create an App for a SageMaker Studio UserProfile.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifInstanceTypes()
        - .ifImageArns()
        - .ifImageVersionArns()

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateApp.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateApp", []))

    @jsii.member(jsii_name="toCreateAppImageConfig")
    def to_create_app_image_config(self) -> "Sagemaker":
        '''(experimental) Grants permission to create an AppImageConfig.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateAppImageConfig.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateAppImageConfig", []))

    @jsii.member(jsii_name="toCreateArtifact")
    def to_create_artifact(self) -> "Sagemaker":
        '''(experimental) Grants permission to create an artifact.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateArtifact.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateArtifact", []))

    @jsii.member(jsii_name="toCreateAutoMLJob")
    def to_create_auto_ml_job(self) -> "Sagemaker":
        '''(experimental) Creates automl job.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifInterContainerTrafficEncryption()
        - .ifOutputKmsKey()
        - .ifVolumeKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateAutoMLJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateAutoMLJob", []))

    @jsii.member(jsii_name="toCreateCodeRepository")
    def to_create_code_repository(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a CodeRepository.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateCodeRepository.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateCodeRepository", []))

    @jsii.member(jsii_name="toCreateCompilationJob")
    def to_create_compilation_job(self) -> "Sagemaker":
        '''(experimental) Create a compilation job.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateCompilationJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateCompilationJob", []))

    @jsii.member(jsii_name="toCreateContext")
    def to_create_context(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a context.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateContext.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateContext", []))

    @jsii.member(jsii_name="toCreateDataQualityJobDefinition")
    def to_create_data_quality_job_definition(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a data quality job definition.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifInstanceTypes()
        - .ifInterContainerTrafficEncryption()
        - .ifMaxRuntimeInSeconds()
        - .ifNetworkIsolation()
        - .ifOutputKmsKey()
        - .ifVolumeKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateDataQualityJobDefinition.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateDataQualityJobDefinition", []))

    @jsii.member(jsii_name="toCreateDeviceFleet")
    def to_create_device_fleet(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a device fleet.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateDeviceFleet.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateDeviceFleet", []))

    @jsii.member(jsii_name="toCreateDomain")
    def to_create_domain(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a Domain for SageMaker Studio.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifAppNetworkAccessType()
        - .ifInstanceTypes()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()
        - .ifDomainSharingOutputKmsKey()
        - .ifVolumeKmsKey()
        - .ifImageArns()
        - .ifImageVersionArns()

        Dependent actions:

        - iam:CreateServiceLinkedRole
        - iam:PassRole

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateDomain.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateDomain", []))

    @jsii.member(jsii_name="toCreateEdgePackagingJob")
    def to_create_edge_packaging_job(self) -> "Sagemaker":
        '''(experimental) Grants permission to create an edge packaging job.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateEdgePackagingJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateEdgePackagingJob", []))

    @jsii.member(jsii_name="toCreateEndpoint")
    def to_create_endpoint(self) -> "Sagemaker":
        '''(experimental) Creates an endpoint using the endpoint configuration specified in the request.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateEndpoint", []))

    @jsii.member(jsii_name="toCreateEndpointConfig")
    def to_create_endpoint_config(self) -> "Sagemaker":
        '''(experimental) Creates an endpoint configuration that can be deployed using Amazon SageMaker hosting services.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifAcceleratorTypes()
        - .ifInstanceTypes()
        - .ifModelArn()
        - .ifVolumeKmsKey()

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateEndpointConfig.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateEndpointConfig", []))

    @jsii.member(jsii_name="toCreateExperiment")
    def to_create_experiment(self) -> "Sagemaker":
        '''(experimental) Create an experiment.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateExperiment.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateExperiment", []))

    @jsii.member(jsii_name="toCreateFeatureGroup")
    def to_create_feature_group(self) -> "Sagemaker":
        '''(experimental) Creates feature group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifFeatureGroupOnlineStoreKmsKey()
        - .ifFeatureGroupOfflineStoreKmsKey()
        - .ifFeatureGroupOfflineStoreS3Uri()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateFeatureGroup.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateFeatureGroup", []))

    @jsii.member(jsii_name="toCreateFlowDefinition")
    def to_create_flow_definition(self) -> "Sagemaker":
        '''(experimental) Creates a flow definition, which defines settings for a human workflow.

        Access Level: Write

        Possible conditions:

        - .ifWorkteamArn()
        - .ifWorkteamType()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateFlowDefinition.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateFlowDefinition", []))

    @jsii.member(jsii_name="toCreateHumanTaskUi")
    def to_create_human_task_ui(self) -> "Sagemaker":
        '''(experimental) Defines the settings you will use for the human review workflow user interface.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateHumanTaskUi.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateHumanTaskUi", []))

    @jsii.member(jsii_name="toCreateHyperParameterTuningJob")
    def to_create_hyper_parameter_tuning_job(self) -> "Sagemaker":
        '''(experimental) Creates hyper parameter tuning job that can be deployed using Amazon SageMaker.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifFileSystemAccessMode()
        - .ifFileSystemDirectoryPath()
        - .ifFileSystemId()
        - .ifFileSystemType()
        - .ifInstanceTypes()
        - .ifInterContainerTrafficEncryption()
        - .ifMaxRuntimeInSeconds()
        - .ifNetworkIsolation()
        - .ifOutputKmsKey()
        - .ifVolumeKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateHyperParameterTuningJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateHyperParameterTuningJob", []))

    @jsii.member(jsii_name="toCreateImage")
    def to_create_image(self) -> "Sagemaker":
        '''(experimental) Grants permissions to create a SageMaker Image.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateImage.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateImage", []))

    @jsii.member(jsii_name="toCreateImageVersion")
    def to_create_image_version(self) -> "Sagemaker":
        '''(experimental) Grants permissions to create a SageMaker ImageVersion.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateImageVersion.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateImageVersion", []))

    @jsii.member(jsii_name="toCreateLabelingJob")
    def to_create_labeling_job(self) -> "Sagemaker":
        '''(experimental) Starts a labeling job.

        A labeling job takes unlabeled data in and produces labeled data as output, which can be used for training SageMaker models.

        Access Level: Write

        Possible conditions:

        - .ifWorkteamArn()
        - .ifWorkteamType()
        - .ifVolumeKmsKey()
        - .ifOutputKmsKey()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateLabelingJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateLabelingJob", []))

    @jsii.member(jsii_name="toCreateModel")
    def to_create_model(self) -> "Sagemaker":
        '''(experimental) Creates a model in Amazon SageMaker.

        In the request, you specify a name for the model and describe one or more containers.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifNetworkIsolation()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateModel.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateModel", []))

    @jsii.member(jsii_name="toCreateModelBiasJobDefinition")
    def to_create_model_bias_job_definition(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a model bias job definition.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifInstanceTypes()
        - .ifInterContainerTrafficEncryption()
        - .ifMaxRuntimeInSeconds()
        - .ifNetworkIsolation()
        - .ifOutputKmsKey()
        - .ifVolumeKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateModelBiasJobDefinition.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateModelBiasJobDefinition", []))

    @jsii.member(jsii_name="toCreateModelExplainabilityJobDefinition")
    def to_create_model_explainability_job_definition(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a model explainability job definition.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifInstanceTypes()
        - .ifInterContainerTrafficEncryption()
        - .ifMaxRuntimeInSeconds()
        - .ifNetworkIsolation()
        - .ifOutputKmsKey()
        - .ifVolumeKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateModelExplainabilityJobDefinition.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateModelExplainabilityJobDefinition", []))

    @jsii.member(jsii_name="toCreateModelPackage")
    def to_create_model_package(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a ModelPackage.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateModelPackage.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateModelPackage", []))

    @jsii.member(jsii_name="toCreateModelPackageGroup")
    def to_create_model_package_group(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a ModelPackageGroup.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateModelPackageGroup.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateModelPackageGroup", []))

    @jsii.member(jsii_name="toCreateModelQualityJobDefinition")
    def to_create_model_quality_job_definition(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a model quality job definition.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifInstanceTypes()
        - .ifInterContainerTrafficEncryption()
        - .ifMaxRuntimeInSeconds()
        - .ifNetworkIsolation()
        - .ifOutputKmsKey()
        - .ifVolumeKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateModelQualityJobDefinition.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateModelQualityJobDefinition", []))

    @jsii.member(jsii_name="toCreateMonitoringSchedule")
    def to_create_monitoring_schedule(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a monitoring schedule.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifInstanceTypes()
        - .ifInterContainerTrafficEncryption()
        - .ifMaxRuntimeInSeconds()
        - .ifNetworkIsolation()
        - .ifOutputKmsKey()
        - .ifVolumeKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateMonitoringSchedule.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateMonitoringSchedule", []))

    @jsii.member(jsii_name="toCreateNotebookInstance")
    def to_create_notebook_instance(self) -> "Sagemaker":
        '''(experimental) Creates an Amazon SageMaker notebook instance. A notebook instance is an Amazon EC2 instance running on a Jupyter Notebook.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifAcceleratorTypes()
        - .ifDirectInternetAccess()
        - .ifInstanceTypes()
        - .ifRootAccess()
        - .ifVolumeKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateNotebookInstance.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateNotebookInstance", []))

    @jsii.member(jsii_name="toCreateNotebookInstanceLifecycleConfig")
    def to_create_notebook_instance_lifecycle_config(self) -> "Sagemaker":
        '''(experimental) Creates an notebook instance lifecycle configuration that can be deployed using Amazon SageMaker.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateNotebookInstanceLifecycleConfig.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateNotebookInstanceLifecycleConfig", []))

    @jsii.member(jsii_name="toCreatePipeline")
    def to_create_pipeline(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a pipeline.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreatePipeline.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreatePipeline", []))

    @jsii.member(jsii_name="toCreatePresignedDomainUrl")
    def to_create_presigned_domain_url(self) -> "Sagemaker":
        '''(experimental) Grants permission to return a URL that you can use from your browser to connect to the Domain as a specified UserProfile when AuthMode is 'IAM'.

        Access Level: Write

        Possible conditions:

        - .ifAwsSourceIp()
        - .ifAwsSourceVpc()
        - .ifAwsSourceVpce()

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreatePresignedDomainUrl.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreatePresignedDomainUrl", []))

    @jsii.member(jsii_name="toCreatePresignedNotebookInstanceUrl")
    def to_create_presigned_notebook_instance_url(self) -> "Sagemaker":
        '''(experimental) Returns a URL that you can use from your browser to connect to the Notebook Instance.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreatePresignedNotebookInstanceUrl.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreatePresignedNotebookInstanceUrl", []))

    @jsii.member(jsii_name="toCreateProcessingJob")
    def to_create_processing_job(self) -> "Sagemaker":
        '''(experimental) Starts a processing job.

        After processing completes, Amazon SageMaker saves the resulting artifacts and other optional output to an Amazon S3 location that you specify.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifInstanceTypes()
        - .ifMaxRuntimeInSeconds()
        - .ifNetworkIsolation()
        - .ifOutputKmsKey()
        - .ifVolumeKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()
        - .ifInterContainerTrafficEncryption()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateProcessingJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateProcessingJob", []))

    @jsii.member(jsii_name="toCreateProject")
    def to_create_project(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a Project.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateProject.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateProject", []))

    @jsii.member(jsii_name="toCreateTrainingJob")
    def to_create_training_job(self) -> "Sagemaker":
        '''(experimental) Starts a model training job.

        After training completes, Amazon SageMaker saves the resulting model artifacts and other optional output to an Amazon S3 location that you specify.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifFileSystemAccessMode()
        - .ifFileSystemDirectoryPath()
        - .ifFileSystemId()
        - .ifFileSystemType()
        - .ifInstanceTypes()
        - .ifInterContainerTrafficEncryption()
        - .ifMaxRuntimeInSeconds()
        - .ifNetworkIsolation()
        - .ifOutputKmsKey()
        - .ifVolumeKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateTrainingJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateTrainingJob", []))

    @jsii.member(jsii_name="toCreateTransformJob")
    def to_create_transform_job(self) -> "Sagemaker":
        '''(experimental) Starts a transform job.

        After the results are obtained, Amazon SageMaker saves them to an Amazon S3 location that you specify.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifInstanceTypes()
        - .ifModelArn()
        - .ifOutputKmsKey()
        - .ifVolumeKmsKey()

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateTransformJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateTransformJob", []))

    @jsii.member(jsii_name="toCreateTrial")
    def to_create_trial(self) -> "Sagemaker":
        '''(experimental) Create a trial.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateTrial.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateTrial", []))

    @jsii.member(jsii_name="toCreateTrialComponent")
    def to_create_trial_component(self) -> "Sagemaker":
        '''(experimental) Create a trial component.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateTrialComponent.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateTrialComponent", []))

    @jsii.member(jsii_name="toCreateUserProfile")
    def to_create_user_profile(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a UserProfile for a SageMaker Studio Domain.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifVpcSecurityGroupIds()
        - .ifInstanceTypes()
        - .ifDomainSharingOutputKmsKey()
        - .ifImageArns()
        - .ifImageVersionArns()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateUserProfile.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateUserProfile", []))

    @jsii.member(jsii_name="toCreateWorkforce")
    def to_create_workforce(self) -> "Sagemaker":
        '''(experimental) Create a workforce.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateWorkforce.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateWorkforce", []))

    @jsii.member(jsii_name="toCreateWorkteam")
    def to_create_workteam(self) -> "Sagemaker":
        '''(experimental) Create a workteam.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_CreateWorkteam.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateWorkteam", []))

    @jsii.member(jsii_name="toDeleteAction")
    def to_delete_action(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete an action.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeleteAction.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteAction", []))

    @jsii.member(jsii_name="toDeleteAlgorithm")
    def to_delete_algorithm(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete an algorithm.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeleteAlgorithm.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteAlgorithm", []))

    @jsii.member(jsii_name="toDeleteApp")
    def to_delete_app(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete an App.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeleteApp.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteApp", []))

    @jsii.member(jsii_name="toDeleteAppImageConfig")
    def to_delete_app_image_config(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete an AppImageConfig.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeleteAppImageConfig.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteAppImageConfig", []))

    @jsii.member(jsii_name="toDeleteArtifact")
    def to_delete_artifact(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete an artifact.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeleteArtifact.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteArtifact", []))

    @jsii.member(jsii_name="toDeleteAssociation")
    def to_delete_association(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete the association from a lineage entity (artifact, context, action, experiment, experiment-trial-component) to another.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeleteAssociation.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteAssociation", []))

    @jsii.member(jsii_name="toDeleteCodeRepository")
    def to_delete_code_repository(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a CodeRepository.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeleteCodeRepository.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteCodeRepository", []))

    @jsii.member(jsii_name="toDeleteContext")
    def to_delete_context(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a context.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeleteContext.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteContext", []))

    @jsii.member(jsii_name="toDeleteDataQualityJobDefinition")
    def to_delete_data_quality_job_definition(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete the data quality job definition created using the CreateDataQualityJobDefinition API.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeleteDataQualityJobDefinition.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteDataQualityJobDefinition", []))

    @jsii.member(jsii_name="toDeleteDeviceFleet")
    def to_delete_device_fleet(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a device fleet.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeleteDeviceFleet.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteDeviceFleet", []))

    @jsii.member(jsii_name="toDeleteDomain")
    def to_delete_domain(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a Domain.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeleteDomain.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteDomain", []))

    @jsii.member(jsii_name="toDeleteEndpoint")
    def to_delete_endpoint(self) -> "Sagemaker":
        '''(experimental) Deletes an endpoint. Amazon SageMaker frees up all the resources that were deployed when the endpoint was created.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeleteEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteEndpoint", []))

    @jsii.member(jsii_name="toDeleteEndpointConfig")
    def to_delete_endpoint_config(self) -> "Sagemaker":
        '''(experimental) Deletes the endpoint configuration created using the CreateEndpointConfig API.

        The DeleteEndpointConfig API deletes only the specified configuration. It does not delete any endpoints created using the configuration.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeleteEndpointConfig.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteEndpointConfig", []))

    @jsii.member(jsii_name="toDeleteExperiment")
    def to_delete_experiment(self) -> "Sagemaker":
        '''(experimental) Deletes an experiment.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeleteExperiment.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteExperiment", []))

    @jsii.member(jsii_name="toDeleteFeatureGroup")
    def to_delete_feature_group(self) -> "Sagemaker":
        '''(experimental) Deletes a feature group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeleteFeatureGroup.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteFeatureGroup", []))

    @jsii.member(jsii_name="toDeleteFlowDefinition")
    def to_delete_flow_definition(self) -> "Sagemaker":
        '''(experimental) Deltes the specified flow definition.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeleteFlowDefinition.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteFlowDefinition", []))

    @jsii.member(jsii_name="toDeleteHumanLoop")
    def to_delete_human_loop(self) -> "Sagemaker":
        '''(experimental) Deletes the specified human loop.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeleteHumanLoop.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteHumanLoop", []))

    @jsii.member(jsii_name="toDeleteImage")
    def to_delete_image(self) -> "Sagemaker":
        '''(experimental) Grants permissions to delete a SageMaker Image.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeleteImage.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteImage", []))

    @jsii.member(jsii_name="toDeleteImageVersion")
    def to_delete_image_version(self) -> "Sagemaker":
        '''(experimental) Grants permissions to delete a SageMaker ImageVersion.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeleteImageVersion.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteImageVersion", []))

    @jsii.member(jsii_name="toDeleteModel")
    def to_delete_model(self) -> "Sagemaker":
        '''(experimental) Deletes a model created using the CreateModel API.

        The DeleteModel API deletes only the model entry in Amazon SageMaker that you created by calling the CreateModel API. It does not delete model artifacts, inference code, or the IAM role that you specified when creating the model.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeleteModel.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteModel", []))

    @jsii.member(jsii_name="toDeleteModelBiasJobDefinition")
    def to_delete_model_bias_job_definition(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete the model bias job definition created using the CreateModelBiasJobDefinition API.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeleteModelBiasJobDefinition.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteModelBiasJobDefinition", []))

    @jsii.member(jsii_name="toDeleteModelExplainabilityJobDefinition")
    def to_delete_model_explainability_job_definition(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete the model explainability job definition created using the CreateModelExplainabilityJobDefinition API.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeleteModelExplainabilityJobDefinition.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteModelExplainabilityJobDefinition", []))

    @jsii.member(jsii_name="toDeleteModelPackage")
    def to_delete_model_package(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a ModelPackage.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeleteModelPackage.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteModelPackage", []))

    @jsii.member(jsii_name="toDeleteModelPackageGroup")
    def to_delete_model_package_group(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a ModelPackageGroup.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeleteModelPackageGroup.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteModelPackageGroup", []))

    @jsii.member(jsii_name="toDeleteModelPackageGroupPolicy")
    def to_delete_model_package_group_policy(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a ModelPackageGroup policy.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeleteModelPackageGroupPolicy.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteModelPackageGroupPolicy", []))

    @jsii.member(jsii_name="toDeleteModelQualityJobDefinition")
    def to_delete_model_quality_job_definition(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete the model quality job definition created using the CreateModelQualityJobDefinition API.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeleteModelQualityJobDefinition.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteModelQualityJobDefinition", []))

    @jsii.member(jsii_name="toDeleteMonitoringSchedule")
    def to_delete_monitoring_schedule(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a monitoring schedule.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeleteMonitoringSchedule.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteMonitoringSchedule", []))

    @jsii.member(jsii_name="toDeleteNotebookInstance")
    def to_delete_notebook_instance(self) -> "Sagemaker":
        '''(experimental) Deletes an Amazon SageMaker notebook instance. Before you can delete a notebook instance, you must call the StopNotebookInstance API.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeleteNotebookInstance.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteNotebookInstance", []))

    @jsii.member(jsii_name="toDeleteNotebookInstanceLifecycleConfig")
    def to_delete_notebook_instance_lifecycle_config(self) -> "Sagemaker":
        '''(experimental) Deletes an notebook instance lifecycle configuration that can be deployed using Amazon SageMaker.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeleteNotebookInstanceLifecycleConfig.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteNotebookInstanceLifecycleConfig", []))

    @jsii.member(jsii_name="toDeletePipeline")
    def to_delete_pipeline(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeletePipeline.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeletePipeline", []))

    @jsii.member(jsii_name="toDeleteProject")
    def to_delete_project(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a project.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeleteProject.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteProject", []))

    @jsii.member(jsii_name="toDeleteRecord")
    def to_delete_record(self) -> "Sagemaker":
        '''(experimental) Delete a record from a feature group.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeleteRecord.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteRecord", []))

    @jsii.member(jsii_name="toDeleteTags")
    def to_delete_tags(self) -> "Sagemaker":
        '''(experimental) Deletes the specified set of tags from an Amazon SageMaker resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeleteTags.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteTags", []))

    @jsii.member(jsii_name="toDeleteTrial")
    def to_delete_trial(self) -> "Sagemaker":
        '''(experimental) Deletes a trial.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeleteTrial.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteTrial", []))

    @jsii.member(jsii_name="toDeleteTrialComponent")
    def to_delete_trial_component(self) -> "Sagemaker":
        '''(experimental) Deletes a trial component.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeleteTrialComponent.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteTrialComponent", []))

    @jsii.member(jsii_name="toDeleteUserProfile")
    def to_delete_user_profile(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a UserProfile.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeleteUserProfile.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteUserProfile", []))

    @jsii.member(jsii_name="toDeleteWorkforce")
    def to_delete_workforce(self) -> "Sagemaker":
        '''(experimental) Deletes a workforce.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeleteWorkforce.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteWorkforce", []))

    @jsii.member(jsii_name="toDeleteWorkteam")
    def to_delete_workteam(self) -> "Sagemaker":
        '''(experimental) Deletes a workteam.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeleteWorkteam.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteWorkteam", []))

    @jsii.member(jsii_name="toDeregisterDevices")
    def to_deregister_devices(self) -> "Sagemaker":
        '''(experimental) Grants permission to deregister a set of devices.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DeregisterDevices.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeregisterDevices", []))

    @jsii.member(jsii_name="toDescribeAction")
    def to_describe_action(self) -> "Sagemaker":
        '''(experimental) Grants permission to get information about an action.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeAction.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeAction", []))

    @jsii.member(jsii_name="toDescribeAlgorithm")
    def to_describe_algorithm(self) -> "Sagemaker":
        '''(experimental) Grants permission to describe an algorithm.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeAlgorithm.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeAlgorithm", []))

    @jsii.member(jsii_name="toDescribeApp")
    def to_describe_app(self) -> "Sagemaker":
        '''(experimental) Grants permission to describe an App.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeApp.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeApp", []))

    @jsii.member(jsii_name="toDescribeAppImageConfig")
    def to_describe_app_image_config(self) -> "Sagemaker":
        '''(experimental) Grants permission to describe an AppImageConfig.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeAppImageConfig.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeAppImageConfig", []))

    @jsii.member(jsii_name="toDescribeArtifact")
    def to_describe_artifact(self) -> "Sagemaker":
        '''(experimental) Grants permission to get information about an artifact.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeArtifact.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeArtifact", []))

    @jsii.member(jsii_name="toDescribeAutoMLJob")
    def to_describe_auto_ml_job(self) -> "Sagemaker":
        '''(experimental) Describes an automl job that was created via CreateAutoMLJob API.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeAutoMLJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeAutoMLJob", []))

    @jsii.member(jsii_name="toDescribeCodeRepository")
    def to_describe_code_repository(self) -> "Sagemaker":
        '''(experimental) Grants permission to describe a CodeRepository.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeCodeRepository.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeCodeRepository", []))

    @jsii.member(jsii_name="toDescribeCompilationJob")
    def to_describe_compilation_job(self) -> "Sagemaker":
        '''(experimental) Returns information about a compilation job.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeCompilationJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeCompilationJob", []))

    @jsii.member(jsii_name="toDescribeContext")
    def to_describe_context(self) -> "Sagemaker":
        '''(experimental) Grants permission to get information about a context.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeContext.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeContext", []))

    @jsii.member(jsii_name="toDescribeDataQualityJobDefinition")
    def to_describe_data_quality_job_definition(self) -> "Sagemaker":
        '''(experimental) Grants permission to return information about a data quality job definition.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeDataQualityJobDefinition.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeDataQualityJobDefinition", []))

    @jsii.member(jsii_name="toDescribeDevice")
    def to_describe_device(self) -> "Sagemaker":
        '''(experimental) Grants permission to access information about a device.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeDevice.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeDevice", []))

    @jsii.member(jsii_name="toDescribeDeviceFleet")
    def to_describe_device_fleet(self) -> "Sagemaker":
        '''(experimental) Grants permission to access information about a device fleet.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeDeviceFleet.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeDeviceFleet", []))

    @jsii.member(jsii_name="toDescribeDomain")
    def to_describe_domain(self) -> "Sagemaker":
        '''(experimental) Grants permission to describe a Domain.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeDomain.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeDomain", []))

    @jsii.member(jsii_name="toDescribeEdgePackagingJob")
    def to_describe_edge_packaging_job(self) -> "Sagemaker":
        '''(experimental) Grants permission to access information about an edge packaging job.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeEdgePackagingJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeEdgePackagingJob", []))

    @jsii.member(jsii_name="toDescribeEndpoint")
    def to_describe_endpoint(self) -> "Sagemaker":
        '''(experimental) Returns the description of an endpoint.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeEndpoint", []))

    @jsii.member(jsii_name="toDescribeEndpointConfig")
    def to_describe_endpoint_config(self) -> "Sagemaker":
        '''(experimental) Returns the description of an endpoint configuration, which was created using the CreateEndpointConfig API.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeEndpointConfig.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeEndpointConfig", []))

    @jsii.member(jsii_name="toDescribeExperiment")
    def to_describe_experiment(self) -> "Sagemaker":
        '''(experimental) Returns information about an experiment.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeExperiment.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeExperiment", []))

    @jsii.member(jsii_name="toDescribeFeatureGroup")
    def to_describe_feature_group(self) -> "Sagemaker":
        '''(experimental) Returns information about a feature group.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeFeatureGroup.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeFeatureGroup", []))

    @jsii.member(jsii_name="toDescribeFlowDefinition")
    def to_describe_flow_definition(self) -> "Sagemaker":
        '''(experimental) Returns detailed information about the specified flow definition.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeFlowDefinition.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeFlowDefinition", []))

    @jsii.member(jsii_name="toDescribeHumanLoop")
    def to_describe_human_loop(self) -> "Sagemaker":
        '''(experimental) Returns detailed information about the specified human loop.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeHumanLoop.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeHumanLoop", []))

    @jsii.member(jsii_name="toDescribeHumanTaskUi")
    def to_describe_human_task_ui(self) -> "Sagemaker":
        '''(experimental) Returns detailed information about the specified human review workflow user interface.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeHumanTaskUi.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeHumanTaskUi", []))

    @jsii.member(jsii_name="toDescribeHyperParameterTuningJob")
    def to_describe_hyper_parameter_tuning_job(self) -> "Sagemaker":
        '''(experimental) Describes a hyper parameter tuning job that was created via CreateHyperParameterTuningJob API.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeHyperParameterTuningJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeHyperParameterTuningJob", []))

    @jsii.member(jsii_name="toDescribeImage")
    def to_describe_image(self) -> "Sagemaker":
        '''(experimental) Grants permissions to return information about a SageMaker Image.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeImage.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeImage", []))

    @jsii.member(jsii_name="toDescribeImageVersion")
    def to_describe_image_version(self) -> "Sagemaker":
        '''(experimental) Grants permissions to return information about a SageMaker ImageVersion.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeImageVersion.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeImageVersion", []))

    @jsii.member(jsii_name="toDescribeLabelingJob")
    def to_describe_labeling_job(self) -> "Sagemaker":
        '''(experimental) Returns information about a labeling job.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeLabelingJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeLabelingJob", []))

    @jsii.member(jsii_name="toDescribeModel")
    def to_describe_model(self) -> "Sagemaker":
        '''(experimental) Describes a model that you created using the CreateModel API.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeModel.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeModel", []))

    @jsii.member(jsii_name="toDescribeModelBiasJobDefinition")
    def to_describe_model_bias_job_definition(self) -> "Sagemaker":
        '''(experimental) Grants permission to return information about a model bias job definition.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeModelBiasJobDefinition.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeModelBiasJobDefinition", []))

    @jsii.member(jsii_name="toDescribeModelExplainabilityJobDefinition")
    def to_describe_model_explainability_job_definition(self) -> "Sagemaker":
        '''(experimental) Grants permission to return information about a model explainability job definition.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeModelExplainabilityJobDefinition.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeModelExplainabilityJobDefinition", []))

    @jsii.member(jsii_name="toDescribeModelPackage")
    def to_describe_model_package(self) -> "Sagemaker":
        '''(experimental) Grants permission to describe a ModelPackage.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeModelPackage.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeModelPackage", []))

    @jsii.member(jsii_name="toDescribeModelPackageGroup")
    def to_describe_model_package_group(self) -> "Sagemaker":
        '''(experimental) Grants permission to describe a ModelPackageGroup.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeModelPackageGroup.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeModelPackageGroup", []))

    @jsii.member(jsii_name="toDescribeModelQualityJobDefinition")
    def to_describe_model_quality_job_definition(self) -> "Sagemaker":
        '''(experimental) Grants permission to return information about a model quality job definition.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeModelQualityJobDefinition.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeModelQualityJobDefinition", []))

    @jsii.member(jsii_name="toDescribeMonitoringSchedule")
    def to_describe_monitoring_schedule(self) -> "Sagemaker":
        '''(experimental) Grants permission to return information about a monitoring schedule.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeMonitoringSchedule.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeMonitoringSchedule", []))

    @jsii.member(jsii_name="toDescribeNotebookInstance")
    def to_describe_notebook_instance(self) -> "Sagemaker":
        '''(experimental) Returns information about a notebook instance.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeNotebookInstance.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeNotebookInstance", []))

    @jsii.member(jsii_name="toDescribeNotebookInstanceLifecycleConfig")
    def to_describe_notebook_instance_lifecycle_config(self) -> "Sagemaker":
        '''(experimental) Describes an notebook instance lifecycle configuration that was created via CreateNotebookInstanceLifecycleConfig API.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeNotebookInstanceLifecycleConfig.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeNotebookInstanceLifecycleConfig", []))

    @jsii.member(jsii_name="toDescribePipeline")
    def to_describe_pipeline(self) -> "Sagemaker":
        '''(experimental) Grants permission to get information about a pipeline.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribePipeline.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribePipeline", []))

    @jsii.member(jsii_name="toDescribePipelineDefinitionForExecution")
    def to_describe_pipeline_definition_for_execution(self) -> "Sagemaker":
        '''(experimental) Grants permission to get the pipeline definition for a pipeline execution.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribePipelineDefinitionForExecution.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribePipelineDefinitionForExecution", []))

    @jsii.member(jsii_name="toDescribePipelineExecution")
    def to_describe_pipeline_execution(self) -> "Sagemaker":
        '''(experimental) Grants permission to get information about a pipeline execution.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribePipelineExecution.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribePipelineExecution", []))

    @jsii.member(jsii_name="toDescribeProcessingJob")
    def to_describe_processing_job(self) -> "Sagemaker":
        '''(experimental) Returns information about a processing job.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeProcessingJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeProcessingJob", []))

    @jsii.member(jsii_name="toDescribeProject")
    def to_describe_project(self) -> "Sagemaker":
        '''(experimental) Grants permission to describe a project.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeProject.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeProject", []))

    @jsii.member(jsii_name="toDescribeSubscribedWorkteam")
    def to_describe_subscribed_workteam(self) -> "Sagemaker":
        '''(experimental) Returns information about a subscribed workteam.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeSubscribedWorkteam.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeSubscribedWorkteam", []))

    @jsii.member(jsii_name="toDescribeTrainingJob")
    def to_describe_training_job(self) -> "Sagemaker":
        '''(experimental) Returns information about a training job.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeTrainingJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeTrainingJob", []))

    @jsii.member(jsii_name="toDescribeTransformJob")
    def to_describe_transform_job(self) -> "Sagemaker":
        '''(experimental) Returns information about a transform job.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeTransformJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeTransformJob", []))

    @jsii.member(jsii_name="toDescribeTrial")
    def to_describe_trial(self) -> "Sagemaker":
        '''(experimental) Returns information about a trial.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeTrial.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeTrial", []))

    @jsii.member(jsii_name="toDescribeTrialComponent")
    def to_describe_trial_component(self) -> "Sagemaker":
        '''(experimental) Returns information about a trial component.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeTrialComponent.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeTrialComponent", []))

    @jsii.member(jsii_name="toDescribeUserProfile")
    def to_describe_user_profile(self) -> "Sagemaker":
        '''(experimental) Grants permission to describe a UserProfile.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeUserProfile.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeUserProfile", []))

    @jsii.member(jsii_name="toDescribeWorkforce")
    def to_describe_workforce(self) -> "Sagemaker":
        '''(experimental) Returns information about a workforce.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeWorkforce.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeWorkforce", []))

    @jsii.member(jsii_name="toDescribeWorkteam")
    def to_describe_workteam(self) -> "Sagemaker":
        '''(experimental) Returns information about a workteam.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DescribeWorkteam.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeWorkteam", []))

    @jsii.member(jsii_name="toDisableSagemakerServicecatalogPortfolio")
    def to_disable_sagemaker_servicecatalog_portfolio(self) -> "Sagemaker":
        '''(experimental) Grants permission to disable a SageMaker Service Catalog Portfolio.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DisableSagemakerServicecatalogPortfolio.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDisableSagemakerServicecatalogPortfolio", []))

    @jsii.member(jsii_name="toDisassociateTrialComponent")
    def to_disassociate_trial_component(self) -> "Sagemaker":
        '''(experimental) Disassociate a trial component with a trial.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_DisassociateTrialComponent.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDisassociateTrialComponent", []))

    @jsii.member(jsii_name="toEnableSagemakerServicecatalogPortfolio")
    def to_enable_sagemaker_servicecatalog_portfolio(self) -> "Sagemaker":
        '''(experimental) Grants permission to enable a SageMaker Service Catalog Portfolio.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_EnableSagemakerServicecatalogPortfolio.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toEnableSagemakerServicecatalogPortfolio", []))

    @jsii.member(jsii_name="toGetDeviceFleetReport")
    def to_get_device_fleet_report(self) -> "Sagemaker":
        '''(experimental) Grants permission to access a summary of the devices in a device fleet.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_GetDeviceFleetReport.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toGetDeviceFleetReport", []))

    @jsii.member(jsii_name="toGetDeviceRegistration")
    def to_get_device_registration(self) -> "Sagemaker":
        '''(experimental) Grants permission to get device registration.

        After you deploy a model onto edge devices this api is used to get current device registration

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_GetDeviceRegistration.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toGetDeviceRegistration", []))

    @jsii.member(jsii_name="toGetModelPackageGroupPolicy")
    def to_get_model_package_group_policy(self) -> "Sagemaker":
        '''(experimental) Grants permission to get a ModelPackageGroup policy.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_GetModelPackageGroupPolicy.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toGetModelPackageGroupPolicy", []))

    @jsii.member(jsii_name="toGetRecord")
    def to_get_record(self) -> "Sagemaker":
        '''(experimental) Get a record from a feature group.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_GetRecord.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toGetRecord", []))

    @jsii.member(jsii_name="toGetSagemakerServicecatalogPortfolioStatus")
    def to_get_sagemaker_servicecatalog_portfolio_status(self) -> "Sagemaker":
        '''(experimental) Grants permission to get a SageMaker Service Catalog Portfolio.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_GetSagemakerServicecatalogPortfolioStatus.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toGetSagemakerServicecatalogPortfolioStatus", []))

    @jsii.member(jsii_name="toGetSearchSuggestions")
    def to_get_search_suggestions(self) -> "Sagemaker":
        '''(experimental) Get search suggestions when provided with keyword.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_GetSearchSuggestions.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toGetSearchSuggestions", []))

    @jsii.member(jsii_name="toInvokeEndpoint")
    def to_invoke_endpoint(self) -> "Sagemaker":
        '''(experimental) After you deploy a model into production using Amazon SageMaker hosting services, your client applications use this API to get inferences from the model hosted at the specified endpoint.

        Access Level: Read

        Possible conditions:

        - .ifTargetModel()

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_InvokeEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toInvokeEndpoint", []))

    @jsii.member(jsii_name="toListActions")
    def to_list_actions(self) -> "Sagemaker":
        '''(experimental) Grants permission to list actions.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListActions.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListActions", []))

    @jsii.member(jsii_name="toListAlgorithms")
    def to_list_algorithms(self) -> "Sagemaker":
        '''(experimental) Grants permission to list Algorithms.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListAlgorithms.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListAlgorithms", []))

    @jsii.member(jsii_name="toListAppImageConfigs")
    def to_list_app_image_configs(self) -> "Sagemaker":
        '''(experimental) Grants permission to list the AppImageConfigs in your account.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListAppImageConfigs.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListAppImageConfigs", []))

    @jsii.member(jsii_name="toListApps")
    def to_list_apps(self) -> "Sagemaker":
        '''(experimental) Grants permission to list the Apps in your account.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListApps.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListApps", []))

    @jsii.member(jsii_name="toListArtifacts")
    def to_list_artifacts(self) -> "Sagemaker":
        '''(experimental) Grants permission to list artifacts.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListArtifacts.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListArtifacts", []))

    @jsii.member(jsii_name="toListAssociations")
    def to_list_associations(self) -> "Sagemaker":
        '''(experimental) Grants permission to list associations.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListAssociations.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListAssociations", []))

    @jsii.member(jsii_name="toListAutoMLJobs")
    def to_list_auto_ml_jobs(self) -> "Sagemaker":
        '''(experimental) Lists automl jobs created via the CreateAutoMLJob.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListAutoMLJobs.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListAutoMLJobs", []))

    @jsii.member(jsii_name="toListCandidatesForAutoMLJob")
    def to_list_candidates_for_auto_ml_job(self) -> "Sagemaker":
        '''(experimental) Lists candidates for automl job created via the CreateAutoMLJob.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListCandidatesForAutoMLJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListCandidatesForAutoMLJob", []))

    @jsii.member(jsii_name="toListCodeRepositories")
    def to_list_code_repositories(self) -> "Sagemaker":
        '''(experimental) Grants permission to list code repositories.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListCodeRepositories.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListCodeRepositories", []))

    @jsii.member(jsii_name="toListCompilationJobs")
    def to_list_compilation_jobs(self) -> "Sagemaker":
        '''(experimental) Lists compilation jobs.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListCompilationJobs.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListCompilationJobs", []))

    @jsii.member(jsii_name="toListContexts")
    def to_list_contexts(self) -> "Sagemaker":
        '''(experimental) Grants permission to list contexts.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListContexts.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListContexts", []))

    @jsii.member(jsii_name="toListDataQualityJobDefinitions")
    def to_list_data_quality_job_definitions(self) -> "Sagemaker":
        '''(experimental) Grants permission to list data quality job definitions.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListDataQualityJobDefinitions.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListDataQualityJobDefinitions", []))

    @jsii.member(jsii_name="toListDeviceFleets")
    def to_list_device_fleets(self) -> "Sagemaker":
        '''(experimental) Grants permission to list device fleets.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListDeviceFleets.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListDeviceFleets", []))

    @jsii.member(jsii_name="toListDevices")
    def to_list_devices(self) -> "Sagemaker":
        '''(experimental) Grants permission to list devices.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListDevices.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListDevices", []))

    @jsii.member(jsii_name="toListDomains")
    def to_list_domains(self) -> "Sagemaker":
        '''(experimental) Grants permission to list the Domains in your account.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListDomains.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListDomains", []))

    @jsii.member(jsii_name="toListEdgePackagingJobs")
    def to_list_edge_packaging_jobs(self) -> "Sagemaker":
        '''(experimental) Grants permission to list edge packaging jobs.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListEdgePackagingJobs.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListEdgePackagingJobs", []))

    @jsii.member(jsii_name="toListEndpointConfigs")
    def to_list_endpoint_configs(self) -> "Sagemaker":
        '''(experimental) Lists endpoint configurations.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListEndpointConfigs.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListEndpointConfigs", []))

    @jsii.member(jsii_name="toListEndpoints")
    def to_list_endpoints(self) -> "Sagemaker":
        '''(experimental) Lists endpoints.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListEndpoints.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListEndpoints", []))

    @jsii.member(jsii_name="toListExperiments")
    def to_list_experiments(self) -> "Sagemaker":
        '''(experimental) Lists experiments.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListExperiments.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListExperiments", []))

    @jsii.member(jsii_name="toListFeatureGroups")
    def to_list_feature_groups(self) -> "Sagemaker":
        '''(experimental) Lists feature groups.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListFeatureGroups.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListFeatureGroups", []))

    @jsii.member(jsii_name="toListFlowDefinitions")
    def to_list_flow_definitions(self) -> "Sagemaker":
        '''(experimental) Returns summary information about flow definitions, given the specified parameters.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListFlowDefinitions.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListFlowDefinitions", []))

    @jsii.member(jsii_name="toListHumanLoops")
    def to_list_human_loops(self) -> "Sagemaker":
        '''(experimental) Returns summary information about human loops, given the specified parameters.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListHumanLoops.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListHumanLoops", []))

    @jsii.member(jsii_name="toListHumanTaskUis")
    def to_list_human_task_uis(self) -> "Sagemaker":
        '''(experimental) Returns summary information about human review workflow user interfaces, given the specified parameters.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListHumanTaskUis.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListHumanTaskUis", []))

    @jsii.member(jsii_name="toListHyperParameterTuningJobs")
    def to_list_hyper_parameter_tuning_jobs(self) -> "Sagemaker":
        '''(experimental) Lists hyper parameter tuning jobs that was created using Amazon SageMaker.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListHyperParameterTuningJobs.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListHyperParameterTuningJobs", []))

    @jsii.member(jsii_name="toListImages")
    def to_list_images(self) -> "Sagemaker":
        '''(experimental) Grants permissions to list SageMaker Images in your account.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListImages.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListImages", []))

    @jsii.member(jsii_name="toListImageVersions")
    def to_list_image_versions(self) -> "Sagemaker":
        '''(experimental) Grants permissions to list ImageVersions that belong to a SageMaker Image.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListImageVersions.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListImageVersions", []))

    @jsii.member(jsii_name="toListLabelingJobs")
    def to_list_labeling_jobs(self) -> "Sagemaker":
        '''(experimental) Lists labeling jobs.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListLabelingJobs.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListLabelingJobs", []))

    @jsii.member(jsii_name="toListLabelingJobsForWorkteam")
    def to_list_labeling_jobs_for_workteam(self) -> "Sagemaker":
        '''(experimental) Lists labeling jobs for workteam.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListLabelingJobs.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListLabelingJobsForWorkteam", []))

    @jsii.member(jsii_name="toListModelBiasJobDefinitions")
    def to_list_model_bias_job_definitions(self) -> "Sagemaker":
        '''(experimental) Grants permission to list model bias job definitions.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListModelBiasJobDefinitions.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListModelBiasJobDefinitions", []))

    @jsii.member(jsii_name="toListModelExplainabilityJobDefinitions")
    def to_list_model_explainability_job_definitions(self) -> "Sagemaker":
        '''(experimental) Grants permission to list model explainability job definitions.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListModelExplainabilityJobDefinitions.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListModelExplainabilityJobDefinitions", []))

    @jsii.member(jsii_name="toListModelPackageGroups")
    def to_list_model_package_groups(self) -> "Sagemaker":
        '''(experimental) Grants permission to list ModelPackageGroups.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListModelPackageGroups.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListModelPackageGroups", []))

    @jsii.member(jsii_name="toListModelPackages")
    def to_list_model_packages(self) -> "Sagemaker":
        '''(experimental) Grants permission to list ModelPackages.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListModelPackages.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListModelPackages", []))

    @jsii.member(jsii_name="toListModelQualityJobDefinitions")
    def to_list_model_quality_job_definitions(self) -> "Sagemaker":
        '''(experimental) Grants permission to list model quality job definitions.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListModelQualityJobDefinitions.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListModelQualityJobDefinitions", []))

    @jsii.member(jsii_name="toListModels")
    def to_list_models(self) -> "Sagemaker":
        '''(experimental) Lists the models created with the CreateModel API.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListModels.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListModels", []))

    @jsii.member(jsii_name="toListMonitoringExecutions")
    def to_list_monitoring_executions(self) -> "Sagemaker":
        '''(experimental) Grants permission to list monitoring executions.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListMonitoringExecutions.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListMonitoringExecutions", []))

    @jsii.member(jsii_name="toListMonitoringSchedules")
    def to_list_monitoring_schedules(self) -> "Sagemaker":
        '''(experimental) Grants permission to list monitoring schedules.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListMonitoringSchedules.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListMonitoringSchedules", []))

    @jsii.member(jsii_name="toListNotebookInstanceLifecycleConfigs")
    def to_list_notebook_instance_lifecycle_configs(self) -> "Sagemaker":
        '''(experimental) Lists notebook instance lifecycle configurations that can be deployed using Amazon SageMaker.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListNotebookInstanceLifecycleConfigs.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListNotebookInstanceLifecycleConfigs", []))

    @jsii.member(jsii_name="toListNotebookInstances")
    def to_list_notebook_instances(self) -> "Sagemaker":
        '''(experimental) Returns a list of the Amazon SageMaker notebook instances in the requester's account in an AWS Region.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListNotebookInstances.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListNotebookInstances", []))

    @jsii.member(jsii_name="toListPipelineExecutions")
    def to_list_pipeline_executions(self) -> "Sagemaker":
        '''(experimental) Grants permission to list executions for a pipeline.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListPipelineExecutions.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListPipelineExecutions", []))

    @jsii.member(jsii_name="toListPipelineExecutionSteps")
    def to_list_pipeline_execution_steps(self) -> "Sagemaker":
        '''(experimental) Grants permission to list steps for a pipeline execution.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListPipelineExecutionSteps.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListPipelineExecutionSteps", []))

    @jsii.member(jsii_name="toListPipelineParametersForExecution")
    def to_list_pipeline_parameters_for_execution(self) -> "Sagemaker":
        '''(experimental) Grants permission to list parameters for a pipeline execution.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListPipelineParametersForExecution.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListPipelineParametersForExecution", []))

    @jsii.member(jsii_name="toListPipelines")
    def to_list_pipelines(self) -> "Sagemaker":
        '''(experimental) Grants permission to list pipelines.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListPipelines.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListPipelines", []))

    @jsii.member(jsii_name="toListProcessingJobs")
    def to_list_processing_jobs(self) -> "Sagemaker":
        '''(experimental) Lists processing jobs.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListProcessingJobs.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListProcessingJobs", []))

    @jsii.member(jsii_name="toListProjects")
    def to_list_projects(self) -> "Sagemaker":
        '''(experimental) Grants permission to list Projects.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListProjects.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListProjects", []))

    @jsii.member(jsii_name="toListSubscribedWorkteams")
    def to_list_subscribed_workteams(self) -> "Sagemaker":
        '''(experimental) Lists subscribed workteams.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListSubscribedWorkteams.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListSubscribedWorkteams", []))

    @jsii.member(jsii_name="toListTags")
    def to_list_tags(self) -> "Sagemaker":
        '''(experimental) Returns the tag set associated with the specified resource.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListTags.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListTags", []))

    @jsii.member(jsii_name="toListTrainingJobs")
    def to_list_training_jobs(self) -> "Sagemaker":
        '''(experimental) Lists training jobs.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListTrainingJobs.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListTrainingJobs", []))

    @jsii.member(jsii_name="toListTrainingJobsForHyperParameterTuningJob")
    def to_list_training_jobs_for_hyper_parameter_tuning_job(self) -> "Sagemaker":
        '''(experimental) Lists training jobs for a hyper parameter tuning job that was created using Amazon SageMaker.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ ListTrainingJobsForHyperParameterTuningJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListTrainingJobsForHyperParameterTuningJob", []))

    @jsii.member(jsii_name="toListTransformJobs")
    def to_list_transform_jobs(self) -> "Sagemaker":
        '''(experimental) Lists transform jobs.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListTransformJobs.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListTransformJobs", []))

    @jsii.member(jsii_name="toListTrialComponents")
    def to_list_trial_components(self) -> "Sagemaker":
        '''(experimental) Lists trial components.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListTrialComponents.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListTrialComponents", []))

    @jsii.member(jsii_name="toListTrials")
    def to_list_trials(self) -> "Sagemaker":
        '''(experimental) Lists trials.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListTrials.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListTrials", []))

    @jsii.member(jsii_name="toListUserProfiles")
    def to_list_user_profiles(self) -> "Sagemaker":
        '''(experimental) Grants permission to list the UserProfiles in your account.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListUserProfiles.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListUserProfiles", []))

    @jsii.member(jsii_name="toListWorkforces")
    def to_list_workforces(self) -> "Sagemaker":
        '''(experimental) Lists workforces.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListWorkforces.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListWorkforces", []))

    @jsii.member(jsii_name="toListWorkteams")
    def to_list_workteams(self) -> "Sagemaker":
        '''(experimental) Lists workteams.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ListWorkteams.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListWorkteams", []))

    @jsii.member(jsii_name="toPutModelPackageGroupPolicy")
    def to_put_model_package_group_policy(self) -> "Sagemaker":
        '''(experimental) Grants permission to put a ModelPackageGroup policy.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_PutModelPackageGroupPolicy.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toPutModelPackageGroupPolicy", []))

    @jsii.member(jsii_name="toPutRecord")
    def to_put_record(self) -> "Sagemaker":
        '''(experimental) Put a record to a feature group.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_PutRecord.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toPutRecord", []))

    @jsii.member(jsii_name="toRegisterDevices")
    def to_register_devices(self) -> "Sagemaker":
        '''(experimental) Grants permission to register a set of devices.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_RegisterDevices.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toRegisterDevices", []))

    @jsii.member(jsii_name="toRenderUiTemplate")
    def to_render_ui_template(self) -> "Sagemaker":
        '''(experimental) Render a UI template used for a human annotation task.

        Access Level: Read

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_RenderUiTemplate.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toRenderUiTemplate", []))

    @jsii.member(jsii_name="toSearch")
    def to_search(self) -> "Sagemaker":
        '''(experimental) Search for SageMaker objects.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_Search.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toSearch", []))

    @jsii.member(jsii_name="toSendHeartbeat")
    def to_send_heartbeat(self) -> "Sagemaker":
        '''(experimental) Grants permission to publish heartbeat data from devices.

        After you deploy a model onto edge devices this api is used to report device status

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_SendHeartbeat.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toSendHeartbeat", []))

    @jsii.member(jsii_name="toStartHumanLoop")
    def to_start_human_loop(self) -> "Sagemaker":
        '''(experimental) Starts a human loop.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_StartHumanLoop.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toStartHumanLoop", []))

    @jsii.member(jsii_name="toStartMonitoringSchedule")
    def to_start_monitoring_schedule(self) -> "Sagemaker":
        '''(experimental) Starts a monitoring schedule.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_StartMonitoringSchedule.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toStartMonitoringSchedule", []))

    @jsii.member(jsii_name="toStartNotebookInstance")
    def to_start_notebook_instance(self) -> "Sagemaker":
        '''(experimental) Launches an EC2 instance with the latest version of the libraries and attaches your EBS volume.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_StartNotebookInstance.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toStartNotebookInstance", []))

    @jsii.member(jsii_name="toStartPipelineExecution")
    def to_start_pipeline_execution(self) -> "Sagemaker":
        '''(experimental) Grants permission to start a pipeline execution.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_StartPipelineExecution.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toStartPipelineExecution", []))

    @jsii.member(jsii_name="toStopAutoMLJob")
    def to_stop_auto_ml_job(self) -> "Sagemaker":
        '''(experimental) Stops a running automl job created via the CreateAutoMLJob.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_StopAutoMLJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toStopAutoMLJob", []))

    @jsii.member(jsii_name="toStopCompilationJob")
    def to_stop_compilation_job(self) -> "Sagemaker":
        '''(experimental) Stops a compilation job.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_StopCompilationJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toStopCompilationJob", []))

    @jsii.member(jsii_name="toStopEdgePackagingJob")
    def to_stop_edge_packaging_job(self) -> "Sagemaker":
        '''(experimental) Grants permission to stop an edge packaging job.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_StopEdgePackagingJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toStopEdgePackagingJob", []))

    @jsii.member(jsii_name="toStopHumanLoop")
    def to_stop_human_loop(self) -> "Sagemaker":
        '''(experimental) Stops the specified human loop.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_StopHumanLoop.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toStopHumanLoop", []))

    @jsii.member(jsii_name="toStopHyperParameterTuningJob")
    def to_stop_hyper_parameter_tuning_job(self) -> "Sagemaker":
        '''(experimental) Stops a running hyper parameter tuning job create via the CreateHyperParameterTuningJob.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_StopHyperParameterTuningJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toStopHyperParameterTuningJob", []))

    @jsii.member(jsii_name="toStopLabelingJob")
    def to_stop_labeling_job(self) -> "Sagemaker":
        '''(experimental) Stops a labeling job. Any labels already generated will be exported before stopping.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_StopLabelingJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toStopLabelingJob", []))

    @jsii.member(jsii_name="toStopMonitoringSchedule")
    def to_stop_monitoring_schedule(self) -> "Sagemaker":
        '''(experimental) Stops a monitoring schedule.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_StopMonitoringSchedule.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toStopMonitoringSchedule", []))

    @jsii.member(jsii_name="toStopNotebookInstance")
    def to_stop_notebook_instance(self) -> "Sagemaker":
        '''(experimental) Terminates the EC2 instance.

        Before terminating the instance, Amazon SageMaker disconnects the EBS volume from it. Amazon SageMaker preserves the EBS volume.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_StopNotebookInstance.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toStopNotebookInstance", []))

    @jsii.member(jsii_name="toStopPipelineExecution")
    def to_stop_pipeline_execution(self) -> "Sagemaker":
        '''(experimental) Grants permission to stop a pipeline execution.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_StopPipelineExecution.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toStopPipelineExecution", []))

    @jsii.member(jsii_name="toStopProcessingJob")
    def to_stop_processing_job(self) -> "Sagemaker":
        '''(experimental) Stops a processing job.

        To stop a job, Amazon SageMaker sends the algorithm the SIGTERM signal, which delays job termination for 120 seconds.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_StopProcessingJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toStopProcessingJob", []))

    @jsii.member(jsii_name="toStopTrainingJob")
    def to_stop_training_job(self) -> "Sagemaker":
        '''(experimental) Stops a training job.

        To stop a job, Amazon SageMaker sends the algorithm the SIGTERM signal, which delays job termination for 120 seconds.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_StopTrainingJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toStopTrainingJob", []))

    @jsii.member(jsii_name="toStopTransformJob")
    def to_stop_transform_job(self) -> "Sagemaker":
        '''(experimental) Stops a transform job.

        When Amazon SageMaker receives a StopTransformJob request, the status of the job changes to Stopping. After Amazon SageMaker stops the job, the status is set to Stopped

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_StopTransformJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toStopTransformJob", []))

    @jsii.member(jsii_name="toUpdateAction")
    def to_update_action(self) -> "Sagemaker":
        '''(experimental) Grants permission to update an action.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_UpdateAction.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateAction", []))

    @jsii.member(jsii_name="toUpdateAppImageConfig")
    def to_update_app_image_config(self) -> "Sagemaker":
        '''(experimental) Grants permission to update an AppImageConfig.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_UpdateAppImageConfig.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateAppImageConfig", []))

    @jsii.member(jsii_name="toUpdateArtifact")
    def to_update_artifact(self) -> "Sagemaker":
        '''(experimental) Grants permission to update an artifact.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_UpdateArtifact.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateArtifact", []))

    @jsii.member(jsii_name="toUpdateCodeRepository")
    def to_update_code_repository(self) -> "Sagemaker":
        '''(experimental) Grants permission to update a CodeRepository.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_UpdateCodeRepository.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateCodeRepository", []))

    @jsii.member(jsii_name="toUpdateContext")
    def to_update_context(self) -> "Sagemaker":
        '''(experimental) Grants permission to update a context.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_UpdateContext.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateContext", []))

    @jsii.member(jsii_name="toUpdateDeviceFleet")
    def to_update_device_fleet(self) -> "Sagemaker":
        '''(experimental) Grants permission to update a device fleet.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_UpdateDeviceFleet.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateDeviceFleet", []))

    @jsii.member(jsii_name="toUpdateDevices")
    def to_update_devices(self) -> "Sagemaker":
        '''(experimental) Grants permission to update a set of devices.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_UpdateDevices.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateDevices", []))

    @jsii.member(jsii_name="toUpdateDomain")
    def to_update_domain(self) -> "Sagemaker":
        '''(experimental) Grants permission to update a Domain.

        Access Level: Write

        Possible conditions:

        - .ifVpcSecurityGroupIds()
        - .ifInstanceTypes()
        - .ifDomainSharingOutputKmsKey()
        - .ifImageArns()
        - .ifImageVersionArns()

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_UpdateDomain.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateDomain", []))

    @jsii.member(jsii_name="toUpdateEndpoint")
    def to_update_endpoint(self) -> "Sagemaker":
        '''(experimental) Updates an endpoint to use the endpoint configuration specified in the request.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_UpdateEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateEndpoint", []))

    @jsii.member(jsii_name="toUpdateEndpointWeightsAndCapacities")
    def to_update_endpoint_weights_and_capacities(self) -> "Sagemaker":
        '''(experimental) Updates variant weight, capacity, or both of one or more variants associated with an endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_UpdateEndpointWeightsAndCapacities.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateEndpointWeightsAndCapacities", []))

    @jsii.member(jsii_name="toUpdateExperiment")
    def to_update_experiment(self) -> "Sagemaker":
        '''(experimental) Updates an experiment.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_UpdateExperiment.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateExperiment", []))

    @jsii.member(jsii_name="toUpdateImage")
    def to_update_image(self) -> "Sagemaker":
        '''(experimental) Grants permissions to update the properties of a SageMaker Image.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_UpdateImage.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateImage", []))

    @jsii.member(jsii_name="toUpdateModelPackage")
    def to_update_model_package(self) -> "Sagemaker":
        '''(experimental) Grants permission to update a ModelPackage.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_UpdateModelPackage.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateModelPackage", []))

    @jsii.member(jsii_name="toUpdateMonitoringSchedule")
    def to_update_monitoring_schedule(self) -> "Sagemaker":
        '''(experimental) Updates a monitoring schedule.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifInstanceTypes()
        - .ifMaxRuntimeInSeconds()
        - .ifNetworkIsolation()
        - .ifOutputKmsKey()
        - .ifVolumeKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()
        - .ifInterContainerTrafficEncryption()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_UpdateMonitoringSchedule.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateMonitoringSchedule", []))

    @jsii.member(jsii_name="toUpdateNotebookInstance")
    def to_update_notebook_instance(self) -> "Sagemaker":
        '''(experimental) Updates a notebook instance.

        Notebook instance updates include upgrading or downgrading the EC2 instance used for your notebook instance to accommodate changes in your workload requirements. You can also update the VPC security groups.

        Access Level: Write

        Possible conditions:

        - .ifAcceleratorTypes()
        - .ifInstanceTypes()
        - .ifRootAccess()

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_UpdateNotebookInstance.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateNotebookInstance", []))

    @jsii.member(jsii_name="toUpdateNotebookInstanceLifecycleConfig")
    def to_update_notebook_instance_lifecycle_config(self) -> "Sagemaker":
        '''(experimental) Updates a notebook instance lifecycle configuration created with the CreateNotebookInstanceLifecycleConfig API.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_ UpdateNotebookInstanceLifecycleConfig.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateNotebookInstanceLifecycleConfig", []))

    @jsii.member(jsii_name="toUpdatePipeline")
    def to_update_pipeline(self) -> "Sagemaker":
        '''(experimental) Grants permission to update a pipeline.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_UpdatePipeline.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdatePipeline", []))

    @jsii.member(jsii_name="toUpdatePipelineExecution")
    def to_update_pipeline_execution(self) -> "Sagemaker":
        '''(experimental) Grants permission to update a pipeline execution.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_UpdatePipelineExecution.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdatePipelineExecution", []))

    @jsii.member(jsii_name="toUpdateTrainingJob")
    def to_update_training_job(self) -> "Sagemaker":
        '''(experimental) Updates a training job.

        Access Level: Write

        Possible conditions:

        - .ifInstanceTypes()

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_UpdateTrainingJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateTrainingJob", []))

    @jsii.member(jsii_name="toUpdateTrial")
    def to_update_trial(self) -> "Sagemaker":
        '''(experimental) Updates a trial.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_UpdateTrial.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateTrial", []))

    @jsii.member(jsii_name="toUpdateTrialComponent")
    def to_update_trial_component(self) -> "Sagemaker":
        '''(experimental) Updates a trial component.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_UpdateTrialComponent.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateTrialComponent", []))

    @jsii.member(jsii_name="toUpdateUserProfile")
    def to_update_user_profile(self) -> "Sagemaker":
        '''(experimental) Grants permission to update a UserProfile.

        Access Level: Write

        Possible conditions:

        - .ifInstanceTypes()
        - .ifVpcSecurityGroupIds()
        - .ifInstanceTypes()
        - .ifDomainSharingOutputKmsKey()
        - .ifImageArns()
        - .ifImageVersionArns()

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_UpdateUserProfile.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateUserProfile", []))

    @jsii.member(jsii_name="toUpdateWorkforce")
    def to_update_workforce(self) -> "Sagemaker":
        '''(experimental) Updates a workforce.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_UpdateWorkforce.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateWorkforce", []))

    @jsii.member(jsii_name="toUpdateWorkteam")
    def to_update_workteam(self) -> "Sagemaker":
        '''(experimental) Updates a workteam.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/API_UpdateWorkteam.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateWorkteam", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Savingsplans(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Savingsplans",
):
    '''(experimental) Statement provider for service `savingsplans <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssavingsplans.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `savingsplans <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssavingsplans.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Savingsplans, self, [sid])

    @jsii.member(jsii_name="onSavingsplan")
    def on_savingsplan(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Savingsplans":
        '''(experimental) Adds a resource of type savingsplan to the statement.

        https://docs.aws.amazon.com/savingsplans/latest/userguide/API_SavingsPlan.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Savingsplans", jsii.invoke(self, "onSavingsplan", [resource_id, account, partition]))

    @jsii.member(jsii_name="toCreateSavingsPlan")
    def to_create_savings_plan(self) -> "Savingsplans":
        '''(experimental) Grants permission to create a savings plan.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/savingsplans/latest/APIReference/API_CreateSavingsPlan.html

        :stability: experimental
        '''
        return typing.cast("Savingsplans", jsii.invoke(self, "toCreateSavingsPlan", []))

    @jsii.member(jsii_name="toDeleteQueuedSavingsPlan")
    def to_delete_queued_savings_plan(self) -> "Savingsplans":
        '''(experimental) Grants permission to delete the queued savings plan associated with customers account.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/savingsplans/latest/APIReference/API_DeleteQueuedSavingsPlan.html

        :stability: experimental
        '''
        return typing.cast("Savingsplans", jsii.invoke(self, "toDeleteQueuedSavingsPlan", []))

    @jsii.member(jsii_name="toDescribeSavingsPlanRates")
    def to_describe_savings_plan_rates(self) -> "Savingsplans":
        '''(experimental) Grants permission to describe the rates associated with customers savings plan.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/savingsplans/latest/APIReference/API_DescribeSavingsPlanRates.html

        :stability: experimental
        '''
        return typing.cast("Savingsplans", jsii.invoke(self, "toDescribeSavingsPlanRates", []))

    @jsii.member(jsii_name="toDescribeSavingsPlans")
    def to_describe_savings_plans(self) -> "Savingsplans":
        '''(experimental) Grants permission to describe the savings plans associated with customers account.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/savingsplans/latest/APIReference/API_DescribeSavingsPlans.html

        :stability: experimental
        '''
        return typing.cast("Savingsplans", jsii.invoke(self, "toDescribeSavingsPlans", []))

    @jsii.member(jsii_name="toDescribeSavingsPlansOfferingRates")
    def to_describe_savings_plans_offering_rates(self) -> "Savingsplans":
        '''(experimental) Grants permission to describe the rates assciated with savings plans offerings.

        Access Level: Read

        https://docs.aws.amazon.com/savingsplans/latest/APIReference/API_DescribeSavingsPlansOfferingRates.html

        :stability: experimental
        '''
        return typing.cast("Savingsplans", jsii.invoke(self, "toDescribeSavingsPlansOfferingRates", []))

    @jsii.member(jsii_name="toDescribeSavingsPlansOfferings")
    def to_describe_savings_plans_offerings(self) -> "Savingsplans":
        '''(experimental) Grants permission to describe the savings plans offerings that customer is eligible to purchase.

        Access Level: Read

        https://docs.aws.amazon.com/savingsplans/latest/APIReference/API_DescribeSavingsPlansOfferings.html

        :stability: experimental
        '''
        return typing.cast("Savingsplans", jsii.invoke(self, "toDescribeSavingsPlansOfferings", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Savingsplans":
        '''(experimental) Grants permission to list tags for a savings plan.

        Access Level: List

        https://docs.aws.amazon.com/savingsplans/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Savingsplans", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Savingsplans":
        '''(experimental) Grants permission to tag a savings plan.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/savingsplans/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Savingsplans", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Savingsplans":
        '''(experimental) Grants permission to untag a savings plan.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/savingsplans/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Savingsplans", jsii.invoke(self, "toUntagResource", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Schemas(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Schemas"):
    '''(experimental) Statement provider for service `schemas <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoneventbridgeschemas.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `schemas <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoneventbridgeschemas.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Schemas, self, [sid])

    @jsii.member(jsii_name="onDiscoverer")
    def on_discoverer(
        self,
        discoverer_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Schemas":
        '''(experimental) Adds a resource of type discoverer to the statement.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/iam-identity-based-access-control-eventbridge.html

        :param discoverer_id: - Identifier for the discovererId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "onDiscoverer", [discoverer_id, account, region, partition]))

    @jsii.member(jsii_name="onRegistry")
    def on_registry(
        self,
        registry_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Schemas":
        '''(experimental) Adds a resource of type registry to the statement.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/iam-identity-based-access-control-eventbridge.html

        :param registry_name: - Identifier for the registryName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "onRegistry", [registry_name, account, region, partition]))

    @jsii.member(jsii_name="onSchema")
    def on_schema(
        self,
        registry_name: builtins.str,
        schema_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Schemas":
        '''(experimental) Adds a resource of type schema to the statement.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/iam-identity-based-access-control-eventbridge.html

        :param registry_name: - Identifier for the registryName.
        :param schema_name: - Identifier for the schemaName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "onSchema", [registry_name, schema_name, account, region, partition]))

    @jsii.member(jsii_name="toCreateDiscoverer")
    def to_create_discoverer(self) -> "Schemas":
        '''(experimental) Creates an event schema discoverer. Once created, your events will be automatically map into corresponding schema documents.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-discoverers-id-discovererid.html#CreateDiscoverer

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toCreateDiscoverer", []))

    @jsii.member(jsii_name="toCreateRegistry")
    def to_create_registry(self) -> "Schemas":
        '''(experimental) Create a new schema registry in your account.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-registries-name-registryname.html#CreateRegistry

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toCreateRegistry", []))

    @jsii.member(jsii_name="toCreateSchema")
    def to_create_schema(self) -> "Schemas":
        '''(experimental) Create a new schema in your account.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-registries-name-registryname-schemas-name-schemaname.html#CreateSchema

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toCreateSchema", []))

    @jsii.member(jsii_name="toDeleteDiscoverer")
    def to_delete_discoverer(self) -> "Schemas":
        '''(experimental) Deletes discoverer in your account.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-discoverers-id-discovererid.html#DeleteDiscoverer

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toDeleteDiscoverer", []))

    @jsii.member(jsii_name="toDeleteRegistry")
    def to_delete_registry(self) -> "Schemas":
        '''(experimental) Deletes an existing registry in your account.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-registries-name-registryname.html#DeleteRegistry

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toDeleteRegistry", []))

    @jsii.member(jsii_name="toDeleteResourcePolicy")
    def to_delete_resource_policy(self) -> "Schemas":
        '''(experimental) Delete the resource-based policy attached to a given registry.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-policy.html#DeleteResourcePolicy

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toDeleteResourcePolicy", []))

    @jsii.member(jsii_name="toDeleteSchema")
    def to_delete_schema(self) -> "Schemas":
        '''(experimental) Deletes an existing schema in your account.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-registries-name-registryname-schemas-name-schemaname.html#DeleteSchema

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toDeleteSchema", []))

    @jsii.member(jsii_name="toDeleteSchemaVersion")
    def to_delete_schema_version(self) -> "Schemas":
        '''(experimental) Deletes a specific version of schema in your account.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-registries-name-registryname-schemas-name-schemaname-version-schemaversion.html#DeleteSchemaVersion

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toDeleteSchemaVersion", []))

    @jsii.member(jsii_name="toDescribeCodeBinding")
    def to_describe_code_binding(self) -> "Schemas":
        '''(experimental) Retrieves metadata for generated code for specific schema in your account.

        Access Level: Read

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-registries-name-registryname-schemas-name-schemaname-language-language.html#DescribeCodeBinding

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toDescribeCodeBinding", []))

    @jsii.member(jsii_name="toDescribeDiscoverer")
    def to_describe_discoverer(self) -> "Schemas":
        '''(experimental) Retrieves discoverer metadata in your account.

        Access Level: Read

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-discoverers-id-discovererid.html#DescribeDiscoverer

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toDescribeDiscoverer", []))

    @jsii.member(jsii_name="toDescribeRegistry")
    def to_describe_registry(self) -> "Schemas":
        '''(experimental) Describes an existing registry metadata in your account.

        Access Level: Read

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-registries-name-registryname.html#DescribeRegistry

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toDescribeRegistry", []))

    @jsii.member(jsii_name="toDescribeSchema")
    def to_describe_schema(self) -> "Schemas":
        '''(experimental) Retrieves an existing schema in your account.

        Access Level: Read

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-registries-name-registryname-schemas-name-schemaname.html#DescribeSchema

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toDescribeSchema", []))

    @jsii.member(jsii_name="toExportSchema")
    def to_export_schema(self) -> "Schemas":
        '''(experimental) Allows exporting AWS registry or discovered schemas in OpenAPI 3 format to JSONSchema format.

        Access Level: Read

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-policy.html#ExportSchema

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toExportSchema", []))

    @jsii.member(jsii_name="toGetCodeBindingSource")
    def to_get_code_binding_source(self) -> "Schemas":
        '''(experimental) Retrieves metadata for generated code for specific schema in your account.

        Access Level: Read

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-registries-name-registryname-schemas-name-schemaname-language-language-source.html#GetCodeBindingSource

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toGetCodeBindingSource", []))

    @jsii.member(jsii_name="toGetDiscoveredSchema")
    def to_get_discovered_schema(self) -> "Schemas":
        '''(experimental) Retrieves schema for the provided list of sample events.

        Access Level: Read

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-discover.html#GetDiscoveredSchema

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toGetDiscoveredSchema", []))

    @jsii.member(jsii_name="toGetResourcePolicy")
    def to_get_resource_policy(self) -> "Schemas":
        '''(experimental) Retrieves the resource-based policy attached to a given registry.

        Access Level: Read

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-policy.html#GetResourcePolicy

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toGetResourcePolicy", []))

    @jsii.member(jsii_name="toListDiscoverers")
    def to_list_discoverers(self) -> "Schemas":
        '''(experimental) Lists all the discoverers in your account.

        Access Level: List

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-discoverers.html#ListDiscoverers

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toListDiscoverers", []))

    @jsii.member(jsii_name="toListRegistries")
    def to_list_registries(self) -> "Schemas":
        '''(experimental) List all discoverers in your account.

        Access Level: List

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-registries.html#ListRegistries

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toListRegistries", []))

    @jsii.member(jsii_name="toListSchemas")
    def to_list_schemas(self) -> "Schemas":
        '''(experimental) List all schemas.

        Access Level: List

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-registries-name-registryname-schemas.html#ListSchemas

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toListSchemas", []))

    @jsii.member(jsii_name="toListSchemaVersions")
    def to_list_schema_versions(self) -> "Schemas":
        '''(experimental) List all versions of a schema.

        Access Level: List

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-registries-name-registryname-schemas-name-schemaname-versions.html#ListSchemaVersions

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toListSchemaVersions", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Schemas":
        '''(experimental) This action lists tags for a resource.

        Access Level: List

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/tags-resource-arn.html#ListTagsForResource

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutCodeBinding")
    def to_put_code_binding(self) -> "Schemas":
        '''(experimental) Generates code for specific schema in your account.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-registries-name-registryname-schemas-name-schemaname-language-language.html#PutCodeBinding

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toPutCodeBinding", []))

    @jsii.member(jsii_name="toPutResourcePolicy")
    def to_put_resource_policy(self) -> "Schemas":
        '''(experimental) Attach resource-based policy to the specific registry.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-policy.html#PutResourcePolicy

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toPutResourcePolicy", []))

    @jsii.member(jsii_name="toSearchSchemas")
    def to_search_schemas(self) -> "Schemas":
        '''(experimental) Searches schemas based on specified keywords in your account.

        Access Level: List

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-registries-name-registryname-schemas-search.html#SearchSchemas

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toSearchSchemas", []))

    @jsii.member(jsii_name="toStartDiscoverer")
    def to_start_discoverer(self) -> "Schemas":
        '''(experimental) Starts the specified discoverer.

        Once started the discoverer will automatically register schemas for published events to configured source in your account

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-discoverers-id-discovererid.html#StartDiscoverer

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toStartDiscoverer", []))

    @jsii.member(jsii_name="toStopDiscoverer")
    def to_stop_discoverer(self) -> "Schemas":
        '''(experimental) Starts the specified discoverer.

        Once started the discoverer will automatically register schemas for published events to configured source in your account

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-discoverers-id-discovererid.html#StopDiscoverer

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toStopDiscoverer", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Schemas":
        '''(experimental) This action tags an resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/tags-resource-arn.html#TagResource

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Schemas":
        '''(experimental) This action removes a tag from on a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/tags-resource-arn.html#UntagResource

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateDiscoverer")
    def to_update_discoverer(self) -> "Schemas":
        '''(experimental) Updates an existing discoverer in your account.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-discoverers-id-discovererid.html#UpdateDiscoverer

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toUpdateDiscoverer", []))

    @jsii.member(jsii_name="toUpdateRegistry")
    def to_update_registry(self) -> "Schemas":
        '''(experimental) Updates an existing registry metadata in your account.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-registries-name-registryname.html#UpdateRegistry

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toUpdateRegistry", []))

    @jsii.member(jsii_name="toUpdateSchema")
    def to_update_schema(self) -> "Schemas":
        '''(experimental) Updates an existing schema in your account.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-registries-name-registryname-schemas-name-schemaname.html#UpdateSchema

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toUpdateSchema", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Sdb(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Sdb"):
    '''(experimental) Statement provider for service `sdb <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsimpledb.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `sdb <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsimpledb.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Sdb, self, [sid])

    @jsii.member(jsii_name="onDomain")
    def on_domain(
        self,
        domain_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sdb":
        '''(experimental) Adds a resource of type domain to the statement.

        https://docs.aws.amazon.com/sdb/latest/APIReference/DataModel.html

        :param domain_name: - Identifier for the domainName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Sdb", jsii.invoke(self, "onDomain", [domain_name, account, region, partition]))

    @jsii.member(jsii_name="toBatchDeleteAttributes")
    def to_batch_delete_attributes(self) -> "Sdb":
        '''(experimental) Performs multiple DeleteAttributes operations in a single call, which reduces round trips and latencies.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonSimpleDB/latest/DeveloperGuide/API_BatchDeleteAttributes.html

        :stability: experimental
        '''
        return typing.cast("Sdb", jsii.invoke(self, "toBatchDeleteAttributes", []))

    @jsii.member(jsii_name="toBatchPutAttributes")
    def to_batch_put_attributes(self) -> "Sdb":
        '''(experimental) With the BatchPutAttributes operation, you can perform multiple PutAttribute operations in a single call.

        With the BatchPutAttributes operation, you can perform multiple PutAttribute operations in a single call.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonSimpleDB/latest/DeveloperGuide/API_BatchPutAttributes.html

        :stability: experimental
        '''
        return typing.cast("Sdb", jsii.invoke(self, "toBatchPutAttributes", []))

    @jsii.member(jsii_name="toCreateDomain")
    def to_create_domain(self) -> "Sdb":
        '''(experimental) The CreateDomain operation creates a new domain.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonSimpleDB/latest/DeveloperGuide/API_CreateDomain.html

        :stability: experimental
        '''
        return typing.cast("Sdb", jsii.invoke(self, "toCreateDomain", []))

    @jsii.member(jsii_name="toDeleteAttributes")
    def to_delete_attributes(self) -> "Sdb":
        '''(experimental) Deletes one or more attributes associated with the item.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonSimpleDB/latest/DeveloperGuide/API_DeleteAttributes.html

        :stability: experimental
        '''
        return typing.cast("Sdb", jsii.invoke(self, "toDeleteAttributes", []))

    @jsii.member(jsii_name="toDeleteDomain")
    def to_delete_domain(self) -> "Sdb":
        '''(experimental) The DeleteDomain operation deletes a domain.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonSimpleDB/latest/DeveloperGuide/API_DeleteDomain.html

        :stability: experimental
        '''
        return typing.cast("Sdb", jsii.invoke(self, "toDeleteDomain", []))

    @jsii.member(jsii_name="toDomainMetadata")
    def to_domain_metadata(self) -> "Sdb":
        '''(experimental) Returns information about the domain, including when the domain was created, the number of items and attributes, and the size of attribute names and values.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonSimpleDB/latest/DeveloperGuide/API_DomainMetadata.html

        :stability: experimental
        '''
        return typing.cast("Sdb", jsii.invoke(self, "toDomainMetadata", []))

    @jsii.member(jsii_name="toGetAttributes")
    def to_get_attributes(self) -> "Sdb":
        '''(experimental) Returns all of the attributes associated with the item.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonSimpleDB/latest/DeveloperGuide/API_GetAttributes.html

        :stability: experimental
        '''
        return typing.cast("Sdb", jsii.invoke(self, "toGetAttributes", []))

    @jsii.member(jsii_name="toListDomains")
    def to_list_domains(self) -> "Sdb":
        '''(experimental) Description for ListDomains.

        Access Level: List

        https://docs.aws.amazon.com/AmazonSimpleDB/latest/DeveloperGuide/API_ListDomains.html

        :stability: experimental
        '''
        return typing.cast("Sdb", jsii.invoke(self, "toListDomains", []))

    @jsii.member(jsii_name="toPutAttributes")
    def to_put_attributes(self) -> "Sdb":
        '''(experimental) The PutAttributes operation creates or replaces attributes in an item.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonSimpleDB/latest/DeveloperGuide/API_PutAttributes.html

        :stability: experimental
        '''
        return typing.cast("Sdb", jsii.invoke(self, "toPutAttributes", []))

    @jsii.member(jsii_name="toSelect")
    def to_select(self) -> "Sdb":
        '''(experimental) Description for Select.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonSimpleDB/latest/DeveloperGuide/API_Select.html

        :stability: experimental
        '''
        return typing.cast("Sdb", jsii.invoke(self, "toSelect", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Secretsmanager(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Secretsmanager",
):
    '''(experimental) Statement provider for service `secretsmanager <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssecretsmanager.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `secretsmanager <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssecretsmanager.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Secretsmanager, self, [sid])

    @jsii.member(jsii_name="ifBlockPublicPolicy")
    def if_block_public_policy(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Secretsmanager":
        '''(experimental) Filters access by whether the resource policy blocks broad AWS account access.

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-contextkeys

        Applies to actions:

        - .toPutResourcePolicy()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "ifBlockPublicPolicy", [value]))

    @jsii.member(jsii_name="ifDescription")
    def if_description(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Secretsmanager":
        '''(experimental) Filters access by the description text in the request.

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-contextkeys

        Applies to actions:

        - .toCreateSecret()
        - .toUpdateSecret()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "ifDescription", [value, operator]))

    @jsii.member(jsii_name="ifForceDeleteWithoutRecovery")
    def if_force_delete_without_recovery(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Secretsmanager":
        '''(experimental) Filters access by whether the secret is to be deleted immediately without any recovery window.

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-contextkeys

        Applies to actions:

        - .toDeleteSecret()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "ifForceDeleteWithoutRecovery", [value]))

    @jsii.member(jsii_name="ifKmsKeyId")
    def if_kms_key_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Secretsmanager":
        '''(experimental) Filters access by the ARN of the KMS key in the request.

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-contextkeys

        Applies to actions:

        - .toCreateSecret()
        - .toUpdateSecret()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "ifKmsKeyId", [value, operator]))

    @jsii.member(jsii_name="ifName")
    def if_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Secretsmanager":
        '''(experimental) Filters access by the friendly name of the secret in the request.

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-contextkeys

        Applies to actions:

        - .toCreateSecret()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "ifName", [value, operator]))

    @jsii.member(jsii_name="ifRecoveryWindowInDays")
    def if_recovery_window_in_days(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Secretsmanager":
        '''(experimental) Filters access by the number of days that Secrets Manager waits before it can delete the secret.

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-contextkeys

        Applies to actions:

        - .toDeleteSecret()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "ifRecoveryWindowInDays", [value, operator]))

    @jsii.member(jsii_name="ifResource")
    def if_resource(
        self,
        allow_rotation_lambda_arn: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Secretsmanager":
        '''(experimental) Filters access by the ARN of the rotation Lambda function associated with the secret.

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-contextkeys

        Applies to actions:

        - .toCancelRotateSecret()
        - .toDeleteResourcePolicy()
        - .toDeleteSecret()
        - .toDescribeSecret()
        - .toGetResourcePolicy()
        - .toGetSecretValue()
        - .toListSecretVersionIds()
        - .toPutResourcePolicy()
        - .toPutSecretValue()
        - .toRestoreSecret()
        - .toRotateSecret()
        - .toTagResource()
        - .toUntagResource()
        - .toUpdateSecret()
        - .toUpdateSecretVersionStage()
        - .toValidateResourcePolicy()

        Applies to resource types:

        - Secret

        :param allow_rotation_lambda_arn: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "ifResource", [allow_rotation_lambda_arn, value, operator]))

    @jsii.member(jsii_name="ifResourceTag")
    def if_resource_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Secretsmanager":
        '''(experimental) Filters access by a tag key and value pair.

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-contextkeys

        Applies to actions:

        - .toCancelRotateSecret()
        - .toCreateSecret()
        - .toDeleteResourcePolicy()
        - .toDeleteSecret()
        - .toDescribeSecret()
        - .toGetResourcePolicy()
        - .toGetSecretValue()
        - .toListSecretVersionIds()
        - .toPutResourcePolicy()
        - .toPutSecretValue()
        - .toRestoreSecret()
        - .toRotateSecret()
        - .toTagResource()
        - .toUntagResource()
        - .toUpdateSecret()
        - .toUpdateSecretVersionStage()
        - .toValidateResourcePolicy()

        Applies to resource types:

        - Secret

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "ifResourceTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifRotationLambdaARN")
    def if_rotation_lambda_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Secretsmanager":
        '''(experimental) Filters access by the ARN of the rotation Lambda function in the request.

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-contextkeys

        Applies to actions:

        - .toRotateSecret()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "ifRotationLambdaARN", [value, operator]))

    @jsii.member(jsii_name="ifSecretId")
    def if_secret_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Secretsmanager":
        '''(experimental) Filters access by the SecretID value in the request.

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-contextkeys

        Applies to actions:

        - .toCancelRotateSecret()
        - .toDeleteResourcePolicy()
        - .toDeleteSecret()
        - .toDescribeSecret()
        - .toGetResourcePolicy()
        - .toGetSecretValue()
        - .toListSecretVersionIds()
        - .toPutResourcePolicy()
        - .toPutSecretValue()
        - .toRestoreSecret()
        - .toRotateSecret()
        - .toTagResource()
        - .toUntagResource()
        - .toUpdateSecret()
        - .toUpdateSecretVersionStage()
        - .toValidateResourcePolicy()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "ifSecretId", [value, operator]))

    @jsii.member(jsii_name="ifVersionId")
    def if_version_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Secretsmanager":
        '''(experimental) Filters access by the unique identifier of the version of the secret in the request.

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-contextkeys

        Applies to actions:

        - .toGetSecretValue()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "ifVersionId", [value, operator]))

    @jsii.member(jsii_name="ifVersionStage")
    def if_version_stage(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Secretsmanager":
        '''(experimental) Filters access by the list of version stages in the request.

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-contextkeys

        Applies to actions:

        - .toGetSecretValue()
        - .toUpdateSecretVersionStage()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "ifVersionStage", [value, operator]))

    @jsii.member(jsii_name="onSecret")
    def on_secret(
        self,
        secret_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Secretsmanager":
        '''(experimental) Adds a resource of type Secret to the statement.

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-resources

        :param secret_id: - Identifier for the secretId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsTagKeys() - .ifResourceTag() - .ifResource()

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "onSecret", [secret_id, account, region, partition]))

    @jsii.member(jsii_name="toCancelRotateSecret")
    def to_cancel_rotate_secret(self) -> "Secretsmanager":
        '''(experimental) Enables the user to cancel an in-progress secret rotation.

        Access Level: Write

        Possible conditions:

        - .ifSecretId()
        - .ifResource()
        - .ifResourceTag()

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-actions

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toCancelRotateSecret", []))

    @jsii.member(jsii_name="toCreateSecret")
    def to_create_secret(self) -> "Secretsmanager":
        '''(experimental) Enables the user to create a secret that stores encrypted data that can be queried and rotated.

        Access Level: Write

        Possible conditions:

        - .ifName()
        - .ifDescription()
        - .ifKmsKeyId()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifResourceTag()

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-actions

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toCreateSecret", []))

    @jsii.member(jsii_name="toDeleteResourcePolicy")
    def to_delete_resource_policy(self) -> "Secretsmanager":
        '''(experimental) Enables the user to delete the resource policy attached to a secret.

        Access Level: Permissions management

        Possible conditions:

        - .ifSecretId()
        - .ifResource()
        - .ifResourceTag()

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-actions

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toDeleteResourcePolicy", []))

    @jsii.member(jsii_name="toDeleteSecret")
    def to_delete_secret(self) -> "Secretsmanager":
        '''(experimental) Enables the user to delete a secret.

        Access Level: Write

        Possible conditions:

        - .ifSecretId()
        - .ifResource()
        - .ifRecoveryWindowInDays()
        - .ifForceDeleteWithoutRecovery()
        - .ifResourceTag()

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-actions

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toDeleteSecret", []))

    @jsii.member(jsii_name="toDescribeSecret")
    def to_describe_secret(self) -> "Secretsmanager":
        '''(experimental) Enables the user to retrieve the metadata about a secret, but not the encrypted data.

        Access Level: Read

        Possible conditions:

        - .ifSecretId()
        - .ifResource()
        - .ifResourceTag()

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-actions

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toDescribeSecret", []))

    @jsii.member(jsii_name="toGetRandomPassword")
    def to_get_random_password(self) -> "Secretsmanager":
        '''(experimental) Enables the user to generate a random string for use in password creation.

        Access Level: Read

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-actions

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toGetRandomPassword", []))

    @jsii.member(jsii_name="toGetResourcePolicy")
    def to_get_resource_policy(self) -> "Secretsmanager":
        '''(experimental) Enables the user to get the resource policy attached to a secret.

        Access Level: Read

        Possible conditions:

        - .ifSecretId()
        - .ifResource()
        - .ifResourceTag()

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-actions

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toGetResourcePolicy", []))

    @jsii.member(jsii_name="toGetSecretValue")
    def to_get_secret_value(self) -> "Secretsmanager":
        '''(experimental) Enables the user to retrieve and decrypt the encrypted data.

        Access Level: Read

        Possible conditions:

        - .ifSecretId()
        - .ifVersionId()
        - .ifVersionStage()
        - .ifResource()
        - .ifResourceTag()

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-actions

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toGetSecretValue", []))

    @jsii.member(jsii_name="toListSecrets")
    def to_list_secrets(self) -> "Secretsmanager":
        '''(experimental) Enables the user to list the available secrets.

        Access Level: List

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-actions

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toListSecrets", []))

    @jsii.member(jsii_name="toListSecretVersionIds")
    def to_list_secret_version_ids(self) -> "Secretsmanager":
        '''(experimental) Enables the user to list the available versions of a secret.

        Access Level: Read

        Possible conditions:

        - .ifSecretId()
        - .ifResource()
        - .ifResourceTag()

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-actions

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toListSecretVersionIds", []))

    @jsii.member(jsii_name="toPutResourcePolicy")
    def to_put_resource_policy(self) -> "Secretsmanager":
        '''(experimental) Enables the user to attach a resource policy to a secret.

        Access Level: Permissions management

        Possible conditions:

        - .ifSecretId()
        - .ifResource()
        - .ifResourceTag()
        - .ifBlockPublicPolicy()

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-actions

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toPutResourcePolicy", []))

    @jsii.member(jsii_name="toPutSecretValue")
    def to_put_secret_value(self) -> "Secretsmanager":
        '''(experimental) Enables the user to create a new version of the secret with new encrypted data.

        Access Level: Write

        Possible conditions:

        - .ifSecretId()
        - .ifResource()
        - .ifResourceTag()

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-actions

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toPutSecretValue", []))

    @jsii.member(jsii_name="toRestoreSecret")
    def to_restore_secret(self) -> "Secretsmanager":
        '''(experimental) Enables the user to cancel deletion of a secret.

        Access Level: Write

        Possible conditions:

        - .ifSecretId()
        - .ifResource()
        - .ifResourceTag()

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-actions

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toRestoreSecret", []))

    @jsii.member(jsii_name="toRotateSecret")
    def to_rotate_secret(self) -> "Secretsmanager":
        '''(experimental) Enables the user to start rotation of a secret.

        Access Level: Write

        Possible conditions:

        - .ifSecretId()
        - .ifRotationLambdaARN()
        - .ifResource()
        - .ifResourceTag()

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-actions

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toRotateSecret", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Secretsmanager":
        '''(experimental) Enables the user to add tags to a secret.

        Access Level: Tagging

        Possible conditions:

        - .ifSecretId()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifResource()
        - .ifResourceTag()

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-actions

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Secretsmanager":
        '''(experimental) Enables the user to remove tags from a secret.

        Access Level: Tagging

        Possible conditions:

        - .ifSecretId()
        - .ifAwsTagKeys()
        - .ifResource()
        - .ifResourceTag()

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-actions

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateSecret")
    def to_update_secret(self) -> "Secretsmanager":
        '''(experimental) Enables the user to update a secret with new metadata or with a new version of the encrypted data.

        Access Level: Write

        Possible conditions:

        - .ifSecretId()
        - .ifDescription()
        - .ifKmsKeyId()
        - .ifResource()
        - .ifResourceTag()

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-actions

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toUpdateSecret", []))

    @jsii.member(jsii_name="toUpdateSecretVersionStage")
    def to_update_secret_version_stage(self) -> "Secretsmanager":
        '''(experimental) Enables the user to move a stage from one secret to another.

        Access Level: Write

        Possible conditions:

        - .ifSecretId()
        - .ifVersionStage()
        - .ifResource()
        - .ifResourceTag()

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-actions

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toUpdateSecretVersionStage", []))

    @jsii.member(jsii_name="toValidateResourcePolicy")
    def to_validate_resource_policy(self) -> "Secretsmanager":
        '''(experimental) Enables the user to validate a resource policy before attaching policy.

        Access Level: Permissions management

        Possible conditions:

        - .ifSecretId()
        - .ifResource()
        - .ifResourceTag()

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-actions

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toValidateResourcePolicy", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Securityhub(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Securityhub",
):
    '''(experimental) Statement provider for service `securityhub <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssecurityhub.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `securityhub <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssecurityhub.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Securityhub, self, [sid])

    @jsii.member(jsii_name="ifASFFSyntaxPath")
    def if_asff_syntax_path(
        self,
        a_sff_syntax_path: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Securityhub":
        '''(experimental) Filters access based on the presence of specific fields and values in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-asffsyntaxpath

        Applies to actions:

        - .toBatchUpdateFindings()

        :param a_sff_syntax_path: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "ifASFFSyntaxPath", [a_sff_syntax_path, value, operator]))

    @jsii.member(jsii_name="ifTargetAccount")
    def if_target_account(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Securityhub":
        '''(experimental) Filters access based on the presence of AwsAccountId field in the requests.

        https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-access.html#conditions

        Applies to actions:

        - .toBatchImportFindings()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "ifTargetAccount", [value, operator]))

    @jsii.member(jsii_name="onHub")
    def on_hub(
        self,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Securityhub":
        '''(experimental) Adds a resource of type hub to the statement.

        https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-access.html#resources

        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "onHub", [account, region, partition]))

    @jsii.member(jsii_name="onProduct")
    def on_product(
        self,
        company: builtins.str,
        product_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Securityhub":
        '''(experimental) Adds a resource of type product to the statement.

        https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-access.html#resources

        :param company: - Identifier for the company.
        :param product_id: - Identifier for the productId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "onProduct", [company, product_id, account, region, partition]))

    @jsii.member(jsii_name="toAcceptInvitation")
    def to_accept_invitation(self) -> "Securityhub":
        '''(experimental) Grants permission to accept Security Hub invitations to become a member account.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AcceptInvitation.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toAcceptInvitation", []))

    @jsii.member(jsii_name="toBatchDisableStandards")
    def to_batch_disable_standards(self) -> "Securityhub":
        '''(experimental) Grants permission to disable standards in Security Hub.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_BatchDisableStandards.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toBatchDisableStandards", []))

    @jsii.member(jsii_name="toBatchEnableStandards")
    def to_batch_enable_standards(self) -> "Securityhub":
        '''(experimental) Grants permission to enable standards in Security Hub.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_BatchEnableStandards.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toBatchEnableStandards", []))

    @jsii.member(jsii_name="toBatchImportFindings")
    def to_batch_import_findings(self) -> "Securityhub":
        '''(experimental) Grants permission to import findings into Security Hub from an integrated product.

        Access Level: Write

        Possible conditions:

        - .ifTargetAccount()

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_BatchImportFindings.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toBatchImportFindings", []))

    @jsii.member(jsii_name="toBatchUpdateFindings")
    def to_batch_update_findings(self) -> "Securityhub":
        '''(experimental) Grants permission to update customer-controlled fields for a selected set of Security Hub findings.

        Access Level: Write

        Possible conditions:

        - .ifASFFSyntaxPath()

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_BatchUpdateFindings.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toBatchUpdateFindings", []))

    @jsii.member(jsii_name="toCreateActionTarget")
    def to_create_action_target(self) -> "Securityhub":
        '''(experimental) Grants permission to create custom actions in Security Hub.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_CreateActionTarget.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toCreateActionTarget", []))

    @jsii.member(jsii_name="toCreateInsight")
    def to_create_insight(self) -> "Securityhub":
        '''(experimental) Grants permission to create insights in Security Hub. Insights are collections of related findings.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_CreateInsight.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toCreateInsight", []))

    @jsii.member(jsii_name="toCreateMembers")
    def to_create_members(self) -> "Securityhub":
        '''(experimental) Grants permission to create member accounts in Security Hub.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_CreateMembers.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toCreateMembers", []))

    @jsii.member(jsii_name="toDeclineInvitations")
    def to_decline_invitations(self) -> "Securityhub":
        '''(experimental) Grants permission to decline Security Hub invitations to become a member account.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DeclineInvitations.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toDeclineInvitations", []))

    @jsii.member(jsii_name="toDeleteActionTarget")
    def to_delete_action_target(self) -> "Securityhub":
        '''(experimental) Grants permission to delete custom actions in Security Hub.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DeleteActionTarget.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toDeleteActionTarget", []))

    @jsii.member(jsii_name="toDeleteInsight")
    def to_delete_insight(self) -> "Securityhub":
        '''(experimental) Grants permission to delete insights from Security Hub.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DeleteInsight.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toDeleteInsight", []))

    @jsii.member(jsii_name="toDeleteInvitations")
    def to_delete_invitations(self) -> "Securityhub":
        '''(experimental) Grants permission to delete Security Hub invitations to become a member account.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DeleteInvitations.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toDeleteInvitations", []))

    @jsii.member(jsii_name="toDeleteMembers")
    def to_delete_members(self) -> "Securityhub":
        '''(experimental) Grants permission to delete Security Hub member accounts.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DeleteMembers.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toDeleteMembers", []))

    @jsii.member(jsii_name="toDescribeActionTargets")
    def to_describe_action_targets(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve a list of custom actions using the API.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DescribeActionTargets.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toDescribeActionTargets", []))

    @jsii.member(jsii_name="toDescribeHub")
    def to_describe_hub(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve information about the hub resource in your account.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DescribeHub.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toDescribeHub", []))

    @jsii.member(jsii_name="toDescribeOrganizationConfiguration")
    def to_describe_organization_configuration(self) -> "Securityhub":
        '''(experimental) Grants permission to describe the organization configuration for Security Hub.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DescribeOrganizationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toDescribeOrganizationConfiguration", []))

    @jsii.member(jsii_name="toDescribeProducts")
    def to_describe_products(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve information about the available Security Hub product integrations.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DescribeProducts.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toDescribeProducts", []))

    @jsii.member(jsii_name="toDescribeStandards")
    def to_describe_standards(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve information about Security Hub standards.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DescribeStandards.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toDescribeStandards", []))

    @jsii.member(jsii_name="toDescribeStandardsControls")
    def to_describe_standards_controls(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve information about Security Hub standards controls.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DescribeStandardsControls.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toDescribeStandardsControls", []))

    @jsii.member(jsii_name="toDisableImportFindingsForProduct")
    def to_disable_import_findings_for_product(self) -> "Securityhub":
        '''(experimental) Grants permission to disable the findings importing for a Security Hub integrated product.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DisableImportFindingsForProduct.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toDisableImportFindingsForProduct", []))

    @jsii.member(jsii_name="toDisableOrganizationAdminAccount")
    def to_disable_organization_admin_account(self) -> "Securityhub":
        '''(experimental) Grants permission to remove the Security Hub administrator account for your organization.

        Access Level: Write

        Dependent actions:

        - organizations:DescribeOrganization

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DisableOrganizationAdminAccount.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toDisableOrganizationAdminAccount", []))

    @jsii.member(jsii_name="toDisableSecurityHub")
    def to_disable_security_hub(self) -> "Securityhub":
        '''(experimental) Grants permission to disable Security Hub.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DisableSecurityHub.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toDisableSecurityHub", []))

    @jsii.member(jsii_name="toDisassociateFromMasterAccount")
    def to_disassociate_from_master_account(self) -> "Securityhub":
        '''(experimental) Grants permission to a Security Hub member account to disassociate from the associated master account.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DisassociateFromMasterAccount.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toDisassociateFromMasterAccount", []))

    @jsii.member(jsii_name="toDisassociateMembers")
    def to_disassociate_members(self) -> "Securityhub":
        '''(experimental) Grants permission to disassociate Security Hub member accounts from the associated master account.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DisassociateMembers.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toDisassociateMembers", []))

    @jsii.member(jsii_name="toEnableImportFindingsForProduct")
    def to_enable_import_findings_for_product(self) -> "Securityhub":
        '''(experimental) Grants permission to enable the findings importing for a Security Hub integrated product.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_EnableImportFindingsForProduct.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toEnableImportFindingsForProduct", []))

    @jsii.member(jsii_name="toEnableOrganizationAdminAccount")
    def to_enable_organization_admin_account(self) -> "Securityhub":
        '''(experimental) Grants permission to designate a Security Hub administrator account for your organization.

        Access Level: Write

        Dependent actions:

        - organizations:DescribeOrganization
        - organizations:EnableAWSServiceAccess
        - organizations:RegisterDelegatedAdministrator

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_EnableOrganizationAdminAccount.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toEnableOrganizationAdminAccount", []))

    @jsii.member(jsii_name="toEnableSecurityHub")
    def to_enable_security_hub(self) -> "Securityhub":
        '''(experimental) Grants permission to enable Security Hub.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_EnableSecurityHub.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toEnableSecurityHub", []))

    @jsii.member(jsii_name="toGetAdhocInsightResults")
    def to_get_adhoc_insight_results(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve insight results by providing a set of filters instead of an insight ARN.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetAdhocInsightResults.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toGetAdhocInsightResults", []))

    @jsii.member(jsii_name="toGetEnabledStandards")
    def to_get_enabled_standards(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve a list of the standards that are enabled in Security Hub.

        Access Level: List

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetEnabledStandards.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toGetEnabledStandards", []))

    @jsii.member(jsii_name="toGetFindings")
    def to_get_findings(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve a list of findings from Security Hub.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetFindings.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toGetFindings", []))

    @jsii.member(jsii_name="toGetFreeTrialEndDate")
    def to_get_free_trial_end_date(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve the end date for an account's free trial of Security Hub.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetFreeTrialEndDate.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toGetFreeTrialEndDate", []))

    @jsii.member(jsii_name="toGetFreeTrialUsage")
    def to_get_free_trial_usage(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve information about Security Hub usage during the free trial period.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetFreeTrialUsage.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toGetFreeTrialUsage", []))

    @jsii.member(jsii_name="toGetInsightFindingTrend")
    def to_get_insight_finding_trend(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve an insight finding trend from Security Hub in order to generate a graph.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetInsightFindingTrend.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toGetInsightFindingTrend", []))

    @jsii.member(jsii_name="toGetInsightResults")
    def to_get_insight_results(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve insight results from Security Hub.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetInsightResults.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toGetInsightResults", []))

    @jsii.member(jsii_name="toGetInsights")
    def to_get_insights(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve Security Hub insights.

        Access Level: List

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetInsights.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toGetInsights", []))

    @jsii.member(jsii_name="toGetInvitationsCount")
    def to_get_invitations_count(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve the count of Security Hub membership invitations sent to the account.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetInvitationsCount.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toGetInvitationsCount", []))

    @jsii.member(jsii_name="toGetMasterAccount")
    def to_get_master_account(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve details about the Security Hub master account.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetMasterAccount.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toGetMasterAccount", []))

    @jsii.member(jsii_name="toGetMembers")
    def to_get_members(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve the details of Security Hub member accounts.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetMembers.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toGetMembers", []))

    @jsii.member(jsii_name="toGetUsage")
    def to_get_usage(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve information about Security Hub usage by accounts.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetUsage.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toGetUsage", []))

    @jsii.member(jsii_name="toInviteMembers")
    def to_invite_members(self) -> "Securityhub":
        '''(experimental) Grants permission to invite other AWS accounts to become Security Hub member accounts.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_InviteMembers.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toInviteMembers", []))

    @jsii.member(jsii_name="toListEnabledProductsForImport")
    def to_list_enabled_products_for_import(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve the Security Hub integrated products that are currently enabled.

        Access Level: List

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_ListEnabledProductsForImport.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toListEnabledProductsForImport", []))

    @jsii.member(jsii_name="toListInvitations")
    def to_list_invitations(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve the Security Hub invitations sent to the account.

        Access Level: List

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_ListInvitations.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toListInvitations", []))

    @jsii.member(jsii_name="toListMembers")
    def to_list_members(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve details about Security Hub member accounts associated with the master account.

        Access Level: List

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_ListMembers.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toListMembers", []))

    @jsii.member(jsii_name="toListOrganizationAdminAccounts")
    def to_list_organization_admin_accounts(self) -> "Securityhub":
        '''(experimental) Grants permission to list the Security Hub administrator accounts for your organization.

        Access Level: List

        Dependent actions:

        - organizations:DescribeOrganization

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_ListOrganizationAdminAccounts.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toListOrganizationAdminAccounts", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Securityhub":
        '''(experimental) Grants permission to list of tags associated with a resource.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toSendFindingEvents")
    def to_send_finding_events(self) -> "Securityhub":
        '''(experimental) Grants permission to use a custom action to send Security Hub findings to Amazon EventBridge.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_SendFindingEvents.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toSendFindingEvents", []))

    @jsii.member(jsii_name="toSendInsightEvents")
    def to_send_insight_events(self) -> "Securityhub":
        '''(experimental) Grants permission to use a custom action to send Security Hub insights to Amazon EventBridge.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_SendInsightEvents.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toSendInsightEvents", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Securityhub":
        '''(experimental) Grants permission to add tags to a Security Hub resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Securityhub":
        '''(experimental) Grants permission to remove tags from a Security Hub resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateActionTarget")
    def to_update_action_target(self) -> "Securityhub":
        '''(experimental) Grants permission to update custom actions in Security Hub.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_UpdateActionTarget.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toUpdateActionTarget", []))

    @jsii.member(jsii_name="toUpdateFindings")
    def to_update_findings(self) -> "Securityhub":
        '''(experimental) Grants permission to update Security Hub findings.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_UpdateFindings.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toUpdateFindings", []))

    @jsii.member(jsii_name="toUpdateInsight")
    def to_update_insight(self) -> "Securityhub":
        '''(experimental) Grants permission to update insights in Security Hub.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_UpdateInsight.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toUpdateInsight", []))

    @jsii.member(jsii_name="toUpdateOrganizationConfiguration")
    def to_update_organization_configuration(self) -> "Securityhub":
        '''(experimental) Grants permission to update the organization configuration for Security Hub.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_UpdateOrganizationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toUpdateOrganizationConfiguration", []))

    @jsii.member(jsii_name="toUpdateSecurityHubConfiguration")
    def to_update_security_hub_configuration(self) -> "Securityhub":
        '''(experimental) Grants permission to update Security Hub configuration.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_UpdateSecurityHubConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toUpdateSecurityHubConfiguration", []))

    @jsii.member(jsii_name="toUpdateStandardsControl")
    def to_update_standards_control(self) -> "Securityhub":
        '''(experimental) Grants permission to update Security Hub standards controls.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_UpdateStandardsControl.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toUpdateStandardsControl", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Serverlessrepo(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Serverlessrepo",
):
    '''(experimental) Statement provider for service `serverlessrepo <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsserverlessapplicationrepository.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `serverlessrepo <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsserverlessapplicationrepository.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Serverlessrepo, self, [sid])

    @jsii.member(jsii_name="ifApplicationType")
    def if_application_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Serverlessrepo":
        '''(experimental) Application type.

        Applies to actions:

        - .toCreateCloudFormationChangeSet()
        - .toCreateCloudFormationTemplate()
        - .toGetApplication()
        - .toListApplicationDependencies()
        - .toListApplicationVersions()
        - .toSearchApplications()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Serverlessrepo", jsii.invoke(self, "ifApplicationType", [value, operator]))

    @jsii.member(jsii_name="onApplications")
    def on_applications(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Serverlessrepo":
        '''(experimental) Adds a resource of type applications to the statement.

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Serverlessrepo", jsii.invoke(self, "onApplications", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateApplication")
    def to_create_application(self) -> "Serverlessrepo":
        '''(experimental) Creates an application, optionally including an AWS SAM file to create the first application version in the same call.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Serverlessrepo", jsii.invoke(self, "toCreateApplication", []))

    @jsii.member(jsii_name="toCreateApplicationVersion")
    def to_create_application_version(self) -> "Serverlessrepo":
        '''(experimental) Creates an application version.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Serverlessrepo", jsii.invoke(self, "toCreateApplicationVersion", []))

    @jsii.member(jsii_name="toCreateCloudFormationChangeSet")
    def to_create_cloud_formation_change_set(self) -> "Serverlessrepo":
        '''(experimental) Creates an AWS CloudFormation ChangeSet for the given application.

        Access Level: Write

        Possible conditions:

        - .ifApplicationType()

        :stability: experimental
        '''
        return typing.cast("Serverlessrepo", jsii.invoke(self, "toCreateCloudFormationChangeSet", []))

    @jsii.member(jsii_name="toCreateCloudFormationTemplate")
    def to_create_cloud_formation_template(self) -> "Serverlessrepo":
        '''(experimental) Creates an AWS CloudFormation template.

        Access Level: Write

        Possible conditions:

        - .ifApplicationType()

        :stability: experimental
        '''
        return typing.cast("Serverlessrepo", jsii.invoke(self, "toCreateCloudFormationTemplate", []))

    @jsii.member(jsii_name="toDeleteApplication")
    def to_delete_application(self) -> "Serverlessrepo":
        '''(experimental) Deletes the specified application.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Serverlessrepo", jsii.invoke(self, "toDeleteApplication", []))

    @jsii.member(jsii_name="toGetApplication")
    def to_get_application(self) -> "Serverlessrepo":
        '''(experimental) Gets the specified application.

        Access Level: Read

        Possible conditions:

        - .ifApplicationType()

        :stability: experimental
        '''
        return typing.cast("Serverlessrepo", jsii.invoke(self, "toGetApplication", []))

    @jsii.member(jsii_name="toGetApplicationPolicy")
    def to_get_application_policy(self) -> "Serverlessrepo":
        '''(experimental) Gets the policy for the specified application.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Serverlessrepo", jsii.invoke(self, "toGetApplicationPolicy", []))

    @jsii.member(jsii_name="toGetCloudFormationTemplate")
    def to_get_cloud_formation_template(self) -> "Serverlessrepo":
        '''(experimental) Gets the specified AWS CloudFormation template.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Serverlessrepo", jsii.invoke(self, "toGetCloudFormationTemplate", []))

    @jsii.member(jsii_name="toListApplicationDependencies")
    def to_list_application_dependencies(self) -> "Serverlessrepo":
        '''(experimental) Retrieves the list of applications nested in the containing application.

        Access Level: List

        Possible conditions:

        - .ifApplicationType()

        :stability: experimental
        '''
        return typing.cast("Serverlessrepo", jsii.invoke(self, "toListApplicationDependencies", []))

    @jsii.member(jsii_name="toListApplications")
    def to_list_applications(self) -> "Serverlessrepo":
        '''(experimental) Lists applications owned by the requester.

        Access Level: List

        :stability: experimental
        '''
        return typing.cast("Serverlessrepo", jsii.invoke(self, "toListApplications", []))

    @jsii.member(jsii_name="toListApplicationVersions")
    def to_list_application_versions(self) -> "Serverlessrepo":
        '''(experimental) Lists versions for the specified application owned by the requester.

        Access Level: List

        Possible conditions:

        - .ifApplicationType()

        :stability: experimental
        '''
        return typing.cast("Serverlessrepo", jsii.invoke(self, "toListApplicationVersions", []))

    @jsii.member(jsii_name="toPutApplicationPolicy")
    def to_put_application_policy(self) -> "Serverlessrepo":
        '''(experimental) Puts the policy for the specified application.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Serverlessrepo", jsii.invoke(self, "toPutApplicationPolicy", []))

    @jsii.member(jsii_name="toSearchApplications")
    def to_search_applications(self) -> "Serverlessrepo":
        '''(experimental) Gets all applications authorized for this user.

        Access Level: Read

        Possible conditions:

        - .ifApplicationType()

        :stability: experimental
        '''
        return typing.cast("Serverlessrepo", jsii.invoke(self, "toSearchApplications", []))

    @jsii.member(jsii_name="toUnshareApplication")
    def to_unshare_application(self) -> "Serverlessrepo":
        '''(experimental) Unshares the specified application.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Serverlessrepo", jsii.invoke(self, "toUnshareApplication", []))

    @jsii.member(jsii_name="toUpdateApplication")
    def to_update_application(self) -> "Serverlessrepo":
        '''(experimental) Updates meta-data of the application.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Serverlessrepo", jsii.invoke(self, "toUpdateApplication", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Servicecatalog(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Servicecatalog",
):
    '''(experimental) Statement provider for service `servicecatalog <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsservicecatalog.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `servicecatalog <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsservicecatalog.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Servicecatalog, self, [sid])

    @jsii.member(jsii_name="ifAccountLevel")
    def if_account_level(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Servicecatalog":
        '''(experimental) Filters users to see and perform actions on resources created by anyone in the account.

        https://docs.aws.amazon.com/servicecatalog/latest/adminguide/permissions-examples.html

        Applies to actions:

        - .toDescribeRecord()
        - .toListRecordHistory()
        - .toScanProvisionedProducts()
        - .toSearchProvisionedProducts()
        - .toTerminateProvisionedProduct()
        - .toUpdateProvisionedProduct()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "ifAccountLevel", [value, operator]))

    @jsii.member(jsii_name="ifRoleLevel")
    def if_role_level(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Servicecatalog":
        '''(experimental) Filters users to see and perform actions on resources created either by them or by anyone federating into the same role as them.

        https://docs.aws.amazon.com/servicecatalog/latest/adminguide/permissions-examples.html

        Applies to actions:

        - .toDescribeRecord()
        - .toListRecordHistory()
        - .toScanProvisionedProducts()
        - .toSearchProvisionedProducts()
        - .toTerminateProvisionedProduct()
        - .toUpdateProvisionedProduct()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "ifRoleLevel", [value, operator]))

    @jsii.member(jsii_name="ifUserLevel")
    def if_user_level(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Servicecatalog":
        '''(experimental) Filters users to see and perform actions on only resources that they created.

        https://docs.aws.amazon.com/servicecatalog/latest/adminguide/permissions-examples.html

        Applies to actions:

        - .toDescribeRecord()
        - .toListRecordHistory()
        - .toScanProvisionedProducts()
        - .toSearchProvisionedProducts()
        - .toTerminateProvisionedProduct()
        - .toUpdateProvisionedProduct()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "ifUserLevel", [value, operator]))

    @jsii.member(jsii_name="onApplication")
    def on_application(
        self,
        application_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Servicecatalog":
        '''(experimental) Adds a resource of type Application to the statement.

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_CreateApplication.html

        :param application_id: - Identifier for the applicationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "onApplication", [application_id, account, region, partition]))

    @jsii.member(jsii_name="onAttributeGroup")
    def on_attribute_group(
        self,
        attribute_group_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Servicecatalog":
        '''(experimental) Adds a resource of type AttributeGroup to the statement.

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_CreateAttributeGroup.html

        :param attribute_group_id: - Identifier for the attributeGroupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "onAttributeGroup", [attribute_group_id, account, region, partition]))

    @jsii.member(jsii_name="onPortfolio")
    def on_portfolio(
        self,
        portfolio_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Servicecatalog":
        '''(experimental) Adds a resource of type Portfolio to the statement.

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_PortfolioDetail.html

        :param portfolio_id: - Identifier for the portfolioId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "onPortfolio", [portfolio_id, account, region, partition]))

    @jsii.member(jsii_name="onProduct")
    def on_product(
        self,
        product_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Servicecatalog":
        '''(experimental) Adds a resource of type Product to the statement.

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ProductViewDetail.html

        :param product_id: - Identifier for the productId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "onProduct", [product_id, account, region, partition]))

    @jsii.member(jsii_name="toAcceptPortfolioShare")
    def to_accept_portfolio_share(self) -> "Servicecatalog":
        '''(experimental) Grants permission to accept a portfolio that has been shared with you.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_AcceptPortfolioShare.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toAcceptPortfolioShare", []))

    @jsii.member(jsii_name="toAssociateAttributeGroup")
    def to_associate_attribute_group(self) -> "Servicecatalog":
        '''(experimental) Grants permission to associate an attribute group with an application.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_AssociateAttributeGroup.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toAssociateAttributeGroup", []))

    @jsii.member(jsii_name="toAssociateBudgetWithResource")
    def to_associate_budget_with_resource(self) -> "Servicecatalog":
        '''(experimental) Grants permission to associate a budget with a resource.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_AssociateBudgetWithResource.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toAssociateBudgetWithResource", []))

    @jsii.member(jsii_name="toAssociatePrincipalWithPortfolio")
    def to_associate_principal_with_portfolio(self) -> "Servicecatalog":
        '''(experimental) Grants permission to associate an IAM principal with a portfolio, giving the specified principal access to any products associated with the specified portfolio.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_AssociatePrincipalWithPortfolio.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toAssociatePrincipalWithPortfolio", []))

    @jsii.member(jsii_name="toAssociateProductWithPortfolio")
    def to_associate_product_with_portfolio(self) -> "Servicecatalog":
        '''(experimental) Grants permission to associate a product with a portfolio.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_AssociateProductWithPortfolio.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toAssociateProductWithPortfolio", []))

    @jsii.member(jsii_name="toAssociateResource")
    def to_associate_resource(self) -> "Servicecatalog":
        '''(experimental) Grants permission to associate a resource with an application.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_AssociateResource.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toAssociateResource", []))

    @jsii.member(jsii_name="toAssociateServiceActionWithProvisioningArtifact")
    def to_associate_service_action_with_provisioning_artifact(
        self,
    ) -> "Servicecatalog":
        '''(experimental) Grants permission to associate an action with a provisioning artifact.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_AssociateServiceActionWithProvisioningArtifact.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toAssociateServiceActionWithProvisioningArtifact", []))

    @jsii.member(jsii_name="toAssociateTagOptionWithResource")
    def to_associate_tag_option_with_resource(self) -> "Servicecatalog":
        '''(experimental) Grants permission to associate the specified TagOption with the specified portfolio or product.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_AssociateTagOptionWithResource.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toAssociateTagOptionWithResource", []))

    @jsii.member(jsii_name="toBatchAssociateServiceActionWithProvisioningArtifact")
    def to_batch_associate_service_action_with_provisioning_artifact(
        self,
    ) -> "Servicecatalog":
        '''(experimental) Grants permission to associate multiple self-service actions with provisioning artifacts.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_BatchAssociateServiceActionWithProvisioningArtifact.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toBatchAssociateServiceActionWithProvisioningArtifact", []))

    @jsii.member(jsii_name="toBatchDisassociateServiceActionFromProvisioningArtifact")
    def to_batch_disassociate_service_action_from_provisioning_artifact(
        self,
    ) -> "Servicecatalog":
        '''(experimental) Grants permission to disassociate a batch of self-service actions from the specified provisioning artifact.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_BatchDisassociateServiceActionFromProvisioningArtifact.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toBatchDisassociateServiceActionFromProvisioningArtifact", []))

    @jsii.member(jsii_name="toCopyProduct")
    def to_copy_product(self) -> "Servicecatalog":
        '''(experimental) Grants permission to copy the specified source product to the specified target product or a new product.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_CopyProduct.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toCopyProduct", []))

    @jsii.member(jsii_name="toCreateApplication")
    def to_create_application(self) -> "Servicecatalog":
        '''(experimental) Grants permission to create an application.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_CreateApplication.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toCreateApplication", []))

    @jsii.member(jsii_name="toCreateAttributeGroup")
    def to_create_attribute_group(self) -> "Servicecatalog":
        '''(experimental) Grants permission to create an attribute group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_CreateAttributeGroup.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toCreateAttributeGroup", []))

    @jsii.member(jsii_name="toCreateConstraint")
    def to_create_constraint(self) -> "Servicecatalog":
        '''(experimental) Grants permission to create a constraint on an associated product and portfolio.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_CreateConstraint.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toCreateConstraint", []))

    @jsii.member(jsii_name="toCreatePortfolio")
    def to_create_portfolio(self) -> "Servicecatalog":
        '''(experimental) Grants permission to create a portfolio.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_CreatePortfolio.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toCreatePortfolio", []))

    @jsii.member(jsii_name="toCreatePortfolioShare")
    def to_create_portfolio_share(self) -> "Servicecatalog":
        '''(experimental) Grants permission to share a portfolio you own with another AWS account.

        Access Level: Permissions management

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_CreatePortfolioShare.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toCreatePortfolioShare", []))

    @jsii.member(jsii_name="toCreateProduct")
    def to_create_product(self) -> "Servicecatalog":
        '''(experimental) Grants permission to create a product and that product's first provisioning artifact.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_CreateProduct.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toCreateProduct", []))

    @jsii.member(jsii_name="toCreateProvisionedProductPlan")
    def to_create_provisioned_product_plan(self) -> "Servicecatalog":
        '''(experimental) Grants permission to add a new provisioned product plan.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_CreateProvisionedProductPlan.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toCreateProvisionedProductPlan", []))

    @jsii.member(jsii_name="toCreateProvisioningArtifact")
    def to_create_provisioning_artifact(self) -> "Servicecatalog":
        '''(experimental) Grants permission to add a new provisioning artifact to an existing product.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_CreateProvisioningArtifact.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toCreateProvisioningArtifact", []))

    @jsii.member(jsii_name="toCreateServiceAction")
    def to_create_service_action(self) -> "Servicecatalog":
        '''(experimental) Grants permission to create a self-service action.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_CreateServiceAction.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toCreateServiceAction", []))

    @jsii.member(jsii_name="toCreateTagOption")
    def to_create_tag_option(self) -> "Servicecatalog":
        '''(experimental) Grants permission to create a TagOption.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_CreateTagOption.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toCreateTagOption", []))

    @jsii.member(jsii_name="toDeleteApplication")
    def to_delete_application(self) -> "Servicecatalog":
        '''(experimental) Grants permission to delete an application if all associations have been removed from the application.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_DeleteApplication.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDeleteApplication", []))

    @jsii.member(jsii_name="toDeleteAttributeGroup")
    def to_delete_attribute_group(self) -> "Servicecatalog":
        '''(experimental) Grants permission to delete an attribute group if all associations have been removed from the attribute group.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_DeleteAttributeGroup.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDeleteAttributeGroup", []))

    @jsii.member(jsii_name="toDeleteConstraint")
    def to_delete_constraint(self) -> "Servicecatalog":
        '''(experimental) Grants permission to remove and delete an existing constraint from an associated product and portfolio.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DeleteConstraint.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDeleteConstraint", []))

    @jsii.member(jsii_name="toDeletePortfolio")
    def to_delete_portfolio(self) -> "Servicecatalog":
        '''(experimental) Grants permission to delete a portfolio if all associations and shares have been removed from the portfolio.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DeletePortfolio.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDeletePortfolio", []))

    @jsii.member(jsii_name="toDeletePortfolioShare")
    def to_delete_portfolio_share(self) -> "Servicecatalog":
        '''(experimental) Grants permission to unshare a portfolio you own from an AWS account you previously shared the portfolio with.

        Access Level: Permissions management

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DeletePortfolioShare.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDeletePortfolioShare", []))

    @jsii.member(jsii_name="toDeleteProduct")
    def to_delete_product(self) -> "Servicecatalog":
        '''(experimental) Grants permission to delete a product if all associations have been removed from the product.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DeleteProduct.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDeleteProduct", []))

    @jsii.member(jsii_name="toDeleteProvisionedProductPlan")
    def to_delete_provisioned_product_plan(self) -> "Servicecatalog":
        '''(experimental) Grants permission to delete a provisioned product plan.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DeleteProvisionedProductPlan.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDeleteProvisionedProductPlan", []))

    @jsii.member(jsii_name="toDeleteProvisioningArtifact")
    def to_delete_provisioning_artifact(self) -> "Servicecatalog":
        '''(experimental) Grants permission to delete a provisioning artifact from a product.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DeleteProvisioningArtifact.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDeleteProvisioningArtifact", []))

    @jsii.member(jsii_name="toDeleteServiceAction")
    def to_delete_service_action(self) -> "Servicecatalog":
        '''(experimental) Grants permission to delete a self-service action.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DeleteServiceAction.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDeleteServiceAction", []))

    @jsii.member(jsii_name="toDeleteTagOption")
    def to_delete_tag_option(self) -> "Servicecatalog":
        '''(experimental) Grants permission to delete the specified TagOption.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DeleteTagOption.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDeleteTagOption", []))

    @jsii.member(jsii_name="toDescribeConstraint")
    def to_describe_constraint(self) -> "Servicecatalog":
        '''(experimental) Grants permission to describe a constraint.

        Access Level: Read

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DescribeConstraint.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDescribeConstraint", []))

    @jsii.member(jsii_name="toDescribeCopyProductStatus")
    def to_describe_copy_product_status(self) -> "Servicecatalog":
        '''(experimental) Grants permission to get the status of the specified copy product operation.

        Access Level: Read

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DescribeCopyProductStatus.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDescribeCopyProductStatus", []))

    @jsii.member(jsii_name="toDescribePortfolio")
    def to_describe_portfolio(self) -> "Servicecatalog":
        '''(experimental) Grants permission to describe a portfolio.

        Access Level: Read

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DescribePortfolio.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDescribePortfolio", []))

    @jsii.member(jsii_name="toDescribePortfolioShareStatus")
    def to_describe_portfolio_share_status(self) -> "Servicecatalog":
        '''(experimental) Grants permission to get the status of the specified portfolio share operation.

        Access Level: Read

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DescribePortfolioShareStatus.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDescribePortfolioShareStatus", []))

    @jsii.member(jsii_name="toDescribeProduct")
    def to_describe_product(self) -> "Servicecatalog":
        '''(experimental) Grants permission to describe a product as an end-user.

        Access Level: Read

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DescribeProduct.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDescribeProduct", []))

    @jsii.member(jsii_name="toDescribeProductAsAdmin")
    def to_describe_product_as_admin(self) -> "Servicecatalog":
        '''(experimental) Grants permission to describe a product as an admin.

        Access Level: Read

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DescribeProductAsAdmin.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDescribeProductAsAdmin", []))

    @jsii.member(jsii_name="toDescribeProductView")
    def to_describe_product_view(self) -> "Servicecatalog":
        '''(experimental) Grants permission to describe a product as an end-user.

        Access Level: Read

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DescribeProductView.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDescribeProductView", []))

    @jsii.member(jsii_name="toDescribeProvisionedProduct")
    def to_describe_provisioned_product(self) -> "Servicecatalog":
        '''(experimental) Grants permission to describe a provisioned product.

        Access Level: Read

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DescribeProvisionedProduct.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDescribeProvisionedProduct", []))

    @jsii.member(jsii_name="toDescribeProvisionedProductPlan")
    def to_describe_provisioned_product_plan(self) -> "Servicecatalog":
        '''(experimental) Grants permission to describe a provisioned product plan.

        Access Level: Read

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DescribeProvisionedProductPlan.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDescribeProvisionedProductPlan", []))

    @jsii.member(jsii_name="toDescribeProvisioningArtifact")
    def to_describe_provisioning_artifact(self) -> "Servicecatalog":
        '''(experimental) Grants permission to describe a provisioning artifact.

        Access Level: Read

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DescribeProvisioningArtifact.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDescribeProvisioningArtifact", []))

    @jsii.member(jsii_name="toDescribeProvisioningParameters")
    def to_describe_provisioning_parameters(self) -> "Servicecatalog":
        '''(experimental) Grants permission to describe the parameters that you need to specify to successfully provision a specified provisioning artifact.

        Access Level: Read

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DescribeProvisioningParameters.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDescribeProvisioningParameters", []))

    @jsii.member(jsii_name="toDescribeRecord")
    def to_describe_record(self) -> "Servicecatalog":
        '''(experimental) Grants permission to describe a record and lists any outputs.

        Access Level: Read

        Possible conditions:

        - .ifAccountLevel()
        - .ifRoleLevel()
        - .ifUserLevel()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DescribeRecord.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDescribeRecord", []))

    @jsii.member(jsii_name="toDescribeServiceAction")
    def to_describe_service_action(self) -> "Servicecatalog":
        '''(experimental) Grants permission to describe a self-service action.

        Access Level: Read

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DescribeServiceAction.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDescribeServiceAction", []))

    @jsii.member(jsii_name="toDescribeServiceActionExecutionParameters")
    def to_describe_service_action_execution_parameters(self) -> "Servicecatalog":
        '''(experimental) Grants permission to get the default parameters if you executed the specified Service Action on the specified Provisioned Product.

        Access Level: Read

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DescribeServiceActionExecutionParameters.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDescribeServiceActionExecutionParameters", []))

    @jsii.member(jsii_name="toDescribeTagOption")
    def to_describe_tag_option(self) -> "Servicecatalog":
        '''(experimental) Grants permission to get information about the specified TagOption.

        Access Level: Read

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DescribeTagOption.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDescribeTagOption", []))

    @jsii.member(jsii_name="toDisableAWSOrganizationsAccess")
    def to_disable_aws_organizations_access(self) -> "Servicecatalog":
        '''(experimental) Grants permission to disable portfolio sharing through AWS Organizations feature.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DisableAWSOrganizationsAccess.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDisableAWSOrganizationsAccess", []))

    @jsii.member(jsii_name="toDisassociateAttributeGroup")
    def to_disassociate_attribute_group(self) -> "Servicecatalog":
        '''(experimental) Grants permission to disassociate an attribute group from an application.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_DisassociateAttributeGroup.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDisassociateAttributeGroup", []))

    @jsii.member(jsii_name="toDisassociateBudgetFromResource")
    def to_disassociate_budget_from_resource(self) -> "Servicecatalog":
        '''(experimental) Grants permission to disassociate a budget from a resource.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DisassociateBudgetFromResource.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDisassociateBudgetFromResource", []))

    @jsii.member(jsii_name="toDisassociatePrincipalFromPortfolio")
    def to_disassociate_principal_from_portfolio(self) -> "Servicecatalog":
        '''(experimental) Grants permission to disassociate an IAM principal from a portfolio.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DisassociatePrincipalFromPortfolio.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDisassociatePrincipalFromPortfolio", []))

    @jsii.member(jsii_name="toDisassociateProductFromPortfolio")
    def to_disassociate_product_from_portfolio(self) -> "Servicecatalog":
        '''(experimental) Grants permission to disassociate a product from a portfolio.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DisassociateProductFromPortfolio.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDisassociateProductFromPortfolio", []))

    @jsii.member(jsii_name="toDisassociateResource")
    def to_disassociate_resource(self) -> "Servicecatalog":
        '''(experimental) Grants permission to disassociate a resource from an application.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_DisassociateResource.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDisassociateResource", []))

    @jsii.member(jsii_name="toDisassociateServiceActionFromProvisioningArtifact")
    def to_disassociate_service_action_from_provisioning_artifact(
        self,
    ) -> "Servicecatalog":
        '''(experimental) Grants permission to disassociate the specified self-service action association from the specified provisioning artifact.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DisassociateServiceActionFromProvisioningArtifact.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDisassociateServiceActionFromProvisioningArtifact", []))

    @jsii.member(jsii_name="toDisassociateTagOptionFromResource")
    def to_disassociate_tag_option_from_resource(self) -> "Servicecatalog":
        '''(experimental) Grants permission to disassociate the specified TagOption from the specified resource.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DisassociateTagOptionFromResource.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDisassociateTagOptionFromResource", []))

    @jsii.member(jsii_name="toEnableAWSOrganizationsAccess")
    def to_enable_aws_organizations_access(self) -> "Servicecatalog":
        '''(experimental) Grants permission to enable portfolio sharing feature through AWS Organizations.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_EnableAWSOrganizationsAccess.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toEnableAWSOrganizationsAccess", []))

    @jsii.member(jsii_name="toExecuteProvisionedProductPlan")
    def to_execute_provisioned_product_plan(self) -> "Servicecatalog":
        '''(experimental) Grants permission to execute a provisioned product plan.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ExecuteProvisionedProductPlan.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toExecuteProvisionedProductPlan", []))

    @jsii.member(jsii_name="toExecuteProvisionedProductServiceAction")
    def to_execute_provisioned_product_service_action(self) -> "Servicecatalog":
        '''(experimental) Grants permission to executes a provisioned product plan.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ExecuteProvisionedProductServiceAction.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toExecuteProvisionedProductServiceAction", []))

    @jsii.member(jsii_name="toGetApplication")
    def to_get_application(self) -> "Servicecatalog":
        '''(experimental) Grants permission to get an application.

        Access Level: Read

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_GetApplication.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toGetApplication", []))

    @jsii.member(jsii_name="toGetAttributeGroup")
    def to_get_attribute_group(self) -> "Servicecatalog":
        '''(experimental) Grants permission to get an attribute group.

        Access Level: Read

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_GetAttributeGroup.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toGetAttributeGroup", []))

    @jsii.member(jsii_name="toGetAWSOrganizationsAccessStatus")
    def to_get_aws_organizations_access_status(self) -> "Servicecatalog":
        '''(experimental) Grants permission to get the access status of AWS Organization portfolio share feature.

        Access Level: Read

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_GetAWSOrganizationsAccessStatus.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toGetAWSOrganizationsAccessStatus", []))

    @jsii.member(jsii_name="toImportAsProvisionedProduct")
    def to_import_as_provisioned_product(self) -> "Servicecatalog":
        '''(experimental) Grants permission to import a resource into a provisioned product.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ImportAsProvisionedProduct.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toImportAsProvisionedProduct", []))

    @jsii.member(jsii_name="toListAcceptedPortfolioShares")
    def to_list_accepted_portfolio_shares(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list the portfolios that have been shared with you and you have accepted.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListAcceptedPortfolioShares.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListAcceptedPortfolioShares", []))

    @jsii.member(jsii_name="toListApplications")
    def to_list_applications(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list the applications in your account.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_ListApplications.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListApplications", []))

    @jsii.member(jsii_name="toListAssociatedAttributeGroups")
    def to_list_associated_attribute_groups(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list the attribute groups associated with an application.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_ListAssociatedAttributeGroups.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListAssociatedAttributeGroups", []))

    @jsii.member(jsii_name="toListAssociatedResources")
    def to_list_associated_resources(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list the resources associated with an application.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_ListAssociatedResources.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListAssociatedResources", []))

    @jsii.member(jsii_name="toListAttributeGroups")
    def to_list_attribute_groups(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list the attribute groups in your account.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_ListAttributeGroups.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListAttributeGroups", []))

    @jsii.member(jsii_name="toListBudgetsForResource")
    def to_list_budgets_for_resource(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list all the budgets associated to a resource.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListBudgetsForResource.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListBudgetsForResource", []))

    @jsii.member(jsii_name="toListConstraintsForPortfolio")
    def to_list_constraints_for_portfolio(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list constraints associated with a given portfolio.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListConstraintsForPortfolio.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListConstraintsForPortfolio", []))

    @jsii.member(jsii_name="toListLaunchPaths")
    def to_list_launch_paths(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list the different ways to launch a given product as an end-user.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListLaunchPaths.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListLaunchPaths", []))

    @jsii.member(jsii_name="toListOrganizationPortfolioAccess")
    def to_list_organization_portfolio_access(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list the organization nodes that have access to the specified portfolio.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListOrganizationPortfolioAccess.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListOrganizationPortfolioAccess", []))

    @jsii.member(jsii_name="toListPortfolioAccess")
    def to_list_portfolio_access(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list the AWS accounts you have shared a given portfolio with.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListPortfolioAccess.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListPortfolioAccess", []))

    @jsii.member(jsii_name="toListPortfolios")
    def to_list_portfolios(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list the portfolios in your account.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListPortfolios.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListPortfolios", []))

    @jsii.member(jsii_name="toListPortfoliosForProduct")
    def to_list_portfolios_for_product(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list the portfolios associated with a given product.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListPortfoliosForProduct.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListPortfoliosForProduct", []))

    @jsii.member(jsii_name="toListPrincipalsForPortfolio")
    def to_list_principals_for_portfolio(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list the IAM principals associated with a given portfolio.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListPrincipalsForPortfolio.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListPrincipalsForPortfolio", []))

    @jsii.member(jsii_name="toListProvisionedProductPlans")
    def to_list_provisioned_product_plans(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list the provisioned product plans.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListProvisionedProductPlans.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListProvisionedProductPlans", []))

    @jsii.member(jsii_name="toListProvisioningArtifacts")
    def to_list_provisioning_artifacts(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list the provisioning artifacts associated with a given product.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListProvisioningArtifacts.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListProvisioningArtifacts", []))

    @jsii.member(jsii_name="toListProvisioningArtifactsForServiceAction")
    def to_list_provisioning_artifacts_for_service_action(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list all provisioning artifacts for the specified self-service action.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListProvisioningArtifactsForServiceAction.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListProvisioningArtifactsForServiceAction", []))

    @jsii.member(jsii_name="toListRecordHistory")
    def to_list_record_history(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list all the records in your account or all the records related to a given provisioned product.

        Access Level: List

        Possible conditions:

        - .ifAccountLevel()
        - .ifRoleLevel()
        - .ifUserLevel()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListRecordHistory.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListRecordHistory", []))

    @jsii.member(jsii_name="toListResourcesForTagOption")
    def to_list_resources_for_tag_option(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list the resources associated with the specified TagOption.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListResourcesForTagOption.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListResourcesForTagOption", []))

    @jsii.member(jsii_name="toListServiceActions")
    def to_list_service_actions(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list all self-service actions.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListServiceActions.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListServiceActions", []))

    @jsii.member(jsii_name="toListServiceActionsForProvisioningArtifact")
    def to_list_service_actions_for_provisioning_artifact(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list all the service actions associated with the specified provisioning artifact in your account.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListServiceActionsForProvisioningArtifact.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListServiceActionsForProvisioningArtifact", []))

    @jsii.member(jsii_name="toListStackInstancesForProvisionedProduct")
    def to_list_stack_instances_for_provisioned_product(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list account, region and status of each stack instances that are associated with a CFN_STACKSET type provisioned product.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListStackInstancesForProvisionedProduct.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListStackInstancesForProvisionedProduct", []))

    @jsii.member(jsii_name="toListTagOptions")
    def to_list_tag_options(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list the specified TagOptions or all TagOptions.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListTagOptions.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListTagOptions", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list the tags for a service catalog appregistry resource.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toProvisionProduct")
    def to_provision_product(self) -> "Servicecatalog":
        '''(experimental) Grants permission to provision a product with a specified provisioning artifact and launch parameters.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ProvisionProduct.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toProvisionProduct", []))

    @jsii.member(jsii_name="toRejectPortfolioShare")
    def to_reject_portfolio_share(self) -> "Servicecatalog":
        '''(experimental) Grants permission to reject a portfolio that has been shared with you that you previously accepted.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_RejectPortfolioShare.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toRejectPortfolioShare", []))

    @jsii.member(jsii_name="toScanProvisionedProducts")
    def to_scan_provisioned_products(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list all the provisioned products in your account.

        Access Level: List

        Possible conditions:

        - .ifAccountLevel()
        - .ifRoleLevel()
        - .ifUserLevel()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ScanProvisionedProducts.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toScanProvisionedProducts", []))

    @jsii.member(jsii_name="toSearchProducts")
    def to_search_products(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list the products available to you as an end-user.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_SearchProducts.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toSearchProducts", []))

    @jsii.member(jsii_name="toSearchProductsAsAdmin")
    def to_search_products_as_admin(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list all the products in your account or all the products associated with a given portfolio.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_SearchProductsAsAdmin.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toSearchProductsAsAdmin", []))

    @jsii.member(jsii_name="toSearchProvisionedProducts")
    def to_search_provisioned_products(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list all the provisioned products in your account.

        Access Level: List

        Possible conditions:

        - .ifAccountLevel()
        - .ifRoleLevel()
        - .ifUserLevel()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_SearchProvisionedProducts.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toSearchProvisionedProducts", []))

    @jsii.member(jsii_name="toSyncResource")
    def to_sync_resource(self) -> "Servicecatalog":
        '''(experimental) Grants permission to sync a resource with its current state in AppRegistry.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_SyncResource.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toSyncResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Servicecatalog":
        '''(experimental) Grants permission to tag a service catalog appregistry resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTerminateProvisionedProduct")
    def to_terminate_provisioned_product(self) -> "Servicecatalog":
        '''(experimental) Grants permission to terminate an existing provisioned product.

        Access Level: Write

        Possible conditions:

        - .ifAccountLevel()
        - .ifRoleLevel()
        - .ifUserLevel()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_TerminateProvisionedProduct.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toTerminateProvisionedProduct", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Servicecatalog":
        '''(experimental) Grants permission to remove a tag from a service catalog appregistry resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateApplication")
    def to_update_application(self) -> "Servicecatalog":
        '''(experimental) Grants permission to update the attributes of an existing application.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_UpdateApplication.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toUpdateApplication", []))

    @jsii.member(jsii_name="toUpdateAttributeGroup")
    def to_update_attribute_group(self) -> "Servicecatalog":
        '''(experimental) Grants permission to update the attributes of an existing attribute group.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_UpdateAttributeGroup.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toUpdateAttributeGroup", []))

    @jsii.member(jsii_name="toUpdateConstraint")
    def to_update_constraint(self) -> "Servicecatalog":
        '''(experimental) Grants permission to update the metadata fields of an existing constraint.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_UpdateConstraint.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toUpdateConstraint", []))

    @jsii.member(jsii_name="toUpdatePortfolio")
    def to_update_portfolio(self) -> "Servicecatalog":
        '''(experimental) Grants permission to update the metadata fields and/or tags of an existing portfolio.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_UpdatePortfolio.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toUpdatePortfolio", []))

    @jsii.member(jsii_name="toUpdateProduct")
    def to_update_product(self) -> "Servicecatalog":
        '''(experimental) Grants permission to update the metadata fields and/or tags of an existing product.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_UpdateProduct.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toUpdateProduct", []))

    @jsii.member(jsii_name="toUpdateProvisionedProduct")
    def to_update_provisioned_product(self) -> "Servicecatalog":
        '''(experimental) Grants permission to update an existing provisioned product.

        Access Level: Write

        Possible conditions:

        - .ifAccountLevel()
        - .ifRoleLevel()
        - .ifUserLevel()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_UpdateProvisionedProduct.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toUpdateProvisionedProduct", []))

    @jsii.member(jsii_name="toUpdateProvisionedProductProperties")
    def to_update_provisioned_product_properties(self) -> "Servicecatalog":
        '''(experimental) Grants permission to update the properties of an existing provisioned product.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_UpdateProvisionedProductProperties.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toUpdateProvisionedProductProperties", []))

    @jsii.member(jsii_name="toUpdateProvisioningArtifact")
    def to_update_provisioning_artifact(self) -> "Servicecatalog":
        '''(experimental) Grants permission to update the metadata fields of an existing provisioning artifact.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_UpdateProvisioningArtifact.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toUpdateProvisioningArtifact", []))

    @jsii.member(jsii_name="toUpdateServiceAction")
    def to_update_service_action(self) -> "Servicecatalog":
        '''(experimental) Grants permission to update a self-service action.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_UpdateServiceAction.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toUpdateServiceAction", []))

    @jsii.member(jsii_name="toUpdateTagOption")
    def to_update_tag_option(self) -> "Servicecatalog":
        '''(experimental) Grants permission to update the specified TagOption.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_UpdateTagOption.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toUpdateTagOption", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Servicediscovery(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Servicediscovery",
):
    '''(experimental) Statement provider for service `servicediscovery <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscloudmap.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `servicediscovery <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscloudmap.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Servicediscovery, self, [sid])

    @jsii.member(jsii_name="ifNamespaceArn")
    def if_namespace_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Servicediscovery":
        '''(experimental) Filters access by specifying the Amazon Resource Name (ARN) for the related namespace.

        https://docs.aws.amazon.com/cloud-map/latest/dg/access-control-overview.html#specifying-conditions

        Applies to actions:

        - .toCreateService()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "ifNamespaceArn", [value, operator]))

    @jsii.member(jsii_name="ifNamespaceName")
    def if_namespace_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Servicediscovery":
        '''(experimental) Filters access by specifying the name of the related namespace.

        https://docs.aws.amazon.com/cloud-map/latest/dg/access-control-overview.html#specifying-conditions

        Applies to actions:

        - .toDiscoverInstances()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "ifNamespaceName", [value, operator]))

    @jsii.member(jsii_name="ifServiceArn")
    def if_service_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Servicediscovery":
        '''(experimental) Filters access by specifying the Amazon Resource Name (ARN) for the related service.

        https://docs.aws.amazon.com/cloud-map/latest/dg/access-control-overview.html#specifying-conditions

        Applies to actions:

        - .toDeregisterInstance()
        - .toGetInstance()
        - .toGetInstancesHealthStatus()
        - .toListInstances()
        - .toRegisterInstance()
        - .toUpdateInstanceCustomHealthStatus()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "ifServiceArn", [value, operator]))

    @jsii.member(jsii_name="ifServiceName")
    def if_service_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Servicediscovery":
        '''(experimental) Filters access by specifying the name of the related service.

        https://docs.aws.amazon.com/cloud-map/latest/dg/access-control-overview.html#specifying-conditions

        Applies to actions:

        - .toDiscoverInstances()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "ifServiceName", [value, operator]))

    @jsii.member(jsii_name="onNamespace")
    def on_namespace(
        self,
        namespace_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Servicediscovery":
        '''(experimental) Adds a resource of type namespace to the statement.

        https://docs.aws.amazon.com/cloud-map/latest/dg/API_Namespace.html

        :param namespace_id: - Identifier for the namespaceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "onNamespace", [namespace_id, account, region, partition]))

    @jsii.member(jsii_name="onService")
    def on_service(
        self,
        service_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Servicediscovery":
        '''(experimental) Adds a resource of type service to the statement.

        https://docs.aws.amazon.com/cloud-map/latest/dg/API_Service.html

        :param service_id: - Identifier for the serviceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "onService", [service_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateHttpNamespace")
    def to_create_http_namespace(self) -> "Servicediscovery":
        '''(experimental) Grants permission to create an HTTP namespace.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/cloud-map/latest/api/API_CreateHttpNamespace.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toCreateHttpNamespace", []))

    @jsii.member(jsii_name="toCreatePrivateDnsNamespace")
    def to_create_private_dns_namespace(self) -> "Servicediscovery":
        '''(experimental) Grants permission to create a private namespace based on DNS, which will be visible only inside a specified Amazon VPC.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/cloud-map/latest/api/API_CreatePrivateDnsNamespace.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toCreatePrivateDnsNamespace", []))

    @jsii.member(jsii_name="toCreatePublicDnsNamespace")
    def to_create_public_dns_namespace(self) -> "Servicediscovery":
        '''(experimental) Grants permission to create a public namespace based on DNS, which will be visible on the internet.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/cloud-map/latest/api/API_CreatePublicDnsNamespace.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toCreatePublicDnsNamespace", []))

    @jsii.member(jsii_name="toCreateService")
    def to_create_service(self) -> "Servicediscovery":
        '''(experimental) Grants permission to create a service.

        Access Level: Write

        Possible conditions:

        - .ifNamespaceArn()
        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/cloud-map/latest/api/API_CreateService.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toCreateService", []))

    @jsii.member(jsii_name="toDeleteNamespace")
    def to_delete_namespace(self) -> "Servicediscovery":
        '''(experimental) Grants permission to delete a specified namespace.

        Access Level: Write

        https://docs.aws.amazon.com/cloud-map/latest/api/API_DeleteNamespace.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toDeleteNamespace", []))

    @jsii.member(jsii_name="toDeleteService")
    def to_delete_service(self) -> "Servicediscovery":
        '''(experimental) Grants permission to delete a specified service.

        Access Level: Write

        https://docs.aws.amazon.com/cloud-map/latest/api/API_DeleteService.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toDeleteService", []))

    @jsii.member(jsii_name="toDeregisterInstance")
    def to_deregister_instance(self) -> "Servicediscovery":
        '''(experimental) Grants permission to delete the records and the health check, if any, that Amazon Route 53 created for the specified instance.

        Access Level: Write

        Possible conditions:

        - .ifServiceArn()

        https://docs.aws.amazon.com/cloud-map/latest/api/API_DeregisterInstance.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toDeregisterInstance", []))

    @jsii.member(jsii_name="toDiscoverInstances")
    def to_discover_instances(self) -> "Servicediscovery":
        '''(experimental) Grants permission to discover registered instances for a specified namespace and service.

        Access Level: Read

        Possible conditions:

        - .ifNamespaceName()
        - .ifServiceName()

        https://docs.aws.amazon.com/cloud-map/latest/api/API_DiscoverInstances.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toDiscoverInstances", []))

    @jsii.member(jsii_name="toGetInstance")
    def to_get_instance(self) -> "Servicediscovery":
        '''(experimental) Grants permission to get information about a specified instance.

        Access Level: Read

        Possible conditions:

        - .ifServiceArn()

        https://docs.aws.amazon.com/cloud-map/latest/api/API_GetInstance.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toGetInstance", []))

    @jsii.member(jsii_name="toGetInstancesHealthStatus")
    def to_get_instances_health_status(self) -> "Servicediscovery":
        '''(experimental) Grants permission to get the current health status (Healthy, Unhealthy, or Unknown) of one or more instances.

        Access Level: Read

        Possible conditions:

        - .ifServiceArn()

        https://docs.aws.amazon.com/cloud-map/latest/api/API_GetInstancesHealthStatus.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toGetInstancesHealthStatus", []))

    @jsii.member(jsii_name="toGetNamespace")
    def to_get_namespace(self) -> "Servicediscovery":
        '''(experimental) Grants permission to get information about a namespace.

        Access Level: Read

        https://docs.aws.amazon.com/cloud-map/latest/api/API_GetNamespace.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toGetNamespace", []))

    @jsii.member(jsii_name="toGetOperation")
    def to_get_operation(self) -> "Servicediscovery":
        '''(experimental) Grants permission to get information about a specific operation.

        Access Level: Read

        https://docs.aws.amazon.com/cloud-map/latest/api/API_GetOperation.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toGetOperation", []))

    @jsii.member(jsii_name="toGetService")
    def to_get_service(self) -> "Servicediscovery":
        '''(experimental) Grants permission to get the settings for a specified service.

        Access Level: Read

        https://docs.aws.amazon.com/cloud-map/latest/api/API_GetService.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toGetService", []))

    @jsii.member(jsii_name="toListInstances")
    def to_list_instances(self) -> "Servicediscovery":
        '''(experimental) Grants permission to get summary information about the instances that were registered with a specified service.

        Access Level: List

        Possible conditions:

        - .ifServiceArn()

        https://docs.aws.amazon.com/cloud-map/latest/api/API_ListInstances.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toListInstances", []))

    @jsii.member(jsii_name="toListNamespaces")
    def to_list_namespaces(self) -> "Servicediscovery":
        '''(experimental) Grants permission to get information about the namespaces.

        Access Level: List

        https://docs.aws.amazon.com/cloud-map/latest/api/API_ListNamespaces.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toListNamespaces", []))

    @jsii.member(jsii_name="toListOperations")
    def to_list_operations(self) -> "Servicediscovery":
        '''(experimental) Grants permission to list operations that match the criteria that you specify.

        Access Level: List

        https://docs.aws.amazon.com/cloud-map/latest/api/API_ListOperations.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toListOperations", []))

    @jsii.member(jsii_name="toListServices")
    def to_list_services(self) -> "Servicediscovery":
        '''(experimental) Grants permission to get settings for all the services that match specified filters.

        Access Level: List

        https://docs.aws.amazon.com/cloud-map/latest/api/API_ListServices.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toListServices", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Servicediscovery":
        '''(experimental) Grants permission to lists tags for the specified resource.

        Access Level: List

        https://docs.aws.amazon.com/cloud-map/latest/api/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toRegisterInstance")
    def to_register_instance(self) -> "Servicediscovery":
        '''(experimental) Grants permission to register an instance based on the settings in a specified service.

        Access Level: Write

        Possible conditions:

        - .ifServiceArn()

        https://docs.aws.amazon.com/cloud-map/latest/api/API_RegisterInstance.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toRegisterInstance", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Servicediscovery":
        '''(experimental) Grants permission to add one or more tags to the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/cloud-map/latest/api/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Servicediscovery":
        '''(experimental) Grants permission to remove one or more tags from the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/cloud-map/latest/api/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateInstanceCustomHealthStatus")
    def to_update_instance_custom_health_status(self) -> "Servicediscovery":
        '''(experimental) Grants permission to update the current health status for an instance that has a custom health check.

        Access Level: Write

        Possible conditions:

        - .ifServiceArn()

        https://docs.aws.amazon.com/cloud-map/latest/api/API_UpdateInstanceCustomHealthStatus.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toUpdateInstanceCustomHealthStatus", []))

    @jsii.member(jsii_name="toUpdateService")
    def to_update_service(self) -> "Servicediscovery":
        '''(experimental) Grants permission to update the settings in a specified service.

        Access Level: Write

        https://docs.aws.amazon.com/cloud-map/latest/api/API_UpdateService.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toUpdateService", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Servicequotas(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Servicequotas",
):
    '''(experimental) Statement provider for service `servicequotas <https://docs.aws.amazon.com/service-authorization/latest/reference/list_servicequotas.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `servicequotas <https://docs.aws.amazon.com/service-authorization/latest/reference/list_servicequotas.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Servicequotas, self, [sid])

    @jsii.member(jsii_name="ifService")
    def if_service(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Servicequotas":
        '''(experimental) Filters or restricts access to a specified AWS service.

        https://docs.aws.amazon.com/servicequotas/latest/userguide/servicequotas/latest/userguide/identity-access-management.htmlck_service

        Applies to actions:

        - .toPutServiceQuotaIncreaseRequestIntoTemplate()
        - .toRequestServiceQuotaIncrease()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "ifService", [value, operator]))

    @jsii.member(jsii_name="onQuota")
    def on_quota(
        self,
        service_code: builtins.str,
        quota_code: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Servicequotas":
        '''(experimental) Adds a resource of type quota to the statement.

        https://docs.aws.amazon.com/servicequotas/latest/userguide/quota-as-resource.html

        :param service_code: - Identifier for the serviceCode.
        :param quota_code: - Identifier for the quotaCode.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "onQuota", [service_code, quota_code, account, region, partition]))

    @jsii.member(jsii_name="toAssociateServiceQuotaTemplate")
    def to_associate_service_quota_template(self) -> "Servicequotas":
        '''(experimental) Grants permission to associate the Service Quotas template with your organization.

        Access Level: Write

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_AssociateServiceQuotaTemplate.html

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toAssociateServiceQuotaTemplate", []))

    @jsii.member(jsii_name="toDeleteServiceQuotaIncreaseRequestFromTemplate")
    def to_delete_service_quota_increase_request_from_template(self) -> "Servicequotas":
        '''(experimental) Grants permission to remove the specified service quota from the service quota template.

        Access Level: Write

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_DeleteServiceQuotaIncreaseRequestFromTemplate.html

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toDeleteServiceQuotaIncreaseRequestFromTemplate", []))

    @jsii.member(jsii_name="toDisassociateServiceQuotaTemplate")
    def to_disassociate_service_quota_template(self) -> "Servicequotas":
        '''(experimental) Grants permission to disassociate the Service Quotas template from your organization.

        Access Level: Write

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_DisassociateServiceQuotaTemplate.html

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toDisassociateServiceQuotaTemplate", []))

    @jsii.member(jsii_name="toGetAssociationForServiceQuotaTemplate")
    def to_get_association_for_service_quota_template(self) -> "Servicequotas":
        '''(experimental) Grants permission to retrieve the ServiceQuotaTemplateAssociationStatus value, which tells you if the Service Quotas template is associated with an organization.

        Access Level: Read

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_GetAssociationForServiceQuotaTemplate.html

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toGetAssociationForServiceQuotaTemplate", []))

    @jsii.member(jsii_name="toGetAWSDefaultServiceQuota")
    def to_get_aws_default_service_quota(self) -> "Servicequotas":
        '''(experimental) Grants permission to return the details for the specified service quota, including the AWS default value.

        Access Level: Read

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_GetAWSDefaultServiceQuota.html

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toGetAWSDefaultServiceQuota", []))

    @jsii.member(jsii_name="toGetRequestedServiceQuotaChange")
    def to_get_requested_service_quota_change(self) -> "Servicequotas":
        '''(experimental) Grants permission to retrieve the details for a particular service quota increase request.

        Access Level: Read

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_GetRequestedServiceQuotaChange.html

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toGetRequestedServiceQuotaChange", []))

    @jsii.member(jsii_name="toGetServiceQuota")
    def to_get_service_quota(self) -> "Servicequotas":
        '''(experimental) Grants permission to return the details for the specified service quota, including the applied value.

        Access Level: Read

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_GetServiceQuota.html

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toGetServiceQuota", []))

    @jsii.member(jsii_name="toGetServiceQuotaIncreaseRequestFromTemplate")
    def to_get_service_quota_increase_request_from_template(self) -> "Servicequotas":
        '''(experimental) Grants permission to retrieve the details for a service quota increase request from the service quota template.

        Access Level: Read

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_GetServiceQuotaIncreaseRequestFromTemplate.html

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toGetServiceQuotaIncreaseRequestFromTemplate", []))

    @jsii.member(jsii_name="toListAWSDefaultServiceQuotas")
    def to_list_aws_default_service_quotas(self) -> "Servicequotas":
        '''(experimental) Grants permission to list all default service quotas for the specified AWS service.

        Access Level: Read

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_ListAWSDefaultServiceQuotas.html

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toListAWSDefaultServiceQuotas", []))

    @jsii.member(jsii_name="toListRequestedServiceQuotaChangeHistory")
    def to_list_requested_service_quota_change_history(self) -> "Servicequotas":
        '''(experimental) Grants permission to request a list of the changes to quotas for a service.

        Access Level: Read

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_ListRequestedServiceQuotaChangeHistory.html

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toListRequestedServiceQuotaChangeHistory", []))

    @jsii.member(jsii_name="toListRequestedServiceQuotaChangeHistoryByQuota")
    def to_list_requested_service_quota_change_history_by_quota(
        self,
    ) -> "Servicequotas":
        '''(experimental) Grants permission to request a list of the changes to specific service quotas.

        Access Level: Read

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_ListRequestedServiceQuotaChangeHistoryByQuota.html

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toListRequestedServiceQuotaChangeHistoryByQuota", []))

    @jsii.member(jsii_name="toListServiceQuotaIncreaseRequestsInTemplate")
    def to_list_service_quota_increase_requests_in_template(self) -> "Servicequotas":
        '''(experimental) Grants permission to return a list of the service quota increase requests from the service quota template.

        Access Level: Read

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_ListServiceQuotaIncreaseRequestsInTemplate

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toListServiceQuotaIncreaseRequestsInTemplate", []))

    @jsii.member(jsii_name="toListServiceQuotas")
    def to_list_service_quotas(self) -> "Servicequotas":
        '''(experimental) Grants permission to list all service quotas for the specified AWS service, in that account, in that Region.

        Access Level: Read

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_ListServiceQuotas.html

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toListServiceQuotas", []))

    @jsii.member(jsii_name="toListServices")
    def to_list_services(self) -> "Servicequotas":
        '''(experimental) Grants permission to list the AWS services available in Service Quotas.

        Access Level: Read

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_ListServices.html

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toListServices", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Servicequotas":
        '''(experimental) Grants permission to view the existing tags on a SQ resource.

        Access Level: List

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_ListTagsForResource

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutServiceQuotaIncreaseRequestIntoTemplate")
    def to_put_service_quota_increase_request_into_template(self) -> "Servicequotas":
        '''(experimental) Grants permission to define and add a quota to the service quota template.

        Access Level: Write

        Possible conditions:

        - .ifService()

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_PutServiceQuotaIncreaseRequestIntoTemplate.html

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toPutServiceQuotaIncreaseRequestIntoTemplate", []))

    @jsii.member(jsii_name="toRequestServiceQuotaIncrease")
    def to_request_service_quota_increase(self) -> "Servicequotas":
        '''(experimental) Grants permission to submit the request for a service quota increase.

        Access Level: Write

        Possible conditions:

        - .ifService()

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_RequestServiceQuotaIncrease.html

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toRequestServiceQuotaIncrease", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Servicequotas":
        '''(experimental) Grants permission to associate a set of tags with an existing SQ resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_TagResource

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Servicequotas":
        '''(experimental) Grants permission to remove a set of tags from a SQ resource, where tags to be removed match a set of customer-supplied tag keys.

        Access Level: Tagging

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_UntagResource

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toUntagResource", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Ses(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Ses"):
    '''(experimental) Statement provider for service `ses <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonses.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `ses <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonses.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Ses, self, [sid])

    @jsii.member(jsii_name="ifFeedbackAddress")
    def if_feedback_address(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ses":
        '''(experimental) Filters actions based on the "Return-Path" address, which specifies where bounces and complaints are sent by email feedback forwarding.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonses.html#amazonses-policy-keys

        Applies to actions:

        - .toSendBulkTemplatedEmail()
        - .toSendCustomVerificationEmail()
        - .toSendEmail()
        - .toSendRawEmail()
        - .toSendTemplatedEmail()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "ifFeedbackAddress", [value, operator]))

    @jsii.member(jsii_name="ifFromAddress")
    def if_from_address(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ses":
        '''(experimental) Filters actions based on the "From" address of a message.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonses.html#amazonses-policy-keys

        Applies to actions:

        - .toSendBounce()
        - .toSendBulkTemplatedEmail()
        - .toSendCustomVerificationEmail()
        - .toSendEmail()
        - .toSendRawEmail()
        - .toSendTemplatedEmail()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "ifFromAddress", [value, operator]))

    @jsii.member(jsii_name="ifFromDisplayName")
    def if_from_display_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ses":
        '''(experimental) Filters actions based on the "From" address that is used as the display name of a message.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonses.html#amazonses-policy-keys

        Applies to actions:

        - .toSendBulkTemplatedEmail()
        - .toSendCustomVerificationEmail()
        - .toSendEmail()
        - .toSendRawEmail()
        - .toSendTemplatedEmail()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "ifFromDisplayName", [value, operator]))

    @jsii.member(jsii_name="ifRecipients")
    def if_recipients(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ses":
        '''(experimental) Filters actions based on the recipient addresses of a message, which include the "To", "CC", and "BCC" addresses.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonses.html#amazonses-policy-keys

        Applies to actions:

        - .toSendBulkTemplatedEmail()
        - .toSendCustomVerificationEmail()
        - .toSendEmail()
        - .toSendRawEmail()
        - .toSendTemplatedEmail()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "ifRecipients", [value, operator]))

    @jsii.member(jsii_name="onConfigurationSet")
    def on_configuration_set(
        self,
        configuration_set_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ses":
        '''(experimental) Adds a resource of type configuration-set to the statement.

        https://docs.aws.amazon.com/ses/latest/APIReference/API_ConfigurationSet.html

        :param configuration_set_name: - Identifier for the configurationSetName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "onConfigurationSet", [configuration_set_name, account, region, partition]))

    @jsii.member(jsii_name="onCustomVerificationEmailTemplate")
    def on_custom_verification_email_template(
        self,
        template_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ses":
        '''(experimental) Adds a resource of type custom-verification-email-template to the statement.

        https://docs.aws.amazon.com/ses/latest/APIReference/API_CustomVerificationEmailTemplate.html

        :param template_name: - Identifier for the templateName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "onCustomVerificationEmailTemplate", [template_name, account, region, partition]))

    @jsii.member(jsii_name="onIdentity")
    def on_identity(
        self,
        identity_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ses":
        '''(experimental) Adds a resource of type identity to the statement.

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_IdentityInfo.html

        :param identity_name: - Identifier for the identityName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "onIdentity", [identity_name, account, region, partition]))

    @jsii.member(jsii_name="onTemplate")
    def on_template(
        self,
        template_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ses":
        '''(experimental) Adds a resource of type template to the statement.

        https://docs.aws.amazon.com/ses/latest/APIReference/API_Template.html

        :param template_name: - Identifier for the templateName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "onTemplate", [template_name, account, region, partition]))

    @jsii.member(jsii_name="toCloneReceiptRuleSet")
    def to_clone_receipt_rule_set(self) -> "Ses":
        '''(experimental) Grants permission to create a receipt rule set by cloning an existing one.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference/API_CloneReceiptRuleSet.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toCloneReceiptRuleSet", []))

    @jsii.member(jsii_name="toCreateConfigurationSet")
    def to_create_configuration_set(self) -> "Ses":
        '''(experimental) Grants permission to create a new configuration set.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference/API_CreateConfigurationSet.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toCreateConfigurationSet", []))

    @jsii.member(jsii_name="toCreateConfigurationSetEventDestination")
    def to_create_configuration_set_event_destination(self) -> "Ses":
        '''(experimental) Grants permission to create a configuration set event destination.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference/API_CreateConfigurationSetEventDestination.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toCreateConfigurationSetEventDestination", []))

    @jsii.member(jsii_name="toCreateConfigurationSetTrackingOptions")
    def to_create_configuration_set_tracking_options(self) -> "Ses":
        '''(experimental) Grants permission to creates an association between a configuration set and a custom domain for open and click event tracking.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference/API_CreateConfigurationSetTrackingOptions.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toCreateConfigurationSetTrackingOptions", []))

    @jsii.member(jsii_name="toCreateCustomVerificationEmailTemplate")
    def to_create_custom_verification_email_template(self) -> "Ses":
        '''(experimental) Grants permission to create a new custom verification email template.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference/API_CreateCustomVerificationEmailTemplate.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toCreateCustomVerificationEmailTemplate", []))

    @jsii.member(jsii_name="toCreateReceiptFilter")
    def to_create_receipt_filter(self) -> "Ses":
        '''(experimental) Grants permission to create a new IP address filter.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference/API_CreateReceiptFilter.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toCreateReceiptFilter", []))

    @jsii.member(jsii_name="toCreateReceiptRule")
    def to_create_receipt_rule(self) -> "Ses":
        '''(experimental) Grants permission to create a receipt rule.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference/API_CreateReceiptRule.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toCreateReceiptRule", []))

    @jsii.member(jsii_name="toCreateReceiptRuleSet")
    def to_create_receipt_rule_set(self) -> "Ses":
        '''(experimental) Grants permission to create an empty receipt rule set.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference/API_CreateReceiptRuleSet.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toCreateReceiptRuleSet", []))

    @jsii.member(jsii_name="toCreateTemplate")
    def to_create_template(self) -> "Ses":
        '''(experimental) Grants permission to creates an email template.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference/API_CreateTemplate.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toCreateTemplate", []))

    @jsii.member(jsii_name="toDeleteConfigurationSet")
    def to_delete_configuration_set(self) -> "Ses":
        '''(experimental) Grants permission to delete an existing configuration set.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference/API_DeleteConfigurationSet.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toDeleteConfigurationSet", []))

    @jsii.member(jsii_name="toDeleteConfigurationSetEventDestination")
    def to_delete_configuration_set_event_destination(self) -> "Ses":
        '''(experimental) Grants permission to delete an event destination.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference/API_DeleteConfigurationSetEventDestination.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toDeleteConfigurationSetEventDestination", []))

    @jsii.member(jsii_name="toDeleteConfigurationSetTrackingOptions")
    def to_delete_configuration_set_tracking_options(self) -> "Ses":
        '''(experimental) Grants permission to delete an association between a configuration set and a custom domain for open and click event tracking.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference/API_DeleteConfigurationSetTrackingOptions.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toDeleteConfigurationSetTrackingOptions", []))

    @jsii.member(jsii_name="toDeleteCustomVerificationEmailTemplate")
    def to_delete_custom_verification_email_template(self) -> "Ses":
        '''(experimental) Grants permission to delete an existing custom verification email template.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference/API_DeleteCustomVerificationEmailTemplate.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toDeleteCustomVerificationEmailTemplate", []))

    @jsii.member(jsii_name="toDeleteIdentity")
    def to_delete_identity(self) -> "Ses":
        '''(experimental) Grants permission to delete the specified identity.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference/API_DeleteIdentity.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toDeleteIdentity", []))

    @jsii.member(jsii_name="toDeleteIdentityPolicy")
    def to_delete_identity_policy(self) -> "Ses":
        '''(experimental) Grants permission to delete the specified sending authorization policy for the given identity (an email address or a domain).

        Access Level: Permissions management

        https://docs.aws.amazon.com/ses/latest/APIReference/API_DeleteIdentityPolicy.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toDeleteIdentityPolicy", []))

    @jsii.member(jsii_name="toDeleteReceiptFilter")
    def to_delete_receipt_filter(self) -> "Ses":
        '''(experimental) Grants permission to delete the specified IP address filter.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference/API_DeleteReceiptFilter.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toDeleteReceiptFilter", []))

    @jsii.member(jsii_name="toDeleteReceiptRule")
    def to_delete_receipt_rule(self) -> "Ses":
        '''(experimental) Grants permission to delete the specified receipt rule.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference/API_DeleteReceiptRule.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toDeleteReceiptRule", []))

    @jsii.member(jsii_name="toDeleteReceiptRuleSet")
    def to_delete_receipt_rule_set(self) -> "Ses":
        '''(experimental) Grants permission to delete the specified receipt rule set and all of the receipt rules it contains.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference/API_DeleteReceiptRuleSet.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toDeleteReceiptRuleSet", []))

    @jsii.member(jsii_name="toDeleteTemplate")
    def to_delete_template(self) -> "Ses":
        '''(experimental) Grants permission to delete an email template.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference/API_DeleteTemplate.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toDeleteTemplate", []))

    @jsii.member(jsii_name="toDeleteVerifiedEmailAddress")
    def to_delete_verified_email_address(self) -> "Ses":
        '''(experimental) Grants permission to delete the specified email address from the list of verified addresses.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference/API_DeleteVerifiedEmailAddress.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toDeleteVerifiedEmailAddress", []))

    @jsii.member(jsii_name="toDescribeActiveReceiptRuleSet")
    def to_describe_active_receipt_rule_set(self) -> "Ses":
        '''(experimental) Grants permission to return the metadata and receipt rules for the receipt rule set that is currently active.

        Access Level: Read

        https://docs.aws.amazon.com/ses/latest/APIReference/API_DescribeActiveReceiptRuleSet.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toDescribeActiveReceiptRuleSet", []))

    @jsii.member(jsii_name="toDescribeConfigurationSet")
    def to_describe_configuration_set(self) -> "Ses":
        '''(experimental) Grants permission to return the details of the specified configuration set.

        Access Level: Read

        https://docs.aws.amazon.com/ses/latest/APIReference/API_DescribeConfigurationSet.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toDescribeConfigurationSet", []))

    @jsii.member(jsii_name="toDescribeReceiptRule")
    def to_describe_receipt_rule(self) -> "Ses":
        '''(experimental) Grants permission to return the details of the specified receipt rule.

        Access Level: Read

        https://docs.aws.amazon.com/ses/latest/APIReference/API_DescribeReceiptRule.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toDescribeReceiptRule", []))

    @jsii.member(jsii_name="toDescribeReceiptRuleSet")
    def to_describe_receipt_rule_set(self) -> "Ses":
        '''(experimental) Grants permission to return the details of the specified receipt rule set.

        Access Level: Read

        https://docs.aws.amazon.com/ses/latest/APIReference/API_DescribeReceiptRuleSet.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toDescribeReceiptRuleSet", []))

    @jsii.member(jsii_name="toGetAccountSendingEnabled")
    def to_get_account_sending_enabled(self) -> "Ses":
        '''(experimental) Grants permission to return the email sending status of your account.

        Access Level: Read

        https://docs.aws.amazon.com/ses/latest/APIReference/API_GetAccountSendingEnabled.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toGetAccountSendingEnabled", []))

    @jsii.member(jsii_name="toGetCustomVerificationEmailTemplate")
    def to_get_custom_verification_email_template(self) -> "Ses":
        '''(experimental) Grants permission to return the custom email verification template for the template name you specify.

        Access Level: Read

        https://docs.aws.amazon.com/ses/latest/APIReference/API_GetCustomVerificationEmailTemplate.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toGetCustomVerificationEmailTemplate", []))

    @jsii.member(jsii_name="toGetIdentityDkimAttributes")
    def to_get_identity_dkim_attributes(self) -> "Ses":
        '''(experimental) Grants permission to return the current status of Easy DKIM signing for an entity.

        Access Level: Read

        https://docs.aws.amazon.com/ses/latest/APIReference/API_GetIdentityDkimAttributes.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toGetIdentityDkimAttributes", []))

    @jsii.member(jsii_name="toGetIdentityMailFromDomainAttributes")
    def to_get_identity_mail_from_domain_attributes(self) -> "Ses":
        '''(experimental) Grants permission to return the custom MAIL FROM attributes for a list of identities (email addresses and/or domains).

        Access Level: Read

        https://docs.aws.amazon.com/ses/latest/APIReference/API_GetIdentityMailFromDomainAttributes.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toGetIdentityMailFromDomainAttributes", []))

    @jsii.member(jsii_name="toGetIdentityNotificationAttributes")
    def to_get_identity_notification_attributes(self) -> "Ses":
        '''(experimental) Grants permission to return a structure describing identity notification attributes for a list of verified identities (email addresses and/or domains),.

        Access Level: Read

        https://docs.aws.amazon.com/ses/latest/APIReference/API_GetIdentityNotificationAttributes.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toGetIdentityNotificationAttributes", []))

    @jsii.member(jsii_name="toGetIdentityPolicies")
    def to_get_identity_policies(self) -> "Ses":
        '''(experimental) Grants permission to return the requested sending authorization policies for the given identity (an email address or a domain).

        Access Level: Read

        https://docs.aws.amazon.com/ses/latest/APIReference/API_GetIdentityPolicies.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toGetIdentityPolicies", []))

    @jsii.member(jsii_name="toGetIdentityVerificationAttributes")
    def to_get_identity_verification_attributes(self) -> "Ses":
        '''(experimental) Grants permission to return the verification status and (for domain identities) the verification token for a list of identities.

        Access Level: Read

        https://docs.aws.amazon.com/ses/latest/APIReference/API_GetIdentityVerificationAttributes.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toGetIdentityVerificationAttributes", []))

    @jsii.member(jsii_name="toGetSendQuota")
    def to_get_send_quota(self) -> "Ses":
        '''(experimental) Grants permission to return the user's current sending limits.

        Access Level: Read

        https://docs.aws.amazon.com/ses/latest/APIReference/API_GetSendQuota.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toGetSendQuota", []))

    @jsii.member(jsii_name="toGetSendStatistics")
    def to_get_send_statistics(self) -> "Ses":
        '''(experimental) Grants permission to returns the user's sending statistics.

        Access Level: Read

        https://docs.aws.amazon.com/ses/latest/APIReference/API_GetSendStatistics.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toGetSendStatistics", []))

    @jsii.member(jsii_name="toGetTemplate")
    def to_get_template(self) -> "Ses":
        '''(experimental) Grants permission to return the template object, which includes the subject line, HTML par, and text part for the template you specify.

        Access Level: Read

        https://docs.aws.amazon.com/ses/latest/APIReference/API_GetTemplate.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toGetTemplate", []))

    @jsii.member(jsii_name="toListConfigurationSets")
    def to_list_configuration_sets(self) -> "Ses":
        '''(experimental) Grants permission to list all of the configuration sets for your account.

        Access Level: List

        https://docs.aws.amazon.com/ses/latest/APIReference/API_ListConfigurationSets.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toListConfigurationSets", []))

    @jsii.member(jsii_name="toListCustomVerificationEmailTemplates")
    def to_list_custom_verification_email_templates(self) -> "Ses":
        '''(experimental) Grants permission to list all of the existing custom verification email templates for your account.

        Access Level: List

        https://docs.aws.amazon.com/ses/latest/APIReference/API_ListCustomVerificationEmailTemplates.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toListCustomVerificationEmailTemplates", []))

    @jsii.member(jsii_name="toListIdentities")
    def to_list_identities(self) -> "Ses":
        '''(experimental) Grants permission to list the email identities for your account.

        Access Level: List

        https://docs.aws.amazon.com/ses/latest/APIReference/API_ListIdentities.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toListIdentities", []))

    @jsii.member(jsii_name="toListIdentityPolicies")
    def to_list_identity_policies(self) -> "Ses":
        '''(experimental) Grants permission to list all of the email templates for your account.

        Access Level: List

        https://docs.aws.amazon.com/ses/latest/APIReference/API_ListIdentityPolicies.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toListIdentityPolicies", []))

    @jsii.member(jsii_name="toListReceiptFilters")
    def to_list_receipt_filters(self) -> "Ses":
        '''(experimental) Grants permission to list the IP address filters associated with your account.

        Access Level: Read

        https://docs.aws.amazon.com/ses/latest/APIReference/API_ListReceiptFilters.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toListReceiptFilters", []))

    @jsii.member(jsii_name="toListReceiptRuleSets")
    def to_list_receipt_rule_sets(self) -> "Ses":
        '''(experimental) Grants permission to list the receipt rule sets that exist under your account.

        Access Level: Read

        https://docs.aws.amazon.com/ses/latest/APIReference/API_ListReceiptRuleSets.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toListReceiptRuleSets", []))

    @jsii.member(jsii_name="toListTemplates")
    def to_list_templates(self) -> "Ses":
        '''(experimental) Grants permission to list the email templates present in your account.

        Access Level: List

        https://docs.aws.amazon.com/ses/latest/APIReference/API_ListTemplates.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toListTemplates", []))

    @jsii.member(jsii_name="toListVerifiedEmailAddresses")
    def to_list_verified_email_addresses(self) -> "Ses":
        '''(experimental) Grants permission to list all of the email addresses that have been verified in your account.

        Access Level: Read

        https://docs.aws.amazon.com/ses/latest/APIReference/API_ListVerifiedEmailAddresses.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toListVerifiedEmailAddresses", []))

    @jsii.member(jsii_name="toPutConfigurationSetDeliveryOptions")
    def to_put_configuration_set_delivery_options(self) -> "Ses":
        '''(experimental) Grants permission to add or update the delivery options for a configuration set.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference/API_PutConfigurationSetDeliveryOptions.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toPutConfigurationSetDeliveryOptions", []))

    @jsii.member(jsii_name="toPutIdentityPolicy")
    def to_put_identity_policy(self) -> "Ses":
        '''(experimental) Grants permission to add or update a sending authorization policy for the specified identity (an email address or a domain).

        Access Level: Permissions management

        https://docs.aws.amazon.com/ses/latest/APIReference/API_PutIdentityPolicy.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toPutIdentityPolicy", []))

    @jsii.member(jsii_name="toReorderReceiptRuleSet")
    def to_reorder_receipt_rule_set(self) -> "Ses":
        '''(experimental) Grants permission to reorder the receipt rules within a receipt rule set.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference/API_ReorderReceiptRuleSet.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toReorderReceiptRuleSet", []))

    @jsii.member(jsii_name="toSendBounce")
    def to_send_bounce(self) -> "Ses":
        '''(experimental) Grants permission to generate and send a bounce message to the sender of an email you received through Amazon SES.

        Access Level: Write

        Possible conditions:

        - .ifFromAddress()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_SendBounce.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toSendBounce", []))

    @jsii.member(jsii_name="toSendBulkTemplatedEmail")
    def to_send_bulk_templated_email(self) -> "Ses":
        '''(experimental) Grants permission to compose an email message to multiple destinations.

        Access Level: Write

        Possible conditions:

        - .ifFeedbackAddress()
        - .ifFromAddress()
        - .ifFromDisplayName()
        - .ifRecipients()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_SendBulkTemplatedEmail.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toSendBulkTemplatedEmail", []))

    @jsii.member(jsii_name="toSendCustomVerificationEmail")
    def to_send_custom_verification_email(self) -> "Ses":
        '''(experimental) Grants permission to add an email address to the list of identities and attempts to verify it for your account.

        Access Level: Write

        Possible conditions:

        - .ifFeedbackAddress()
        - .ifFromAddress()
        - .ifFromDisplayName()
        - .ifRecipients()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_SendCustomVerificationEmail.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toSendCustomVerificationEmail", []))

    @jsii.member(jsii_name="toSendEmail")
    def to_send_email(self) -> "Ses":
        '''(experimental) Grants permission to send an email message.

        Access Level: Write

        Possible conditions:

        - .ifFeedbackAddress()
        - .ifFromAddress()
        - .ifFromDisplayName()
        - .ifRecipients()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_SendEmail.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toSendEmail", []))

    @jsii.member(jsii_name="toSendRawEmail")
    def to_send_raw_email(self) -> "Ses":
        '''(experimental) Grants permission to send an email message, with header and content specified by the client.

        Access Level: Write

        Possible conditions:

        - .ifFeedbackAddress()
        - .ifFromAddress()
        - .ifFromDisplayName()
        - .ifRecipients()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_SendRawEmail.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toSendRawEmail", []))

    @jsii.member(jsii_name="toSendTemplatedEmail")
    def to_send_templated_email(self) -> "Ses":
        '''(experimental) Grants permission to compose an email message using an email template.

        Access Level: Write

        Possible conditions:

        - .ifFeedbackAddress()
        - .ifFromAddress()
        - .ifFromDisplayName()
        - .ifRecipients()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_SendTemplatedEmail.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toSendTemplatedEmail", []))

    @jsii.member(jsii_name="toSetActiveReceiptRuleSet")
    def to_set_active_receipt_rule_set(self) -> "Ses":
        '''(experimental) Grants permission to set the specified receipt rule set as the active receipt rule set.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference/API_SetActiveReceiptRuleSet.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toSetActiveReceiptRuleSet", []))

    @jsii.member(jsii_name="toSetIdentityDkimEnabled")
    def to_set_identity_dkim_enabled(self) -> "Ses":
        '''(experimental) Grants permission to enable or disable Easy DKIM signing of email sent from an identity.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference/API_SetIdentityDkimEnabled.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toSetIdentityDkimEnabled", []))

    @jsii.member(jsii_name="toSetIdentityFeedbackForwardingEnabled")
    def to_set_identity_feedback_forwarding_enabled(self) -> "Ses":
        '''(experimental) Grants permission to enable or disable whether Amazon SES forwards bounce and complaint notifications for an identity (an email address or a domain).

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference/API_SetIdentityFeedbackForwardingEnabled.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toSetIdentityFeedbackForwardingEnabled", []))

    @jsii.member(jsii_name="toSetIdentityHeadersInNotificationsEnabled")
    def to_set_identity_headers_in_notifications_enabled(self) -> "Ses":
        '''(experimental) Grants permission to set whether Amazon SES includes the original email headers in the Amazon Simple Notification Service (Amazon SNS) notifications of a specified type for a given identity (an email address or a domain).

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference/API_SetIdentityHeadersInNotificationsEnabled.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toSetIdentityHeadersInNotificationsEnabled", []))

    @jsii.member(jsii_name="toSetIdentityMailFromDomain")
    def to_set_identity_mail_from_domain(self) -> "Ses":
        '''(experimental) Grants permission to enable or disable the custom MAIL FROM domain setup for a verified identity.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference/API_SetIdentityMailFromDomain.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toSetIdentityMailFromDomain", []))

    @jsii.member(jsii_name="toSetIdentityNotificationTopic")
    def to_set_identity_notification_topic(self) -> "Ses":
        '''(experimental) Grants permission to set an Amazon Simple Notification Service (Amazon SNS) topic to use when delivering notifications for a verified identity.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference/API_SetIdentityNotificationTopic.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toSetIdentityNotificationTopic", []))

    @jsii.member(jsii_name="toSetReceiptRulePosition")
    def to_set_receipt_rule_position(self) -> "Ses":
        '''(experimental) Grants permission to set the position of the specified receipt rule in the receipt rule set.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference/API_SetReceiptRulePosition.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toSetReceiptRulePosition", []))

    @jsii.member(jsii_name="toTestRenderTemplate")
    def to_test_render_template(self) -> "Ses":
        '''(experimental) Grants permission to create a preview of the MIME content of an email when provided with a template and a set of replacement data.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference/API_TestRenderTemplate.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toTestRenderTemplate", []))

    @jsii.member(jsii_name="toUpdateAccountSendingEnabled")
    def to_update_account_sending_enabled(self) -> "Ses":
        '''(experimental) Grants permission to enable or disable email sending for your account.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference/API_UpdateAccountSendingEnabled.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toUpdateAccountSendingEnabled", []))

    @jsii.member(jsii_name="toUpdateConfigurationSetEventDestination")
    def to_update_configuration_set_event_destination(self) -> "Ses":
        '''(experimental) Grants permission to update the event destination of a configuration set.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference/API_UpdateConfigurationSetEventDestination.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toUpdateConfigurationSetEventDestination", []))

    @jsii.member(jsii_name="toUpdateConfigurationSetReputationMetricsEnabled")
    def to_update_configuration_set_reputation_metrics_enabled(self) -> "Ses":
        '''(experimental) Grants permission to enable or disable the publishing of reputation metrics for emails sent using a specific configuration set.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference/API_UpdateConfigurationSetReputationMetricsEnabled.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toUpdateConfigurationSetReputationMetricsEnabled", []))

    @jsii.member(jsii_name="toUpdateConfigurationSetSendingEnabled")
    def to_update_configuration_set_sending_enabled(self) -> "Ses":
        '''(experimental) Grants permission to enable or disable email sending for messages sent using a specific configuration set.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference/API_UpdateConfigurationSetSendingEnabled.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toUpdateConfigurationSetSendingEnabled", []))

    @jsii.member(jsii_name="toUpdateConfigurationSetTrackingOptions")
    def to_update_configuration_set_tracking_options(self) -> "Ses":
        '''(experimental) Grants permission to modify an association between a configuration set and a custom domain for open and click event tracking.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference/API_UpdateConfigurationSetTrackingOptions.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toUpdateConfigurationSetTrackingOptions", []))

    @jsii.member(jsii_name="toUpdateCustomVerificationEmailTemplate")
    def to_update_custom_verification_email_template(self) -> "Ses":
        '''(experimental) Grants permission to update an existing custom verification email template.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference/API_UpdateCustomVerificationEmailTemplate.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toUpdateCustomVerificationEmailTemplate", []))

    @jsii.member(jsii_name="toUpdateReceiptRule")
    def to_update_receipt_rule(self) -> "Ses":
        '''(experimental) Grants permission to update a receipt rule.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference/API_UpdateReceiptRule.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toUpdateReceiptRule", []))

    @jsii.member(jsii_name="toUpdateTemplate")
    def to_update_template(self) -> "Ses":
        '''(experimental) Grants permission to update an email template.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference/API_UpdateTemplate.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toUpdateTemplate", []))

    @jsii.member(jsii_name="toVerifyDomainDkim")
    def to_verify_domain_dkim(self) -> "Ses":
        '''(experimental) Grants permission to return a set of DKIM tokens for a domain.

        Access Level: Read

        https://docs.aws.amazon.com/ses/latest/APIReference/API_VerifyDomainDkim.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toVerifyDomainDkim", []))

    @jsii.member(jsii_name="toVerifyDomainIdentity")
    def to_verify_domain_identity(self) -> "Ses":
        '''(experimental) Grants permission to verify a domain.

        Access Level: Read

        https://docs.aws.amazon.com/ses/latest/APIReference/API_VerifyDomainIdentity.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toVerifyDomainIdentity", []))

    @jsii.member(jsii_name="toVerifyEmailAddress")
    def to_verify_email_address(self) -> "Ses":
        '''(experimental) Grants permission to verify an email address.

        Access Level: Read

        https://docs.aws.amazon.com/ses/latest/APIReference/API_VerifyEmailAddress.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toVerifyEmailAddress", []))

    @jsii.member(jsii_name="toVerifyEmailIdentity")
    def to_verify_email_identity(self) -> "Ses":
        '''(experimental) Grants permission to verify an email identity.

        Access Level: Read

        https://docs.aws.amazon.com/ses/latest/APIReference/API_VerifyEmailIdentity.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toVerifyEmailIdentity", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class SesPinpoint(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.SesPinpoint",
):
    '''(experimental) Statement provider for service `ses-pinpoint <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonpinpointemailservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `ses-pinpoint <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonpinpointemailservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(SesPinpoint, self, [sid])

    @jsii.member(jsii_name="ifFeedbackAddress")
    def if_feedback_address(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "SesPinpoint":
        '''(experimental) Filters actions based on the "Return-Path" address, which specifies where bounces and complaints are sent by email feedback forwarding.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonses.html#amazonses-policy-keys

        Applies to actions:

        - .toSendEmail()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "ifFeedbackAddress", [value, operator]))

    @jsii.member(jsii_name="ifFromAddress")
    def if_from_address(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "SesPinpoint":
        '''(experimental) Filters actions based on the "From" address of a message.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonses.html#amazonses-policy-keys

        Applies to actions:

        - .toSendEmail()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "ifFromAddress", [value, operator]))

    @jsii.member(jsii_name="ifFromDisplayName")
    def if_from_display_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "SesPinpoint":
        '''(experimental) Filters actions based on the "From" address that is used as the display name of a message.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonses.html#amazonses-policy-keys

        Applies to actions:

        - .toSendEmail()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "ifFromDisplayName", [value, operator]))

    @jsii.member(jsii_name="ifRecipients")
    def if_recipients(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "SesPinpoint":
        '''(experimental) Filters actions based on the recipient addresses of a message, which include the "To", "CC", and "BCC" addresses.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonses.html#amazonses-policy-keys

        Applies to actions:

        - .toSendEmail()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "ifRecipients", [value, operator]))

    @jsii.member(jsii_name="onConfigurationSet")
    def on_configuration_set(
        self,
        configuration_set_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SesPinpoint":
        '''(experimental) Adds a resource of type configuration-set to the statement.

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_CreateConfigurationSet.html

        :param configuration_set_name: - Identifier for the configurationSetName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "onConfigurationSet", [configuration_set_name, account, region, partition]))

    @jsii.member(jsii_name="onDedicatedIpPool")
    def on_dedicated_ip_pool(
        self,
        dedicated_ip_pool: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SesPinpoint":
        '''(experimental) Adds a resource of type dedicated-ip-pool to the statement.

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_DedicatedIp.html

        :param dedicated_ip_pool: - Identifier for the dedicatedIPPool.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "onDedicatedIpPool", [dedicated_ip_pool, account, region, partition]))

    @jsii.member(jsii_name="onDeliverabilityTestReport")
    def on_deliverability_test_report(
        self,
        report_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SesPinpoint":
        '''(experimental) Adds a resource of type deliverability-test-report to the statement.

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_DeliverabilityTestReport.html

        :param report_id: - Identifier for the reportId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "onDeliverabilityTestReport", [report_id, account, region, partition]))

    @jsii.member(jsii_name="onIdentity")
    def on_identity(
        self,
        identity_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SesPinpoint":
        '''(experimental) Adds a resource of type identity to the statement.

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_IdentityInfo.html

        :param identity_name: - Identifier for the identityName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "onIdentity", [identity_name, account, region, partition]))

    @jsii.member(jsii_name="toCreateConfigurationSet")
    def to_create_configuration_set(self) -> "SesPinpoint":
        '''(experimental) Grants permission to create a configuration set.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_CreateConfigurationSet.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toCreateConfigurationSet", []))

    @jsii.member(jsii_name="toCreateConfigurationSetEventDestination")
    def to_create_configuration_set_event_destination(self) -> "SesPinpoint":
        '''(experimental) Grants permission to create a configuration set event destination.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_CreateConfigurationSetEventDestination.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toCreateConfigurationSetEventDestination", []))

    @jsii.member(jsii_name="toCreateDedicatedIpPool")
    def to_create_dedicated_ip_pool(self) -> "SesPinpoint":
        '''(experimental) Grants permission to create a new pool of dedicated IP addresses.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_CreateDedicatedIpPool.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toCreateDedicatedIpPool", []))

    @jsii.member(jsii_name="toCreateDeliverabilityTestReport")
    def to_create_deliverability_test_report(self) -> "SesPinpoint":
        '''(experimental) Grants permission to create a new predictive inbox placement test.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_CreateDeliverabilityTestReport.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toCreateDeliverabilityTestReport", []))

    @jsii.member(jsii_name="toCreateEmailIdentity")
    def to_create_email_identity(self) -> "SesPinpoint":
        '''(experimental) Grants permission to start the process of verifying an email identity.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_CreateEmailIdentity.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toCreateEmailIdentity", []))

    @jsii.member(jsii_name="toDeleteConfigurationSet")
    def to_delete_configuration_set(self) -> "SesPinpoint":
        '''(experimental) Grants permission to delete an existing configuration set.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_DeleteConfigurationSet.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toDeleteConfigurationSet", []))

    @jsii.member(jsii_name="toDeleteConfigurationSetEventDestination")
    def to_delete_configuration_set_event_destination(self) -> "SesPinpoint":
        '''(experimental) Grants permission to delete an event destination.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_DeleteConfigurationSetEventDestination.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toDeleteConfigurationSetEventDestination", []))

    @jsii.member(jsii_name="toDeleteDedicatedIpPool")
    def to_delete_dedicated_ip_pool(self) -> "SesPinpoint":
        '''(experimental) Grants permission to delete a dedicated IP pool.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_DeleteDedicatedIpPool.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toDeleteDedicatedIpPool", []))

    @jsii.member(jsii_name="toDeleteEmailIdentity")
    def to_delete_email_identity(self) -> "SesPinpoint":
        '''(experimental) Grants permission to delete an email identity that you previously verified.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_DeleteEmailIdentity.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toDeleteEmailIdentity", []))

    @jsii.member(jsii_name="toGetAccount")
    def to_get_account(self) -> "SesPinpoint":
        '''(experimental) Grants permission to get information about the email-sending status and capabilities.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_GetAccount.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toGetAccount", []))

    @jsii.member(jsii_name="toGetBlacklistReports")
    def to_get_blacklist_reports(self) -> "SesPinpoint":
        '''(experimental) Grants permission to retrieve a list of the deny lists on which your dedicated IP addresses appear.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_GetBlacklistReports.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toGetBlacklistReports", []))

    @jsii.member(jsii_name="toGetConfigurationSet")
    def to_get_configuration_set(self) -> "SesPinpoint":
        '''(experimental) Grants permission to get information about an existing configuration set.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_GetConfigurationSet.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toGetConfigurationSet", []))

    @jsii.member(jsii_name="toGetConfigurationSetEventDestinations")
    def to_get_configuration_set_event_destinations(self) -> "SesPinpoint":
        '''(experimental) Grants permission to retrieve a list of event destinations that are associated with a configuration set.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_GetConfigurationSetEventDestinations.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toGetConfigurationSetEventDestinations", []))

    @jsii.member(jsii_name="toGetDedicatedIp")
    def to_get_dedicated_ip(self) -> "SesPinpoint":
        '''(experimental) Grants permission to get information about a dedicated IP address.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_GetDedicatedIp.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toGetDedicatedIp", []))

    @jsii.member(jsii_name="toGetDedicatedIps")
    def to_get_dedicated_ips(self) -> "SesPinpoint":
        '''(experimental) Grants permission to list the dedicated IP addresses that are associated with your account.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_GetDedicatedIps.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toGetDedicatedIps", []))

    @jsii.member(jsii_name="toGetDeliverabilityDashboardOptions")
    def to_get_deliverability_dashboard_options(self) -> "SesPinpoint":
        '''(experimental) Grants permission to get the status of the Deliverability dashboard.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_GetDeliverabilityDashboardOptions.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toGetDeliverabilityDashboardOptions", []))

    @jsii.member(jsii_name="toGetDeliverabilityTestReport")
    def to_get_deliverability_test_report(self) -> "SesPinpoint":
        '''(experimental) Grants permission to retrieve the results of a predictive inbox placement test.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_GetDeliverabilityTestReport.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toGetDeliverabilityTestReport", []))

    @jsii.member(jsii_name="toGetDomainDeliverabilityCampaign")
    def to_get_domain_deliverability_campaign(self) -> "SesPinpoint":
        '''(experimental) Grants permission to retrieve all the deliverability data for a specific campaign.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_GetDomainDeliverabilityCampaign.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toGetDomainDeliverabilityCampaign", []))

    @jsii.member(jsii_name="toGetDomainStatisticsReport")
    def to_get_domain_statistics_report(self) -> "SesPinpoint":
        '''(experimental) Grants permission to retrieve inbox placement and engagement rates for the domains that you use to send email.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_GetDomainStatisticsReport.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toGetDomainStatisticsReport", []))

    @jsii.member(jsii_name="toGetEmailIdentity")
    def to_get_email_identity(self) -> "SesPinpoint":
        '''(experimental) Grants permission to get information about a specific identity associated with your account.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_GetEmailIdentity.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toGetEmailIdentity", []))

    @jsii.member(jsii_name="toListConfigurationSets")
    def to_list_configuration_sets(self) -> "SesPinpoint":
        '''(experimental) Grants permission to list all of the configuration sets associated with your account.

        Access Level: List

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_ListConfigurationSets.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toListConfigurationSets", []))

    @jsii.member(jsii_name="toListDedicatedIpPools")
    def to_list_dedicated_ip_pools(self) -> "SesPinpoint":
        '''(experimental) Grants permission to list all of the dedicated IP pools that exist in your account.

        Access Level: List

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_ListDedicatedIpPools.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toListDedicatedIpPools", []))

    @jsii.member(jsii_name="toListDeliverabilityTestReports")
    def to_list_deliverability_test_reports(self) -> "SesPinpoint":
        '''(experimental) Grants permission to retrieve a list of the predictive inbox placement tests that you've performed, regardless of their statuses.

        Access Level: List

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_ListDeliverabilityTestReports.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toListDeliverabilityTestReports", []))

    @jsii.member(jsii_name="toListDomainDeliverabilityCampaigns")
    def to_list_domain_deliverability_campaigns(self) -> "SesPinpoint":
        '''(experimental) Grants permission to retrieve deliverability data for all the campaigns that used a specific domain to send email during a specified time range.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_ListDomainDeliverabilityCampaigns.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toListDomainDeliverabilityCampaigns", []))

    @jsii.member(jsii_name="toListEmailIdentities")
    def to_list_email_identities(self) -> "SesPinpoint":
        '''(experimental) Grants permission to list all of the email identities that are associated with your account.

        Access Level: List

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_ListEmailIdentities.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toListEmailIdentities", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "SesPinpoint":
        '''(experimental) Grants permission to retrieve a list of the tags (keys and values) that are associated with a specific resource.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutAccountDedicatedIpWarmupAttributes")
    def to_put_account_dedicated_ip_warmup_attributes(self) -> "SesPinpoint":
        '''(experimental) Grants permission to enable or disable the automatic warm-up feature for dedicated IP addresses.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_PutAccountDedicatedIpWarmupAttributes.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toPutAccountDedicatedIpWarmupAttributes", []))

    @jsii.member(jsii_name="toPutAccountSendingAttributes")
    def to_put_account_sending_attributes(self) -> "SesPinpoint":
        '''(experimental) Grants permission to enable or disable the ability of your account to send email.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_PutAccountSendingAttributes.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toPutAccountSendingAttributes", []))

    @jsii.member(jsii_name="toPutConfigurationSetDeliveryOptions")
    def to_put_configuration_set_delivery_options(self) -> "SesPinpoint":
        '''(experimental) Grants permission to associate a configuration set with a dedicated IP pool.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_PutConfigurationSetDeliveryOptions.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toPutConfigurationSetDeliveryOptions", []))

    @jsii.member(jsii_name="toPutConfigurationSetReputationOptions")
    def to_put_configuration_set_reputation_options(self) -> "SesPinpoint":
        '''(experimental) Grants permission to enable or disable collection of reputation metrics for emails that you send using a particular configuration set.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_PutConfigurationSetReputationOptions.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toPutConfigurationSetReputationOptions", []))

    @jsii.member(jsii_name="toPutConfigurationSetSendingOptions")
    def to_put_configuration_set_sending_options(self) -> "SesPinpoint":
        '''(experimental) Grants permission to enable or disable email sending for messages that use a particular configuration set.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_PutConfigurationSetSendingOptions.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toPutConfigurationSetSendingOptions", []))

    @jsii.member(jsii_name="toPutConfigurationSetTrackingOptions")
    def to_put_configuration_set_tracking_options(self) -> "SesPinpoint":
        '''(experimental) Grants permission to specify a custom domain to use for open and click tracking elements in email that you send using a particular configuration set.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_PutConfigurationSetTrackingOptions.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toPutConfigurationSetTrackingOptions", []))

    @jsii.member(jsii_name="toPutDedicatedIpInPool")
    def to_put_dedicated_ip_in_pool(self) -> "SesPinpoint":
        '''(experimental) Grants permission to move a dedicated IP address to an existing dedicated IP pool.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_PutDedicatedIpInPool.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toPutDedicatedIpInPool", []))

    @jsii.member(jsii_name="toPutDedicatedIpWarmupAttributes")
    def to_put_dedicated_ip_warmup_attributes(self) -> "SesPinpoint":
        '''(experimental) Grants permission to enable dedicated IP warm up attributes.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_PutDedicatedIpWarmupAttributes.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toPutDedicatedIpWarmupAttributes", []))

    @jsii.member(jsii_name="toPutDeliverabilityDashboardOption")
    def to_put_deliverability_dashboard_option(self) -> "SesPinpoint":
        '''(experimental) Grants permission to enable or disable the Deliverability dashboard.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_PutDeliverabilityDashboardOption.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toPutDeliverabilityDashboardOption", []))

    @jsii.member(jsii_name="toPutEmailIdentityDkimAttributes")
    def to_put_email_identity_dkim_attributes(self) -> "SesPinpoint":
        '''(experimental) Grants permission to enable or disable DKIM authentication for an email identity.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_PutEmailIdentityDkimAttributes.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toPutEmailIdentityDkimAttributes", []))

    @jsii.member(jsii_name="toPutEmailIdentityFeedbackAttributes")
    def to_put_email_identity_feedback_attributes(self) -> "SesPinpoint":
        '''(experimental) Grants permission to enable or disable feedback forwarding for an identity.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_PutEmailIdentityFeedbackAttributes.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toPutEmailIdentityFeedbackAttributes", []))

    @jsii.member(jsii_name="toPutEmailIdentityMailFromAttributes")
    def to_put_email_identity_mail_from_attributes(self) -> "SesPinpoint":
        '''(experimental) Grants permission to enable or disable the custom MAIL FROM domain configuration for an email identity.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_PutEmailIdentityMailFromAttributes.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toPutEmailIdentityMailFromAttributes", []))

    @jsii.member(jsii_name="toSendEmail")
    def to_send_email(self) -> "SesPinpoint":
        '''(experimental) Grants permission to send an email message.

        Access Level: Write

        Possible conditions:

        - .ifFeedbackAddress()
        - .ifFromAddress()
        - .ifFromDisplayName()
        - .ifRecipients()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_SendEmail.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toSendEmail", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "SesPinpoint":
        '''(experimental) Grants permission to add one or more tags (keys and values) to a specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "SesPinpoint":
        '''(experimental) Grants permission to remove one or more tags (keys and values) from a specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateConfigurationSetEventDestination")
    def to_update_configuration_set_event_destination(self) -> "SesPinpoint":
        '''(experimental) Grants permission to update the configuration of an event destination for a configuration set.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_UpdateConfigurationSetEventDestination.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toUpdateConfigurationSetEventDestination", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class SesV2(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.SesV2"):
    '''(experimental) Statement provider for service `ses-v2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsimpleemailservicev2.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `ses-v2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsimpleemailservicev2.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(SesV2, self, [sid])

    @jsii.member(jsii_name="ifFeedbackAddress")
    def if_feedback_address(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "SesV2":
        '''(experimental) Filters actions based on the "Return-Path" address, which specifies where bounces and complaints are sent by email feedback forwarding.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonses.html#amazonses-policy-keys

        Applies to actions:

        - .toSendEmail()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "ifFeedbackAddress", [value, operator]))

    @jsii.member(jsii_name="ifFromAddress")
    def if_from_address(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "SesV2":
        '''(experimental) Filters actions based on the "From" address of a message.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonses.html#amazonses-policy-keys

        Applies to actions:

        - .toSendEmail()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "ifFromAddress", [value, operator]))

    @jsii.member(jsii_name="ifFromDisplayName")
    def if_from_display_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "SesV2":
        '''(experimental) Filters actions based on the "From" address that is used as the display name of a message.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonses.html#amazonses-policy-keys

        Applies to actions:

        - .toSendEmail()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "ifFromDisplayName", [value, operator]))

    @jsii.member(jsii_name="ifRecipients")
    def if_recipients(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "SesV2":
        '''(experimental) Filters actions based on the recipient addresses of a message, which include the "To", "CC", and "BCC" addresses.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonses.html#amazonses-policy-keys

        Applies to actions:

        - .toSendEmail()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "ifRecipients", [value, operator]))

    @jsii.member(jsii_name="onConfigurationSet")
    def on_configuration_set(
        self,
        configuration_set_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SesV2":
        '''(experimental) Adds a resource of type configuration-set to the statement.

        https://docs.aws.amazon.com/ses/latest/APIReference/API_ConfigurationSet.html

        :param configuration_set_name: - Identifier for the configurationSetName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "onConfigurationSet", [configuration_set_name, account, region, partition]))

    @jsii.member(jsii_name="onContactList")
    def on_contact_list(
        self,
        contact_list_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SesV2":
        '''(experimental) Adds a resource of type contact-list to the statement.

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_ContactList.html

        :param contact_list_name: - Identifier for the contactListName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "onContactList", [contact_list_name, account, region, partition]))

    @jsii.member(jsii_name="onCustomVerificationEmailTemplate")
    def on_custom_verification_email_template(
        self,
        template_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SesV2":
        '''(experimental) Adds a resource of type custom-verification-email-template to the statement.

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_CustomVerificationEmailTemplateMetadata.html

        :param template_name: - Identifier for the templateName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "onCustomVerificationEmailTemplate", [template_name, account, region, partition]))

    @jsii.member(jsii_name="onDedicatedIpPool")
    def on_dedicated_ip_pool(
        self,
        dedicated_ip_pool: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SesV2":
        '''(experimental) Adds a resource of type dedicated-ip-pool to the statement.

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_DedicatedIp.html

        :param dedicated_ip_pool: - Identifier for the dedicatedIPPool.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "onDedicatedIpPool", [dedicated_ip_pool, account, region, partition]))

    @jsii.member(jsii_name="onDeliverabilityTestReport")
    def on_deliverability_test_report(
        self,
        report_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SesV2":
        '''(experimental) Adds a resource of type deliverability-test-report to the statement.

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_DeliverabilityTestReport.html

        :param report_id: - Identifier for the reportId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "onDeliverabilityTestReport", [report_id, account, region, partition]))

    @jsii.member(jsii_name="onIdentity")
    def on_identity(
        self,
        identity_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SesV2":
        '''(experimental) Adds a resource of type identity to the statement.

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_IdentityInfo.html

        :param identity_name: - Identifier for the identityName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "onIdentity", [identity_name, account, region, partition]))

    @jsii.member(jsii_name="onImportJob")
    def on_import_job(
        self,
        import_job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SesV2":
        '''(experimental) Adds a resource of type import-job to the statement.

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_ImportJobSummary.html

        :param import_job_id: - Identifier for the importJobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "onImportJob", [import_job_id, account, region, partition]))

    @jsii.member(jsii_name="onTemplate")
    def on_template(
        self,
        template_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SesV2":
        '''(experimental) Adds a resource of type template to the statement.

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_Template.html

        :param template_name: - Identifier for the templateName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "onTemplate", [template_name, account, region, partition]))

    @jsii.member(jsii_name="toCreateConfigurationSet")
    def to_create_configuration_set(self) -> "SesV2":
        '''(experimental) Grants permission to create a new configuration set.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_CreateConfigurationSet.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toCreateConfigurationSet", []))

    @jsii.member(jsii_name="toCreateConfigurationSetEventDestination")
    def to_create_configuration_set_event_destination(self) -> "SesV2":
        '''(experimental) Grants permission to create a configuration set event destination.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_CreateConfigurationSetEventDestination.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toCreateConfigurationSetEventDestination", []))

    @jsii.member(jsii_name="toCreateContact")
    def to_create_contact(self) -> "SesV2":
        '''(experimental) Grants permission to create a contact.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_CreateContact.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toCreateContact", []))

    @jsii.member(jsii_name="toCreateContactList")
    def to_create_contact_list(self) -> "SesV2":
        '''(experimental) Grants permission to create a contact list.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_CreateContactList.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toCreateContactList", []))

    @jsii.member(jsii_name="toCreateCustomVerificationEmailTemplate")
    def to_create_custom_verification_email_template(self) -> "SesV2":
        '''(experimental) Grants permission to create a new custom verification email template.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_CreateCustomVerificationEmailTemplate.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toCreateCustomVerificationEmailTemplate", []))

    @jsii.member(jsii_name="toCreateDedicatedIpPool")
    def to_create_dedicated_ip_pool(self) -> "SesV2":
        '''(experimental) Grants permission to create a new pool of dedicated IP addresses.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_CreateDedicatedIpPool.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toCreateDedicatedIpPool", []))

    @jsii.member(jsii_name="toCreateDeliverabilityTestReport")
    def to_create_deliverability_test_report(self) -> "SesV2":
        '''(experimental) Grants permission to create a new predictive inbox placement test.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_CreateDeliverabilityTestReport.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toCreateDeliverabilityTestReport", []))

    @jsii.member(jsii_name="toCreateEmailIdentity")
    def to_create_email_identity(self) -> "SesV2":
        '''(experimental) Grants permission to start the process of verifying an email identity.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_CreateEmailIdentity.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toCreateEmailIdentity", []))

    @jsii.member(jsii_name="toCreateEmailIdentityPolicy")
    def to_create_email_identity_policy(self) -> "SesV2":
        '''(experimental) Grants permission to create the specified sending authorization policy for the given identity.

        Access Level: Permissions management

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_CreateEmailIdentityPolicy.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toCreateEmailIdentityPolicy", []))

    @jsii.member(jsii_name="toCreateEmailTemplate")
    def to_create_email_template(self) -> "SesV2":
        '''(experimental) Grants permission to create an email template.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_CreateEmailTemplate.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toCreateEmailTemplate", []))

    @jsii.member(jsii_name="toCreateImportJob")
    def to_create_import_job(self) -> "SesV2":
        '''(experimental) Grants permission to creates an import job for a data destination.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_CreateImportJob.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toCreateImportJob", []))

    @jsii.member(jsii_name="toDeleteConfigurationSet")
    def to_delete_configuration_set(self) -> "SesV2":
        '''(experimental) Grants permission to delete an existing configuration set.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_DeleteConfigurationSet.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toDeleteConfigurationSet", []))

    @jsii.member(jsii_name="toDeleteConfigurationSetEventDestination")
    def to_delete_configuration_set_event_destination(self) -> "SesV2":
        '''(experimental) Grants permission to delete an event destination.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_DeleteConfigurationSetEventDestination.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toDeleteConfigurationSetEventDestination", []))

    @jsii.member(jsii_name="toDeleteContact")
    def to_delete_contact(self) -> "SesV2":
        '''(experimental) Grants permission to delete a contact from a contact list.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_DeleteContact.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toDeleteContact", []))

    @jsii.member(jsii_name="toDeleteContactList")
    def to_delete_contact_list(self) -> "SesV2":
        '''(experimental) Grants permission to delete a contact list with all of its contacts.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_DeleteContactList.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toDeleteContactList", []))

    @jsii.member(jsii_name="toDeleteCustomVerificationEmailTemplate")
    def to_delete_custom_verification_email_template(self) -> "SesV2":
        '''(experimental) Grants permission to delete an existing custom verification email template.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_DeleteCustomVerificationEmailTemplate.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toDeleteCustomVerificationEmailTemplate", []))

    @jsii.member(jsii_name="toDeleteDedicatedIpPool")
    def to_delete_dedicated_ip_pool(self) -> "SesV2":
        '''(experimental) Grants permission to delete a dedicated IP pool.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_DeleteDedicatedIpPool.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toDeleteDedicatedIpPool", []))

    @jsii.member(jsii_name="toDeleteEmailIdentity")
    def to_delete_email_identity(self) -> "SesV2":
        '''(experimental) Grants permission to delete an email identity.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_DeleteEmailIdentity.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toDeleteEmailIdentity", []))

    @jsii.member(jsii_name="toDeleteEmailIdentityPolicy")
    def to_delete_email_identity_policy(self) -> "SesV2":
        '''(experimental) Grants permission to delete the specified sending authorization policy for the given identity (an email address or a domain).

        Access Level: Permissions management

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_DeleteEmailIdentityPolicy.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toDeleteEmailIdentityPolicy", []))

    @jsii.member(jsii_name="toDeleteEmailTemplate")
    def to_delete_email_template(self) -> "SesV2":
        '''(experimental) Grants permission to delete an email template.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_DeleteEmailTemplate.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toDeleteEmailTemplate", []))

    @jsii.member(jsii_name="toDeleteSuppressedDestination")
    def to_delete_suppressed_destination(self) -> "SesV2":
        '''(experimental) Grants permission to remove an email address from the suppression list for your account.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_DeleteSuppressedDestination.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toDeleteSuppressedDestination", []))

    @jsii.member(jsii_name="toGetAccount")
    def to_get_account(self) -> "SesV2":
        '''(experimental) Grants permission to get information about the email-sending status and capabilities for your account.

        Access Level: Read

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetAccount.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toGetAccount", []))

    @jsii.member(jsii_name="toGetBlacklistReports")
    def to_get_blacklist_reports(self) -> "SesV2":
        '''(experimental) Grants permission to retrieve a list of the deny lists on which your dedicated IP addresses or tracked domains appear.

        Access Level: Read

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetBlacklistReports.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toGetBlacklistReports", []))

    @jsii.member(jsii_name="toGetConfigurationSet")
    def to_get_configuration_set(self) -> "SesV2":
        '''(experimental) Grants permission to get information about an existing configuration set.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetConfigurationSet.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toGetConfigurationSet", []))

    @jsii.member(jsii_name="toGetConfigurationSetEventDestinations")
    def to_get_configuration_set_event_destinations(self) -> "SesV2":
        '''(experimental) Grants permission to retrieve a list of event destinations that are associated with a configuration set.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetConfigurationSetEventDestinations.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toGetConfigurationSetEventDestinations", []))

    @jsii.member(jsii_name="toGetContact")
    def to_get_contact(self) -> "SesV2":
        '''(experimental) Grants permission to return a contact from a contact list.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetContact.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toGetContact", []))

    @jsii.member(jsii_name="toGetContactList")
    def to_get_contact_list(self) -> "SesV2":
        '''(experimental) Grants permission to return contact list metadata.

        Access Level: Read

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetContactList.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toGetContactList", []))

    @jsii.member(jsii_name="toGetCustomVerificationEmailTemplate")
    def to_get_custom_verification_email_template(self) -> "SesV2":
        '''(experimental) Grants permission to return the custom email verification template for the template name you specify.

        Access Level: Read

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetCustomVerificationEmailTemplate.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toGetCustomVerificationEmailTemplate", []))

    @jsii.member(jsii_name="toGetDedicatedIp")
    def to_get_dedicated_ip(self) -> "SesV2":
        '''(experimental) Grants permission to get information about a dedicated IP address.

        Access Level: Read

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetDedicatedIp.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toGetDedicatedIp", []))

    @jsii.member(jsii_name="toGetDedicatedIps")
    def to_get_dedicated_ips(self) -> "SesV2":
        '''(experimental) Grants permission to list the dedicated IP addresses a dedicated IP pool.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetDedicatedIps.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toGetDedicatedIps", []))

    @jsii.member(jsii_name="toGetDeliverabilityDashboardOptions")
    def to_get_deliverability_dashboard_options(self) -> "SesV2":
        '''(experimental) Grants permission to get the status of the Deliverability dashboard.

        Access Level: Read

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetDeliverabilityDashboardOptions.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toGetDeliverabilityDashboardOptions", []))

    @jsii.member(jsii_name="toGetDeliverabilityTestReport")
    def to_get_deliverability_test_report(self) -> "SesV2":
        '''(experimental) Grants permission to retrieve the results of a predictive inbox placement test.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetDeliverabilityTestReport.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toGetDeliverabilityTestReport", []))

    @jsii.member(jsii_name="toGetDomainDeliverabilityCampaign")
    def to_get_domain_deliverability_campaign(self) -> "SesV2":
        '''(experimental) Grants permission to retrieve all the deliverability data for a specific campaign.

        Access Level: Read

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetDomainDeliverabilityCampaign.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toGetDomainDeliverabilityCampaign", []))

    @jsii.member(jsii_name="toGetDomainStatisticsReport")
    def to_get_domain_statistics_report(self) -> "SesV2":
        '''(experimental) Grants permission to retrieve inbox placement and engagement rates for the domains that you use to send email.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetDomainStatisticsReport.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toGetDomainStatisticsReport", []))

    @jsii.member(jsii_name="toGetEmailIdentity")
    def to_get_email_identity(self) -> "SesV2":
        '''(experimental) Grants permission to get information about a specific identity.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetEmailIdentity.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toGetEmailIdentity", []))

    @jsii.member(jsii_name="toGetEmailIdentityPolicies")
    def to_get_email_identity_policies(self) -> "SesV2":
        '''(experimental) Grants permission to return the requested sending authorization policies for the given identity (an email address or a domain).

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetEmailIdentityPolicies.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toGetEmailIdentityPolicies", []))

    @jsii.member(jsii_name="toGetEmailTemplate")
    def to_get_email_template(self) -> "SesV2":
        '''(experimental) Grants permission to return the template object, which includes the subject line, HTML part, and text part for the template you specify.

        Access Level: Read

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetEmailTemplate.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toGetEmailTemplate", []))

    @jsii.member(jsii_name="toGetImportJob")
    def to_get_import_job(self) -> "SesV2":
        '''(experimental) Grants permission to provide information about an import job.

        Access Level: Read

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetImportJob.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toGetImportJob", []))

    @jsii.member(jsii_name="toGetSuppressedDestination")
    def to_get_suppressed_destination(self) -> "SesV2":
        '''(experimental) Grants permission to retrieve information about a specific email address that's on the suppression list for your account.

        Access Level: Read

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetSuppressedDestination.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toGetSuppressedDestination", []))

    @jsii.member(jsii_name="toListConfigurationSets")
    def to_list_configuration_sets(self) -> "SesV2":
        '''(experimental) Grants permission to list all of the configuration sets for your account.

        Access Level: List

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_ListConfigurationSets.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toListConfigurationSets", []))

    @jsii.member(jsii_name="toListContactLists")
    def to_list_contact_lists(self) -> "SesV2":
        '''(experimental) Grants permission to list all of the contact lists available for your account.

        Access Level: List

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_ListContactLists.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toListContactLists", []))

    @jsii.member(jsii_name="toListContacts")
    def to_list_contacts(self) -> "SesV2":
        '''(experimental) Grants permission to list the contacts present in a specific contact list.

        Access Level: List

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_ListContacts.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toListContacts", []))

    @jsii.member(jsii_name="toListCustomVerificationEmailTemplates")
    def to_list_custom_verification_email_templates(self) -> "SesV2":
        '''(experimental) Grants permission to list all of the existing custom verification email templates for your account.

        Access Level: List

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_ListCustomVerificationEmailTemplates.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toListCustomVerificationEmailTemplates", []))

    @jsii.member(jsii_name="toListDedicatedIpPools")
    def to_list_dedicated_ip_pools(self) -> "SesV2":
        '''(experimental) Grants permission to list all of the dedicated IP pools for your account.

        Access Level: List

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_ListDedicatedIpPools.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toListDedicatedIpPools", []))

    @jsii.member(jsii_name="toListDeliverabilityTestReports")
    def to_list_deliverability_test_reports(self) -> "SesV2":
        '''(experimental) Grants permission to retrieve the list of the predictive inbox placement tests that you've performed, regardless of their statuses, for your account.

        Access Level: List

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_ListDeliverabilityTestReports.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toListDeliverabilityTestReports", []))

    @jsii.member(jsii_name="toListDomainDeliverabilityCampaigns")
    def to_list_domain_deliverability_campaigns(self) -> "SesV2":
        '''(experimental) Grants permission to list deliverability data for campaigns that used a specific domain to send email during a specified time range.

        Access Level: Read

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_ListDomainDeliverabilityCampaigns.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toListDomainDeliverabilityCampaigns", []))

    @jsii.member(jsii_name="toListEmailIdentities")
    def to_list_email_identities(self) -> "SesV2":
        '''(experimental) Grants permission to list the email identities for your account.

        Access Level: List

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_ListEmailIdentities.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toListEmailIdentities", []))

    @jsii.member(jsii_name="toListEmailTemplates")
    def to_list_email_templates(self) -> "SesV2":
        '''(experimental) Grants permission to list all of the email templates for your account.

        Access Level: List

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_ListEmailTemplates.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toListEmailTemplates", []))

    @jsii.member(jsii_name="toListImportJobs")
    def to_list_import_jobs(self) -> "SesV2":
        '''(experimental) Grants permission to list all of the import jobs for your account.

        Access Level: List

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_ListImportJobs.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toListImportJobs", []))

    @jsii.member(jsii_name="toListSuppressedDestinations")
    def to_list_suppressed_destinations(self) -> "SesV2":
        '''(experimental) Grants permission to list email addresses that are on the suppression list for your account.

        Access Level: Read

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_ListSuppressedDestinations.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toListSuppressedDestinations", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "SesV2":
        '''(experimental) Grants permission to retrieve a list of the tags (keys and values) that are associated with a specific resource for your account.

        Access Level: Read

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutAccountDedicatedIpWarmupAttributes")
    def to_put_account_dedicated_ip_warmup_attributes(self) -> "SesV2":
        '''(experimental) Grants permission to enable or disable the automatic warm-up feature for dedicated IP addresses.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutAccountDedicatedIpWarmupAttributes.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutAccountDedicatedIpWarmupAttributes", []))

    @jsii.member(jsii_name="toPutAccountDetails")
    def to_put_account_details(self) -> "SesV2":
        '''(experimental) Grants permission to update your account details.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutAccountDetails.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutAccountDetails", []))

    @jsii.member(jsii_name="toPutAccountSendingAttributes")
    def to_put_account_sending_attributes(self) -> "SesV2":
        '''(experimental) Grants permission to enable or disable the ability to send email for your account.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutAccountSendingAttributes.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutAccountSendingAttributes", []))

    @jsii.member(jsii_name="toPutAccountSuppressionAttributes")
    def to_put_account_suppression_attributes(self) -> "SesV2":
        '''(experimental) Grants permission to change the settings for the account-level suppression list.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutAccountSuppressionAttributes.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutAccountSuppressionAttributes", []))

    @jsii.member(jsii_name="toPutConfigurationSetDeliveryOptions")
    def to_put_configuration_set_delivery_options(self) -> "SesV2":
        '''(experimental) Grants permission to associate a configuration set with a dedicated IP pool.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutConfigurationSetDeliveryOptions.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutConfigurationSetDeliveryOptions", []))

    @jsii.member(jsii_name="toPutConfigurationSetReputationOptions")
    def to_put_configuration_set_reputation_options(self) -> "SesV2":
        '''(experimental) Grants permission to enable or disable collection of reputation metrics for emails that you send using a particular configuration set.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutConfigurationSetReputationOptions.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutConfigurationSetReputationOptions", []))

    @jsii.member(jsii_name="toPutConfigurationSetSendingOptions")
    def to_put_configuration_set_sending_options(self) -> "SesV2":
        '''(experimental) Grants permission to enable or disable email sending for messages that use a particular configuration set.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutConfigurationSetSendingOptions.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutConfigurationSetSendingOptions", []))

    @jsii.member(jsii_name="toPutConfigurationSetSuppressionOptions")
    def to_put_configuration_set_suppression_options(self) -> "SesV2":
        '''(experimental) Grants permission to specify the account suppression list preferences for a particular configuration set.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutConfigurationSetSuppressionOptions.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutConfigurationSetSuppressionOptions", []))

    @jsii.member(jsii_name="toPutConfigurationSetTrackingOptions")
    def to_put_configuration_set_tracking_options(self) -> "SesV2":
        '''(experimental) Grants permission to specify a custom domain to use for open and click tracking elements in email that you send for a particular configuration set.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutConfigurationSetTrackingOptions.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutConfigurationSetTrackingOptions", []))

    @jsii.member(jsii_name="toPutDedicatedIpInPool")
    def to_put_dedicated_ip_in_pool(self) -> "SesV2":
        '''(experimental) Grants permission to move a dedicated IP address to an existing dedicated IP pool.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutDedicatedIpInPool.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutDedicatedIpInPool", []))

    @jsii.member(jsii_name="toPutDedicatedIpWarmupAttributes")
    def to_put_dedicated_ip_warmup_attributes(self) -> "SesV2":
        '''(experimental) Grants permission to put Dedicated IP warm up attributes.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutDedicatedIpWarmupAttributes.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutDedicatedIpWarmupAttributes", []))

    @jsii.member(jsii_name="toPutDeliverabilityDashboardOption")
    def to_put_deliverability_dashboard_option(self) -> "SesV2":
        '''(experimental) Grants permission to enable or disable the Deliverability dashboard.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutDeliverabilityDashboardOption.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutDeliverabilityDashboardOption", []))

    @jsii.member(jsii_name="toPutEmailIdentityConfigurationSetAttributes")
    def to_put_email_identity_configuration_set_attributes(self) -> "SesV2":
        '''(experimental) Grants permission to associate a configuration set with an email identity.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutEmailIdentityConfigurationSetAttributes.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutEmailIdentityConfigurationSetAttributes", []))

    @jsii.member(jsii_name="toPutEmailIdentityDkimAttributes")
    def to_put_email_identity_dkim_attributes(self) -> "SesV2":
        '''(experimental) Grants permission to enable or disable DKIM authentication for an email identity.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutEmailIdentityDkimAttributes.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutEmailIdentityDkimAttributes", []))

    @jsii.member(jsii_name="toPutEmailIdentityDkimSigningAttributes")
    def to_put_email_identity_dkim_signing_attributes(self) -> "SesV2":
        '''(experimental) Grants permission to configure or change the DKIM authentication settings for an email domain identity.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutEmailIdentityDkimSigningAttributes.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutEmailIdentityDkimSigningAttributes", []))

    @jsii.member(jsii_name="toPutEmailIdentityFeedbackAttributes")
    def to_put_email_identity_feedback_attributes(self) -> "SesV2":
        '''(experimental) Grants permission to enable or disable feedback forwarding for an email identity.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutEmailIdentityFeedbackAttributes.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutEmailIdentityFeedbackAttributes", []))

    @jsii.member(jsii_name="toPutEmailIdentityMailFromAttributes")
    def to_put_email_identity_mail_from_attributes(self) -> "SesV2":
        '''(experimental) Grants permission to enable or disable the custom MAIL FROM domain configuration for an email identity.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutEmailIdentityMailFromAttributes.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutEmailIdentityMailFromAttributes", []))

    @jsii.member(jsii_name="toPutSuppressedDestination")
    def to_put_suppressed_destination(self) -> "SesV2":
        '''(experimental) Grants permission to add an email address to the suppression list.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutSuppressedDestination.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutSuppressedDestination", []))

    @jsii.member(jsii_name="toSendBulkEmail")
    def to_send_bulk_email(self) -> "SesV2":
        '''(experimental) Grants permission to compose an email message to multiple destinations.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_SendBulkEmail.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toSendBulkEmail", []))

    @jsii.member(jsii_name="toSendCustomVerificationEmail")
    def to_send_custom_verification_email(self) -> "SesV2":
        '''(experimental) Grants permission to add an email address to the list of identities and attempts to verify it.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_SendCustomVerificationEmail.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toSendCustomVerificationEmail", []))

    @jsii.member(jsii_name="toSendEmail")
    def to_send_email(self) -> "SesV2":
        '''(experimental) Grants permission to send an email message.

        Access Level: Write

        Possible conditions:

        - .ifFeedbackAddress()
        - .ifFromAddress()
        - .ifFromDisplayName()
        - .ifRecipients()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_SendEmail.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toSendEmail", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "SesV2":
        '''(experimental) Grants permission to add one or more tags (keys and values) to a specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTestRenderEmailTemplate")
    def to_test_render_email_template(self) -> "SesV2":
        '''(experimental) Grants permission to create a preview of the MIME content of an email when provided with a template and a set of replacement data.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_TestRenderEmailTemplate.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toTestRenderEmailTemplate", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "SesV2":
        '''(experimental) Grants permission to remove one or more tags (keys and values) from a specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateConfigurationSetEventDestination")
    def to_update_configuration_set_event_destination(self) -> "SesV2":
        '''(experimental) Grants permission to update the configuration of an event destination for a configuration set.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_UpdateConfigurationSetEventDestination.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toUpdateConfigurationSetEventDestination", []))

    @jsii.member(jsii_name="toUpdateContact")
    def to_update_contact(self) -> "SesV2":
        '''(experimental) Grants permission to update a contact's preferences for a list.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_UpdateContact.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toUpdateContact", []))

    @jsii.member(jsii_name="toUpdateContactList")
    def to_update_contact_list(self) -> "SesV2":
        '''(experimental) Grants permission to update contact list metadata.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_UpdateContactList.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toUpdateContactList", []))

    @jsii.member(jsii_name="toUpdateCustomVerificationEmailTemplate")
    def to_update_custom_verification_email_template(self) -> "SesV2":
        '''(experimental) Grants permission to update an existing custom verification email template.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_UpdateCustomVerificationEmailTemplate.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toUpdateCustomVerificationEmailTemplate", []))

    @jsii.member(jsii_name="toUpdateEmailIdentityPolicy")
    def to_update_email_identity_policy(self) -> "SesV2":
        '''(experimental) Grants permission to update the specified sending authorization policy for the given identity (an email address or a domain).

        Access Level: Permissions management

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_UpdateEmailIdentityPolicy.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toUpdateEmailIdentityPolicy", []))

    @jsii.member(jsii_name="toUpdateEmailTemplate")
    def to_update_email_template(self) -> "SesV2":
        '''(experimental) Grants permission to update an email template.

        Access Level: Write

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_UpdateEmailTemplate.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toUpdateEmailTemplate", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Shield(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Shield"):
    '''(experimental) Statement provider for service `shield <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsshield.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `shield <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsshield.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Shield, self, [sid])

    @jsii.member(jsii_name="onAttack")
    def on_attack(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Shield":
        '''(experimental) Adds a resource of type attack to the statement.

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_AttackDetail.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "onAttack", [id, account, partition]))

    @jsii.member(jsii_name="onProtection")
    def on_protection(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Shield":
        '''(experimental) Adds a resource of type protection to the statement.

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_Protection.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "onProtection", [id, account, partition]))

    @jsii.member(jsii_name="onProtectionGroup")
    def on_protection_group(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Shield":
        '''(experimental) Adds a resource of type protection-group to the statement.

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_ProtectionGroup.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "onProtectionGroup", [id, account, partition]))

    @jsii.member(jsii_name="toAssociateDRTLogBucket")
    def to_associate_drt_log_bucket(self) -> "Shield":
        '''(experimental) Grants permission to authorize the DDoS Response team to access the specified Amazon S3 bucket containing your flow logs.

        Access Level: Write

        Dependent actions:

        - s3:GetBucketPolicy
        - s3:PutBucketPolicy

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_AssociateDRTLogBucket.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toAssociateDRTLogBucket", []))

    @jsii.member(jsii_name="toAssociateDRTRole")
    def to_associate_drt_role(self) -> "Shield":
        '''(experimental) Grants permission to authorize the DDoS Response team using the specified role, to access your AWS account to assist with DDoS attack mitigation during potential attacks.

        Access Level: Write

        Dependent actions:

        - iam:GetRole
        - iam:ListAttachedRolePolicies
        - iam:PassRole

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_AssociateDRTRole.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toAssociateDRTRole", []))

    @jsii.member(jsii_name="toAssociateHealthCheck")
    def to_associate_health_check(self) -> "Shield":
        '''(experimental) Grants permission to add health-based detection to the Shield Advanced protection for a resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - route53:GetHealthCheck

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_AssociateHealthCheck.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toAssociateHealthCheck", []))

    @jsii.member(jsii_name="toAssociateProactiveEngagementDetails")
    def to_associate_proactive_engagement_details(self) -> "Shield":
        '''(experimental) Grants permission to initialize proactive engagement and set the list of contacts for the DDoS Response Team (DRT) to use.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_AssociateProactiveEngagementDetails.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toAssociateProactiveEngagementDetails", []))

    @jsii.member(jsii_name="toCreateProtection")
    def to_create_protection(self) -> "Shield":
        '''(experimental) Grants permission to activate DDoS protection service for a given resource ARN.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_CreateProtection.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toCreateProtection", []))

    @jsii.member(jsii_name="toCreateProtectionGroup")
    def to_create_protection_group(self) -> "Shield":
        '''(experimental) Grants permission to create a grouping of protected resources so they can be handled as a collective.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_CreateProtectionGroup.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toCreateProtectionGroup", []))

    @jsii.member(jsii_name="toCreateSubscription")
    def to_create_subscription(self) -> "Shield":
        '''(experimental) Grants permission to activate subscription.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_CreateSubscription.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toCreateSubscription", []))

    @jsii.member(jsii_name="toDeleteProtection")
    def to_delete_protection(self) -> "Shield":
        '''(experimental) Grants permission to delete an existing protection.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_DeleteProtection.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toDeleteProtection", []))

    @jsii.member(jsii_name="toDeleteProtectionGroup")
    def to_delete_protection_group(self) -> "Shield":
        '''(experimental) Grants permission to remove the specified protection group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_DeleteProtectionGroup.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toDeleteProtectionGroup", []))

    @jsii.member(jsii_name="toDeleteSubscription")
    def to_delete_subscription(self) -> "Shield":
        '''(experimental) Grants permission to deactivate subscription.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_DeleteSubscription.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toDeleteSubscription", []))

    @jsii.member(jsii_name="toDescribeAttack")
    def to_describe_attack(self) -> "Shield":
        '''(experimental) Grants permission to get attack details.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_DescribeAttack.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toDescribeAttack", []))

    @jsii.member(jsii_name="toDescribeAttackStatistics")
    def to_describe_attack_statistics(self) -> "Shield":
        '''(experimental) Grants permission to describe information about the number and type of attacks AWS Shield has detected in the last year.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_DescribeAttackStatistics.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toDescribeAttackStatistics", []))

    @jsii.member(jsii_name="toDescribeDRTAccess")
    def to_describe_drt_access(self) -> "Shield":
        '''(experimental) Grants permission to describe the current role and list of Amazon S3 log buckets used by the DDoS Response team to access your AWS account while assisting with attack mitigation.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_DescribeDRTAccess.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toDescribeDRTAccess", []))

    @jsii.member(jsii_name="toDescribeEmergencyContactSettings")
    def to_describe_emergency_contact_settings(self) -> "Shield":
        '''(experimental) Grants permission to list the email addresses that the DRT can use to contact you during a suspected attack.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_DescribeEmergencyContactSettings.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toDescribeEmergencyContactSettings", []))

    @jsii.member(jsii_name="toDescribeProtection")
    def to_describe_protection(self) -> "Shield":
        '''(experimental) Grants permission to get protection details.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_DescribeProtection.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toDescribeProtection", []))

    @jsii.member(jsii_name="toDescribeProtectionGroup")
    def to_describe_protection_group(self) -> "Shield":
        '''(experimental) Grants permission to describe the specification for the specified protection group.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_DescribeProtectionGroup.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toDescribeProtectionGroup", []))

    @jsii.member(jsii_name="toDescribeSubscription")
    def to_describe_subscription(self) -> "Shield":
        '''(experimental) Grants permission to get subscription details, such as start time.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_DescribeSubscription.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toDescribeSubscription", []))

    @jsii.member(jsii_name="toDisableProactiveEngagement")
    def to_disable_proactive_engagement(self) -> "Shield":
        '''(experimental) Grants permission to remove authorization from the DDoS Response Team (DRT) to notify contacts about escalations.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_DisableProactiveEngagement.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toDisableProactiveEngagement", []))

    @jsii.member(jsii_name="toDisassociateDRTLogBucket")
    def to_disassociate_drt_log_bucket(self) -> "Shield":
        '''(experimental) Grants permission to remove the DDoS Response team's access to the specified Amazon S3 bucket containing your flow logs.

        Access Level: Write

        Dependent actions:

        - s3:DeleteBucketPolicy
        - s3:GetBucketPolicy
        - s3:PutBucketPolicy

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_DisassociateDRTLogBucket.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toDisassociateDRTLogBucket", []))

    @jsii.member(jsii_name="toDisassociateDRTRole")
    def to_disassociate_drt_role(self) -> "Shield":
        '''(experimental) Grants permission to remove the DDoS Response team's access to your AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_DisassociateDRTRole.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toDisassociateDRTRole", []))

    @jsii.member(jsii_name="toDisassociateHealthCheck")
    def to_disassociate_health_check(self) -> "Shield":
        '''(experimental) Grants permission to remove health-based detection from the Shield Advanced protection for a resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_DisassociateHealthCheck.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toDisassociateHealthCheck", []))

    @jsii.member(jsii_name="toEnableProactiveEngagement")
    def to_enable_proactive_engagement(self) -> "Shield":
        '''(experimental) Grants permission to authorize the DDoS Response Team (DRT) to use email and phone to notify contacts about escalations.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_EnableProactiveEngagement.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toEnableProactiveEngagement", []))

    @jsii.member(jsii_name="toGetSubscriptionState")
    def to_get_subscription_state(self) -> "Shield":
        '''(experimental) Grants permission to get subscription state.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_GetSubscriptionState.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toGetSubscriptionState", []))

    @jsii.member(jsii_name="toListAttacks")
    def to_list_attacks(self) -> "Shield":
        '''(experimental) Grants permission to list all existing attacks.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_ListAttacks.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toListAttacks", []))

    @jsii.member(jsii_name="toListProtectionGroups")
    def to_list_protection_groups(self) -> "Shield":
        '''(experimental) Grants permission to retrieve the protection groups for the account.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_ListProtectionGroups.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toListProtectionGroups", []))

    @jsii.member(jsii_name="toListProtections")
    def to_list_protections(self) -> "Shield":
        '''(experimental) Grants permission to list all existing protections.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_ListProtections.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toListProtections", []))

    @jsii.member(jsii_name="toListResourcesInProtectionGroup")
    def to_list_resources_in_protection_group(self) -> "Shield":
        '''(experimental) Grants permission to retrieve the resources that are included in the protection group.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_ListResourcesInProtectionGroup.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toListResourcesInProtectionGroup", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Shield":
        '''(experimental) Grants permission to get information about AWS tags for a specified Amazon Resource Name (ARN) in AWS Shield.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Shield":
        '''(experimental) Grants permission to add or updates tags for a resource in AWS Shield.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Shield":
        '''(experimental) Grants permission to remove tags from a resource in AWS Shield.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateEmergencyContactSettings")
    def to_update_emergency_contact_settings(self) -> "Shield":
        '''(experimental) Grants permission to update the details of the list of email addresses that the DRT can use to contact you during a suspected attack.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_UpdateEmergencyContactSettings.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toUpdateEmergencyContactSettings", []))

    @jsii.member(jsii_name="toUpdateProtectionGroup")
    def to_update_protection_group(self) -> "Shield":
        '''(experimental) Grants permission to update an existing protection group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_UpdateProtectionGroup.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toUpdateProtectionGroup", []))

    @jsii.member(jsii_name="toUpdateSubscription")
    def to_update_subscription(self) -> "Shield":
        '''(experimental) Grants permission to update the details of an existing subscription.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_UpdateSubscription.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toUpdateSubscription", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Signer(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Signer"):
    '''(experimental) Statement provider for service `signer <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssigner.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `signer <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssigner.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Signer, self, [sid])

    @jsii.member(jsii_name="ifProfileVersion")
    def if_profile_version(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Signer":
        '''(experimental) Filters access based on the version of the Signing Profile.

        https://docs.aws.amazon.com/signer/latest/developerguide/authen-apipermissions.html

        Applies to actions:

        - .toAddProfilePermission()
        - .toCancelSigningProfile()
        - .toGetSigningProfile()
        - .toRemoveProfilePermission()
        - .toRevokeSignature()
        - .toRevokeSigningProfile()
        - .toStartSigningJob()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Signer", jsii.invoke(self, "ifProfileVersion", [value, operator]))

    @jsii.member(jsii_name="onSigningJob")
    def on_signing_job(
        self,
        job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Signer":
        '''(experimental) Adds a resource of type signing-job to the statement.

        https://docs.aws.amazon.com/signer/latest/developerguide/gs-job.html

        :param job_id: - Identifier for the jobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Signer", jsii.invoke(self, "onSigningJob", [job_id, account, region, partition]))

    @jsii.member(jsii_name="onSigningProfile")
    def on_signing_profile(
        self,
        profile_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Signer":
        '''(experimental) Adds a resource of type signing-profile to the statement.

        https://docs.aws.amazon.com/signer/latest/developerguide/gs-profile.html

        :param profile_name: - Identifier for the profileName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Signer", jsii.invoke(self, "onSigningProfile", [profile_name, account, region, partition]))

    @jsii.member(jsii_name="toAddProfilePermission")
    def to_add_profile_permission(self) -> "Signer":
        '''(experimental) Grants permission to add cross-account permissions to a Signing Profile.

        Access Level: Permissions management

        Possible conditions:

        - .ifProfileVersion()

        https://docs.aws.amazon.com/signer/latest/api/API_AddProfilePermission.html

        :stability: experimental
        '''
        return typing.cast("Signer", jsii.invoke(self, "toAddProfilePermission", []))

    @jsii.member(jsii_name="toCancelSigningProfile")
    def to_cancel_signing_profile(self) -> "Signer":
        '''(experimental) Grants permission to change the state of a Signing Profile to CANCELED.

        Access Level: Write

        Possible conditions:

        - .ifProfileVersion()

        https://docs.aws.amazon.com/signer/latest/api/API_CancelSigningProfile.html

        :stability: experimental
        '''
        return typing.cast("Signer", jsii.invoke(self, "toCancelSigningProfile", []))

    @jsii.member(jsii_name="toDescribeSigningJob")
    def to_describe_signing_job(self) -> "Signer":
        '''(experimental) Grants permission to return information about a specific Signing Job.

        Access Level: Read

        https://docs.aws.amazon.com/signer/latest/api/API_DescribeSigningJob.html

        :stability: experimental
        '''
        return typing.cast("Signer", jsii.invoke(self, "toDescribeSigningJob", []))

    @jsii.member(jsii_name="toGetSigningPlatform")
    def to_get_signing_platform(self) -> "Signer":
        '''(experimental) Grants permission to return information about a specific Signing Platform.

        Access Level: Read

        https://docs.aws.amazon.com/signer/latest/api/API_GetSigningPlatform.html

        :stability: experimental
        '''
        return typing.cast("Signer", jsii.invoke(self, "toGetSigningPlatform", []))

    @jsii.member(jsii_name="toGetSigningProfile")
    def to_get_signing_profile(self) -> "Signer":
        '''(experimental) Grants permission to return information about a specific Signing Profile.

        Access Level: Read

        Possible conditions:

        - .ifProfileVersion()

        https://docs.aws.amazon.com/signer/latest/api/API_GetSigningProfile.html

        :stability: experimental
        '''
        return typing.cast("Signer", jsii.invoke(self, "toGetSigningProfile", []))

    @jsii.member(jsii_name="toListProfilePermissions")
    def to_list_profile_permissions(self) -> "Signer":
        '''(experimental) Grants permission to list the cross-account permissions associated with a Signing Profile.

        Access Level: Read

        https://docs.aws.amazon.com/signer/latest/api/API_ListProfilePermissions.html

        :stability: experimental
        '''
        return typing.cast("Signer", jsii.invoke(self, "toListProfilePermissions", []))

    @jsii.member(jsii_name="toListSigningJobs")
    def to_list_signing_jobs(self) -> "Signer":
        '''(experimental) Grants permission to list all Signing Jobs in your account.

        Access Level: List

        https://docs.aws.amazon.com/signer/latest/api/API_ListSigningJobs.html

        :stability: experimental
        '''
        return typing.cast("Signer", jsii.invoke(self, "toListSigningJobs", []))

    @jsii.member(jsii_name="toListSigningPlatforms")
    def to_list_signing_platforms(self) -> "Signer":
        '''(experimental) Grants permission to list all available Signing Platforms.

        Access Level: List

        https://docs.aws.amazon.com/signer/latest/api/API_ListSigningPlatforms.html

        :stability: experimental
        '''
        return typing.cast("Signer", jsii.invoke(self, "toListSigningPlatforms", []))

    @jsii.member(jsii_name="toListSigningProfiles")
    def to_list_signing_profiles(self) -> "Signer":
        '''(experimental) Grants permission to list all Signing Profiles in your account.

        Access Level: List

        https://docs.aws.amazon.com/signer/latest/api/API_ListSigningProfiles.html

        :stability: experimental
        '''
        return typing.cast("Signer", jsii.invoke(self, "toListSigningProfiles", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Signer":
        '''(experimental) Grants permission to list the tags associated with a Signing Profile.

        Access Level: Read

        https://docs.aws.amazon.com/signer/latest/api/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Signer", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutSigningProfile")
    def to_put_signing_profile(self) -> "Signer":
        '''(experimental) Grants permission to create a new Signing Profile.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/signer/latest/api/API_PutSigningProfile.html

        :stability: experimental
        '''
        return typing.cast("Signer", jsii.invoke(self, "toPutSigningProfile", []))

    @jsii.member(jsii_name="toRemoveProfilePermission")
    def to_remove_profile_permission(self) -> "Signer":
        '''(experimental) Grants permission to remove cross-account permissions from a Signing Profile.

        Access Level: Permissions management

        Possible conditions:

        - .ifProfileVersion()

        https://docs.aws.amazon.com/signer/latest/api/API_RemoveProfilePermission.html

        :stability: experimental
        '''
        return typing.cast("Signer", jsii.invoke(self, "toRemoveProfilePermission", []))

    @jsii.member(jsii_name="toRevokeSignature")
    def to_revoke_signature(self) -> "Signer":
        '''(experimental) Grants permission to change the state of a Signing Job to REVOKED.

        Access Level: Write

        Possible conditions:

        - .ifProfileVersion()

        https://docs.aws.amazon.com/signer/latest/api/API_RevokeSignature.html

        :stability: experimental
        '''
        return typing.cast("Signer", jsii.invoke(self, "toRevokeSignature", []))

    @jsii.member(jsii_name="toRevokeSigningProfile")
    def to_revoke_signing_profile(self) -> "Signer":
        '''(experimental) Grants permission to change the state of a Signing Profile to REVOKED.

        Access Level: Write

        Possible conditions:

        - .ifProfileVersion()

        https://docs.aws.amazon.com/signer/latest/api/API_RevokeSigningProfile.html

        :stability: experimental
        '''
        return typing.cast("Signer", jsii.invoke(self, "toRevokeSigningProfile", []))

    @jsii.member(jsii_name="toStartSigningJob")
    def to_start_signing_job(self) -> "Signer":
        '''(experimental) Grants permission to initiate a Signing Job on the provided code.

        Access Level: Write

        Possible conditions:

        - .ifProfileVersion()

        https://docs.aws.amazon.com/signer/latest/api/API_StartSigningJob.html

        :stability: experimental
        '''
        return typing.cast("Signer", jsii.invoke(self, "toStartSigningJob", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Signer":
        '''(experimental) Grants permission to add one or more tags to a Signing Profile.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/signer/latest/api/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Signer", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Signer":
        '''(experimental) Grants permission to remove one or more tags from a Signing Profile.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/signer/latest/api/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Signer", jsii.invoke(self, "toUntagResource", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Sms(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Sms"):
    '''(experimental) Statement provider for service `sms <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsservermigrationservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `sms <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsservermigrationservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Sms, self, [sid])

    @jsii.member(jsii_name="toCreateApp")
    def to_create_app(self) -> "Sms":
        '''(experimental) Grants permission to create an application configuration to migrate on-premise application onto AWS.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_CreateApp.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toCreateApp", []))

    @jsii.member(jsii_name="toCreateReplicationJob")
    def to_create_replication_job(self) -> "Sms":
        '''(experimental) Grants permission to create a job to migrate on-premise server onto AWS.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_CreateReplicationJob.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toCreateReplicationJob", []))

    @jsii.member(jsii_name="toDeleteApp")
    def to_delete_app(self) -> "Sms":
        '''(experimental) Grants permission to delete an existing application configuration.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_DeleteApp.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toDeleteApp", []))

    @jsii.member(jsii_name="toDeleteAppLaunchConfiguration")
    def to_delete_app_launch_configuration(self) -> "Sms":
        '''(experimental) Grants permission to delete launch configuration for an existing application.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_DeleteAppLaunchConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toDeleteAppLaunchConfiguration", []))

    @jsii.member(jsii_name="toDeleteAppReplicationConfiguration")
    def to_delete_app_replication_configuration(self) -> "Sms":
        '''(experimental) Grants permission to delete replication configuration for an existing application.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_DeleteAppReplicationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toDeleteAppReplicationConfiguration", []))

    @jsii.member(jsii_name="toDeleteAppValidationConfiguration")
    def to_delete_app_validation_configuration(self) -> "Sms":
        '''(experimental) Grants permission to delete validation configuration for an existing application.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_DeleteAppValidationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toDeleteAppValidationConfiguration", []))

    @jsii.member(jsii_name="toDeleteReplicationJob")
    def to_delete_replication_job(self) -> "Sms":
        '''(experimental) Grants permission to delete an existing job to migrate on-premise server onto AWS.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_DeleteReplicationJob.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toDeleteReplicationJob", []))

    @jsii.member(jsii_name="toDeleteServerCatalog")
    def to_delete_server_catalog(self) -> "Sms":
        '''(experimental) Grants permission to delete the complete list of on-premise servers gathered into AWS.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_DeleteServerCatalog.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toDeleteServerCatalog", []))

    @jsii.member(jsii_name="toDisassociateConnector")
    def to_disassociate_connector(self) -> "Sms":
        '''(experimental) Grants permission to disassociate a connector that has been associated.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_DisassociateConnector.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toDisassociateConnector", []))

    @jsii.member(jsii_name="toGenerateChangeSet")
    def to_generate_change_set(self) -> "Sms":
        '''(experimental) Grants permission to generate a changeSet for the CloudFormation stack of an application.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_GenerateChangeSet.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toGenerateChangeSet", []))

    @jsii.member(jsii_name="toGenerateTemplate")
    def to_generate_template(self) -> "Sms":
        '''(experimental) Grants permission to generate a CloudFormation template for an existing application.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_GenerateTemplate.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toGenerateTemplate", []))

    @jsii.member(jsii_name="toGetApp")
    def to_get_app(self) -> "Sms":
        '''(experimental) Grants permission to get the configuration and statuses for an existing application.

        Access Level: Read

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_GetApp.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toGetApp", []))

    @jsii.member(jsii_name="toGetAppLaunchConfiguration")
    def to_get_app_launch_configuration(self) -> "Sms":
        '''(experimental) Grants permission to get launch configuration for an existing application.

        Access Level: Read

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_GetAppLaunchConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toGetAppLaunchConfiguration", []))

    @jsii.member(jsii_name="toGetAppReplicationConfiguration")
    def to_get_app_replication_configuration(self) -> "Sms":
        '''(experimental) Grants permission to get replication configuration for an existing application.

        Access Level: Read

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_GetAppReplicationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toGetAppReplicationConfiguration", []))

    @jsii.member(jsii_name="toGetAppValidationConfiguration")
    def to_get_app_validation_configuration(self) -> "Sms":
        '''(experimental) Grants permission to get validation configuration for an existing application.

        Access Level: Read

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_GetAppValidationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toGetAppValidationConfiguration", []))

    @jsii.member(jsii_name="toGetAppValidationOutput")
    def to_get_app_validation_output(self) -> "Sms":
        '''(experimental) Grants permission to get notification sent from application validation script.

        Access Level: Read

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_GetAppValidationOutput.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toGetAppValidationOutput", []))

    @jsii.member(jsii_name="toGetConnectors")
    def to_get_connectors(self) -> "Sms":
        '''(experimental) Grants permission to get all connectors that have been associated.

        Access Level: Read

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_GetConnectors.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toGetConnectors", []))

    @jsii.member(jsii_name="toGetMessages")
    def to_get_messages(self) -> "Sms":
        '''(experimental) Grants permission to gets messages from AWS Server Migration Service to Server Migration Connector.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toGetMessages", []))

    @jsii.member(jsii_name="toGetReplicationJobs")
    def to_get_replication_jobs(self) -> "Sms":
        '''(experimental) Grants permission to get all existing jobs to migrate on-premise servers onto AWS.

        Access Level: Read

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_GetReplicationJobs.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toGetReplicationJobs", []))

    @jsii.member(jsii_name="toGetReplicationRuns")
    def to_get_replication_runs(self) -> "Sms":
        '''(experimental) Grants permission to get all runs for an existing job.

        Access Level: Read

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_GetReplicationRuns.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toGetReplicationRuns", []))

    @jsii.member(jsii_name="toGetServers")
    def to_get_servers(self) -> "Sms":
        '''(experimental) Grants permission to get all servers that have been imported.

        Access Level: Read

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_GetServers.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toGetServers", []))

    @jsii.member(jsii_name="toImportAppCatalog")
    def to_import_app_catalog(self) -> "Sms":
        '''(experimental) Grants permission to import application catalog from AWS Application Discovery Service.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_ImportAppCatalog.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toImportAppCatalog", []))

    @jsii.member(jsii_name="toImportServerCatalog")
    def to_import_server_catalog(self) -> "Sms":
        '''(experimental) Grants permission to gather a complete list of on-premise servers.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_ImportServerCatalog.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toImportServerCatalog", []))

    @jsii.member(jsii_name="toLaunchApp")
    def to_launch_app(self) -> "Sms":
        '''(experimental) Grants permission to create and launch a CloudFormation stack for an existing application.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_LaunchApp.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toLaunchApp", []))

    @jsii.member(jsii_name="toListApps")
    def to_list_apps(self) -> "Sms":
        '''(experimental) Grants permission to get a list of summaries for existing applications.

        Access Level: List

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_ListAppss.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toListApps", []))

    @jsii.member(jsii_name="toNotifyAppValidationOutput")
    def to_notify_app_validation_output(self) -> "Sms":
        '''(experimental) Grants permission to send notification for application validation script.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_NotifyAppValidationOutput.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toNotifyAppValidationOutput", []))

    @jsii.member(jsii_name="toPutAppLaunchConfiguration")
    def to_put_app_launch_configuration(self) -> "Sms":
        '''(experimental) Grants permission to create or update launch configuration for an existing application.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_PutAppLaunchConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toPutAppLaunchConfiguration", []))

    @jsii.member(jsii_name="toPutAppReplicationConfiguration")
    def to_put_app_replication_configuration(self) -> "Sms":
        '''(experimental) Grants permission to create or update replication configuration for an existing application.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_PutAppReplicationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toPutAppReplicationConfiguration", []))

    @jsii.member(jsii_name="toPutAppValidationConfiguration")
    def to_put_app_validation_configuration(self) -> "Sms":
        '''(experimental) Grants permission to put validation configuration for an existing application.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_PutAppValidationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toPutAppValidationConfiguration", []))

    @jsii.member(jsii_name="toSendMessage")
    def to_send_message(self) -> "Sms":
        '''(experimental) Grants permission to send message from Server Migration Connector to AWS Server Migration Service.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toSendMessage", []))

    @jsii.member(jsii_name="toStartAppReplication")
    def to_start_app_replication(self) -> "Sms":
        '''(experimental) Grants permission to create and start replication jobs for an existing application.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_StartAppReplication.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toStartAppReplication", []))

    @jsii.member(jsii_name="toStartOnDemandAppReplication")
    def to_start_on_demand_app_replication(self) -> "Sms":
        '''(experimental) Grants permission to start a replication run for an existing application.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_StartOnDemandAppReplication.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toStartOnDemandAppReplication", []))

    @jsii.member(jsii_name="toStartOnDemandReplicationRun")
    def to_start_on_demand_replication_run(self) -> "Sms":
        '''(experimental) Grants permission to start a replication run for an existing replication job.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_StartOnDemandReplicationRun.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toStartOnDemandReplicationRun", []))

    @jsii.member(jsii_name="toStopAppReplication")
    def to_stop_app_replication(self) -> "Sms":
        '''(experimental) Grants permission to stop and delete replication jobs for an existing application.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_StopAppReplication.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toStopAppReplication", []))

    @jsii.member(jsii_name="toTerminateApp")
    def to_terminate_app(self) -> "Sms":
        '''(experimental) Grants permission to terminate the CloudFormation stack for an existing application.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_TerminateApp.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toTerminateApp", []))

    @jsii.member(jsii_name="toUpdateApp")
    def to_update_app(self) -> "Sms":
        '''(experimental) Grants permission to update an existing application configuration.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_UpdateApp.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toUpdateApp", []))

    @jsii.member(jsii_name="toUpdateReplicationJob")
    def to_update_replication_job(self) -> "Sms":
        '''(experimental) Grants permission to update an existing job to migrate on-premise server onto AWS.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_UpdateReplicationJob.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toUpdateReplicationJob", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class SmsVoice(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.SmsVoice",
):
    '''(experimental) Statement provider for service `sms-voice <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonpinpointsmsandvoiceservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `sms-voice <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonpinpointsmsandvoiceservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(SmsVoice, self, [sid])

    @jsii.member(jsii_name="toCreateConfigurationSet")
    def to_create_configuration_set(self) -> "SmsVoice":
        '''(experimental) Create a new configuration set.

        After you create the configuration set, you can add one or more event destinations to it.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint-sms-voice/latest/APIReference/v1-sms-voice-configuration-sets.html

        :stability: experimental
        '''
        return typing.cast("SmsVoice", jsii.invoke(self, "toCreateConfigurationSet", []))

    @jsii.member(jsii_name="toCreateConfigurationSetEventDestination")
    def to_create_configuration_set_event_destination(self) -> "SmsVoice":
        '''(experimental) Create a new event destination in a configuration set.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/pinpoint-sms-voice/latest/APIReference/v1-sms-voice-configuration-sets-configurationsetname-event-destinations.html

        :stability: experimental
        '''
        return typing.cast("SmsVoice", jsii.invoke(self, "toCreateConfigurationSetEventDestination", []))

    @jsii.member(jsii_name="toDeleteConfigurationSet")
    def to_delete_configuration_set(self) -> "SmsVoice":
        '''(experimental) Deletes an existing configuration set.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint-sms-voice/latest/APIReference/v1-sms-voice-configuration-sets-configurationsetname.html

        :stability: experimental
        '''
        return typing.cast("SmsVoice", jsii.invoke(self, "toDeleteConfigurationSet", []))

    @jsii.member(jsii_name="toDeleteConfigurationSetEventDestination")
    def to_delete_configuration_set_event_destination(self) -> "SmsVoice":
        '''(experimental) Deletes an event destination in a configuration set.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint-sms-voice/latest/APIReference/v1-sms-voice-configuration-sets-configurationsetname-event-destinations-eventdestinationname.html

        :stability: experimental
        '''
        return typing.cast("SmsVoice", jsii.invoke(self, "toDeleteConfigurationSetEventDestination", []))

    @jsii.member(jsii_name="toGetConfigurationSetEventDestinations")
    def to_get_configuration_set_event_destinations(self) -> "SmsVoice":
        '''(experimental) Obtain information about an event destination, including the types of events it reports, the Amazon Resource Name (ARN) of the destination, and the name of the event destination.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint-sms-voice/latest/APIReference/v1-sms-voice-configuration-sets-configurationsetname-event-destinations.html

        :stability: experimental
        '''
        return typing.cast("SmsVoice", jsii.invoke(self, "toGetConfigurationSetEventDestinations", []))

    @jsii.member(jsii_name="toListConfigurationSets")
    def to_list_configuration_sets(self) -> "SmsVoice":
        '''(experimental) Return a list of configuration sets.

        This operation only returns the configuration sets that are associated with your account in the current AWS Region.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint-sms-voice/latest/APIReference/v1-sms-voice-configuration-sets.html

        :stability: experimental
        '''
        return typing.cast("SmsVoice", jsii.invoke(self, "toListConfigurationSets", []))

    @jsii.member(jsii_name="toSendVoiceMessage")
    def to_send_voice_message(self) -> "SmsVoice":
        '''(experimental) Create a new voice message and send it to a recipient's phone number.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint-sms-voice/latest/APIReference/v1-sms-voice-voice-message.html

        :stability: experimental
        '''
        return typing.cast("SmsVoice", jsii.invoke(self, "toSendVoiceMessage", []))

    @jsii.member(jsii_name="toUpdateConfigurationSetEventDestination")
    def to_update_configuration_set_event_destination(self) -> "SmsVoice":
        '''(experimental) Update an event destination in a configuration set.

        An event destination is a location that you publish information about your voice calls to. For example, you can log an event to an Amazon CloudWatch destination when a call fails.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/pinpoint-sms-voice/latest/APIReference/v1-sms-voice-configuration-sets-configurationsetname-event-destinations-eventdestinationname.html

        :stability: experimental
        '''
        return typing.cast("SmsVoice", jsii.invoke(self, "toUpdateConfigurationSetEventDestination", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Snowball(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Snowball",
):
    '''(experimental) Statement provider for service `snowball <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssnowball.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `snowball <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssnowball.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Snowball, self, [sid])

    @jsii.member(jsii_name="toCancelCluster")
    def to_cancel_cluster(self) -> "Snowball":
        '''(experimental) Cancels a cluster job.

        Access Level: Write

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_CancelCluster.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toCancelCluster", []))

    @jsii.member(jsii_name="toCancelJob")
    def to_cancel_job(self) -> "Snowball":
        '''(experimental) Cancels the specified job.

        Access Level: Write

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_CancelJob.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toCancelJob", []))

    @jsii.member(jsii_name="toCreateAddress")
    def to_create_address(self) -> "Snowball":
        '''(experimental) Creates an address for a Snowball to be shipped to.

        Access Level: Write

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_CreateAddress.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toCreateAddress", []))

    @jsii.member(jsii_name="toCreateCluster")
    def to_create_cluster(self) -> "Snowball":
        '''(experimental) Creates an empty cluster.

        Access Level: Write

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_CreateCluster.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toCreateCluster", []))

    @jsii.member(jsii_name="toCreateJob")
    def to_create_job(self) -> "Snowball":
        '''(experimental) Creates a job to import or export data between Amazon S3 and your on-premises data center.

        Access Level: Write

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_CreateJob.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toCreateJob", []))

    @jsii.member(jsii_name="toDescribeAddress")
    def to_describe_address(self) -> "Snowball":
        '''(experimental) Takes an AddressId and returns specific details about that address in the form of an Address object.

        Access Level: Read

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_DescribeAddress.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toDescribeAddress", []))

    @jsii.member(jsii_name="toDescribeAddresses")
    def to_describe_addresses(self) -> "Snowball":
        '''(experimental) Returns a specified number of ADDRESS objects.

        Access Level: List

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_DescribeAddresses.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toDescribeAddresses", []))

    @jsii.member(jsii_name="toDescribeCluster")
    def to_describe_cluster(self) -> "Snowball":
        '''(experimental) Returns information about a specific cluster including shipping information, cluster status, and other important metadata.

        Access Level: Read

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_DescribeCluster.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toDescribeCluster", []))

    @jsii.member(jsii_name="toDescribeJob")
    def to_describe_job(self) -> "Snowball":
        '''(experimental) Returns information about a specific job including shipping information, job status, and other important metadata.

        Access Level: Read

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_DescribeJob.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toDescribeJob", []))

    @jsii.member(jsii_name="toGetJobManifest")
    def to_get_job_manifest(self) -> "Snowball":
        '''(experimental) Returns a link to an Amazon S3 presigned URL for the manifest file associated with the specified JobId value.

        Access Level: Read

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_GetJobManifest.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toGetJobManifest", []))

    @jsii.member(jsii_name="toGetJobUnlockCode")
    def to_get_job_unlock_code(self) -> "Snowball":
        '''(experimental) Returns the UnlockCode code value for the specified job.

        Access Level: Read

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_GetJobUnlockCode.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toGetJobUnlockCode", []))

    @jsii.member(jsii_name="toGetSnowballUsage")
    def to_get_snowball_usage(self) -> "Snowball":
        '''(experimental) Returns information about the Snowball service limit for your account, and also the number of Snowballs your account has in use.

        Access Level: Read

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_GetSnowballUsage.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toGetSnowballUsage", []))

    @jsii.member(jsii_name="toListClusterJobs")
    def to_list_cluster_jobs(self) -> "Snowball":
        '''(experimental) Returns an array of JobListEntry objects of the specified length.

        Access Level: List

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_ListClusterJobs.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toListClusterJobs", []))

    @jsii.member(jsii_name="toListClusters")
    def to_list_clusters(self) -> "Snowball":
        '''(experimental) Returns an array of ClusterListEntry objects of the specified length.

        Access Level: List

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_ListClusters.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toListClusters", []))

    @jsii.member(jsii_name="toListJobs")
    def to_list_jobs(self) -> "Snowball":
        '''(experimental) Returns an array of JobListEntry objects of the specified length.

        Access Level: List

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_ListJobs.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toListJobs", []))

    @jsii.member(jsii_name="toUpdateCluster")
    def to_update_cluster(self) -> "Snowball":
        '''(experimental) While a cluster's ClusterState value is in the AwaitingQuorum state, you can update some of the information associated with a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_UpdateCluster.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toUpdateCluster", []))

    @jsii.member(jsii_name="toUpdateJob")
    def to_update_job(self) -> "Snowball":
        '''(experimental) While a job's JobState value is New, you can update some of the information associated with a job.

        Access Level: Write

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_UpdateJob.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toUpdateJob", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Sns(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Sns"):
    '''(experimental) Statement provider for service `sns <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsns.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `sns <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsns.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Sns, self, [sid])

    @jsii.member(jsii_name="ifEndpoint")
    def if_endpoint(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sns":
        '''(experimental) The URL, email address, or ARN from a Subscribe request or a previously confirmed subscription.

        https://docs.aws.amazon.com/sns/latest/dg/UsingIAMwithSNS.html#w2ab1c11c23c19

        Applies to actions:

        - .toSubscribe()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "ifEndpoint", [value, operator]))

    @jsii.member(jsii_name="ifProtocol")
    def if_protocol(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sns":
        '''(experimental) The protocol value from a Subscribe request or a previously confirmed subscription.

        https://docs.aws.amazon.com/sns/latest/dg/UsingIAMwithSNS.html#w2ab1c11c23c19

        Applies to actions:

        - .toSubscribe()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "ifProtocol", [value, operator]))

    @jsii.member(jsii_name="onTopic")
    def on_topic(
        self,
        topic_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sns":
        '''(experimental) Adds a resource of type topic to the statement.

        https://docs.aws.amazon.com/sns/latest/dg/CreateTopic.html

        :param topic_name: - Identifier for the topicName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "onTopic", [topic_name, account, region, partition]))

    @jsii.member(jsii_name="toAddPermission")
    def to_add_permission(self) -> "Sns":
        '''(experimental) Adds a statement to a topic's access control policy, granting access for the specified AWS accounts to the specified actions.

        Access Level: Permissions management

        https://docs.aws.amazon.com/sns/latest/api/API_AddPermission.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toAddPermission", []))

    @jsii.member(jsii_name="toCheckIfPhoneNumberIsOptedOut")
    def to_check_if_phone_number_is_opted_out(self) -> "Sns":
        '''(experimental) Accepts a phone number and indicates whether the phone holder has opted out of receiving SMS messages from your account.

        Access Level: Read

        https://docs.aws.amazon.com/sns/latest/api/API_CheckIfPhoneNumberIsOptedOut.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toCheckIfPhoneNumberIsOptedOut", []))

    @jsii.member(jsii_name="toConfirmSubscription")
    def to_confirm_subscription(self) -> "Sns":
        '''(experimental) Verifies an endpoint owner's intent to receive messages by validating the token sent to the endpoint by an earlier Subscribe action.

        Access Level: Write

        https://docs.aws.amazon.com/sns/latest/api/API_ConfirmSubscription.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toConfirmSubscription", []))

    @jsii.member(jsii_name="toCreatePlatformApplication")
    def to_create_platform_application(self) -> "Sns":
        '''(experimental) Creates a platform application object for one of the supported push notification services, such as APNS and GCM, to which devices and mobile apps may register.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/sns/latest/api/API_CreatePlatformApplication.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toCreatePlatformApplication", []))

    @jsii.member(jsii_name="toCreatePlatformEndpoint")
    def to_create_platform_endpoint(self) -> "Sns":
        '''(experimental) Creates an endpoint for a device and mobile app on one of the supported push notification services, such as GCM and APNS.

        Access Level: Write

        https://docs.aws.amazon.com/sns/latest/api/API_CreatePlatformEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toCreatePlatformEndpoint", []))

    @jsii.member(jsii_name="toCreateTopic")
    def to_create_topic(self) -> "Sns":
        '''(experimental) Creates a topic to which notifications can be published.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/sns/latest/api/API_CreateTopic.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toCreateTopic", []))

    @jsii.member(jsii_name="toDeleteEndpoint")
    def to_delete_endpoint(self) -> "Sns":
        '''(experimental) Deletes the endpoint for a device and mobile app from Amazon SNS.

        Access Level: Write

        https://docs.aws.amazon.com/sns/latest/api/API_DeleteEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toDeleteEndpoint", []))

    @jsii.member(jsii_name="toDeletePlatformApplication")
    def to_delete_platform_application(self) -> "Sns":
        '''(experimental) Deletes a platform application object for one of the supported push notification services, such as APNS and GCM.

        Access Level: Write

        https://docs.aws.amazon.com/sns/latest/api/API_DeletePlatformApplication.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toDeletePlatformApplication", []))

    @jsii.member(jsii_name="toDeleteTopic")
    def to_delete_topic(self) -> "Sns":
        '''(experimental) Deletes a topic and all its subscriptions.

        Access Level: Write

        https://docs.aws.amazon.com/sns/latest/api/API_DeleteTopic.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toDeleteTopic", []))

    @jsii.member(jsii_name="toGetEndpointAttributes")
    def to_get_endpoint_attributes(self) -> "Sns":
        '''(experimental) Retrieves the endpoint attributes for a device on one of the supported push notification services, such as GCM and APNS.

        Access Level: Read

        https://docs.aws.amazon.com/sns/latest/api/API_GetEndpointAttributes.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toGetEndpointAttributes", []))

    @jsii.member(jsii_name="toGetPlatformApplicationAttributes")
    def to_get_platform_application_attributes(self) -> "Sns":
        '''(experimental) Retrieves the attributes of the platform application object for the supported push notification services, such as APNS and GCM.

        Access Level: Read

        https://docs.aws.amazon.com/sns/latest/api/API_GetPlatformApplicationAttributes.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toGetPlatformApplicationAttributes", []))

    @jsii.member(jsii_name="toGetSMSAttributes")
    def to_get_sms_attributes(self) -> "Sns":
        '''(experimental) Returns the settings for sending SMS messages from your account.

        Access Level: Read

        https://docs.aws.amazon.com/sns/latest/api/API_GetSMSAttributes.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toGetSMSAttributes", []))

    @jsii.member(jsii_name="toGetSubscriptionAttributes")
    def to_get_subscription_attributes(self) -> "Sns":
        '''(experimental) Returns all of the properties of a subscription.

        Access Level: Read

        https://docs.aws.amazon.com/sns/latest/api/API_GetSubscriptionAttributes.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toGetSubscriptionAttributes", []))

    @jsii.member(jsii_name="toGetTopicAttributes")
    def to_get_topic_attributes(self) -> "Sns":
        '''(experimental) Returns all of the properties of a topic.

        Topic properties returned might differ based on the authorization of the user.

        Access Level: Read

        https://docs.aws.amazon.com/sns/latest/api/API_GetTopicAttributes.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toGetTopicAttributes", []))

    @jsii.member(jsii_name="toListEndpointsByPlatformApplication")
    def to_list_endpoints_by_platform_application(self) -> "Sns":
        '''(experimental) Lists the endpoints and endpoint attributes for devices in a supported push notification service, such as GCM and APNS.

        Access Level: List

        https://docs.aws.amazon.com/sns/latest/api/API_ListEndpointsByPlatformApplication.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toListEndpointsByPlatformApplication", []))

    @jsii.member(jsii_name="toListPhoneNumbersOptedOut")
    def to_list_phone_numbers_opted_out(self) -> "Sns":
        '''(experimental) Returns a list of phone numbers that are opted out, meaning you cannot send SMS messages to them.

        Access Level: Read

        https://docs.aws.amazon.com/sns/latest/api/API_ListPhoneNumbersOptedOut.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toListPhoneNumbersOptedOut", []))

    @jsii.member(jsii_name="toListPlatformApplications")
    def to_list_platform_applications(self) -> "Sns":
        '''(experimental) Lists the platform application objects for the supported push notification services, such as APNS and GCM.

        Access Level: List

        https://docs.aws.amazon.com/sns/latest/api/API_ListPlatformApplications.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toListPlatformApplications", []))

    @jsii.member(jsii_name="toListSubscriptions")
    def to_list_subscriptions(self) -> "Sns":
        '''(experimental) Returns a list of the requester's subscriptions.

        Access Level: List

        https://docs.aws.amazon.com/sns/latest/api/API_ListSubscriptions.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toListSubscriptions", []))

    @jsii.member(jsii_name="toListSubscriptionsByTopic")
    def to_list_subscriptions_by_topic(self) -> "Sns":
        '''(experimental) Returns a list of the subscriptions to a specific topic.

        Access Level: List

        https://docs.aws.amazon.com/sns/latest/api/API_ListSubscriptionsByTopic.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toListSubscriptionsByTopic", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Sns":
        '''(experimental) List all tags added to the specified Amazon SNS topic.

        Access Level: Read

        https://docs.aws.amazon.com/sns/latest/api/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTopics")
    def to_list_topics(self) -> "Sns":
        '''(experimental) Returns a list of the requester's topics. Each call returns a limited list of topics, up to 100.

        Access Level: List

        https://docs.aws.amazon.com/sns/latest/api/API_ListTopics.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toListTopics", []))

    @jsii.member(jsii_name="toOptInPhoneNumber")
    def to_opt_in_phone_number(self) -> "Sns":
        '''(experimental) Opts in a phone number that is currently opted out, which enables you to resume sending SMS messages to the number.

        Access Level: Write

        https://docs.aws.amazon.com/sns/latest/api/API_OptInPhoneNumber.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toOptInPhoneNumber", []))

    @jsii.member(jsii_name="toPublish")
    def to_publish(self) -> "Sns":
        '''(experimental) Sends a message to all of a topic's subscribed endpoints.

        Access Level: Write

        https://docs.aws.amazon.com/sns/latest/api/API_Publish.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toPublish", []))

    @jsii.member(jsii_name="toRemovePermission")
    def to_remove_permission(self) -> "Sns":
        '''(experimental) Removes a statement from a topic's access control policy.

        Access Level: Permissions management

        https://docs.aws.amazon.com/sns/latest/api/API_RemovePermission.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toRemovePermission", []))

    @jsii.member(jsii_name="toSetEndpointAttributes")
    def to_set_endpoint_attributes(self) -> "Sns":
        '''(experimental) Sets the attributes for an endpoint for a device on one of the supported push notification services, such as GCM and APNS.

        Access Level: Write

        https://docs.aws.amazon.com/sns/latest/api/API_SetEndpointAttributes.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toSetEndpointAttributes", []))

    @jsii.member(jsii_name="toSetPlatformApplicationAttributes")
    def to_set_platform_application_attributes(self) -> "Sns":
        '''(experimental) Sets the attributes of the platform application object for the supported push notification services, such as APNS and GCM.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/sns/latest/api/API_SetPlatformApplicationAttributes.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toSetPlatformApplicationAttributes", []))

    @jsii.member(jsii_name="toSetSMSAttributes")
    def to_set_sms_attributes(self) -> "Sns":
        '''(experimental) Set the default settings for sending SMS messages and receiving daily SMS usage reports.

        Access Level: Write

        https://docs.aws.amazon.com/sns/latest/api/API_SetSMSAttributes.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toSetSMSAttributes", []))

    @jsii.member(jsii_name="toSetSubscriptionAttributes")
    def to_set_subscription_attributes(self) -> "Sns":
        '''(experimental) Allows a subscription owner to set an attribute of the topic to a new value.

        Access Level: Write

        https://docs.aws.amazon.com/sns/latest/api/API_SetSubscriptionAttributes.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toSetSubscriptionAttributes", []))

    @jsii.member(jsii_name="toSetTopicAttributes")
    def to_set_topic_attributes(self) -> "Sns":
        '''(experimental) Allows a topic owner to set an attribute of the topic to a new value.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/sns/latest/api/API_SetTopicAttributes.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toSetTopicAttributes", []))

    @jsii.member(jsii_name="toSubscribe")
    def to_subscribe(self) -> "Sns":
        '''(experimental) Prepares to subscribe an endpoint by sending the endpoint a confirmation message.

        Access Level: Write

        Possible conditions:

        - .ifEndpoint()
        - .ifProtocol()

        https://docs.aws.amazon.com/sns/latest/api/API_Subscribe.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toSubscribe", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Sns":
        '''(experimental) Add tags to the specified Amazon SNS topic.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/sns/latest/api/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUnsubscribe")
    def to_unsubscribe(self) -> "Sns":
        '''(experimental) Deletes a subscription.

        If the subscription requires authentication for deletion, only the owner of the subscription or the topic's owner can unsubscribe, and an AWS signature is required.

        Access Level: Write

        https://docs.aws.amazon.com/sns/latest/api/API_Unsubscribe.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toUnsubscribe", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Sns":
        '''(experimental) Remove tags from the specified Amazon SNS topic.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/sns/latest/api/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toUntagResource", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Sqs(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Sqs"):
    '''(experimental) Statement provider for service `sqs <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsqs.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `sqs <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsqs.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Sqs, self, [sid])

    @jsii.member(jsii_name="onQueue")
    def on_queue(
        self,
        queue_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sqs":
        '''(experimental) Adds a resource of type queue to the statement.

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-how-it-works.html

        :param queue_name: - Identifier for the queueName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "onQueue", [queue_name, account, region, partition]))

    @jsii.member(jsii_name="toAddPermission")
    def to_add_permission(self) -> "Sqs":
        '''(experimental) Adds a permission to a queue for a specific principal.

        Access Level: Permissions management

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_AddPermission.html

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "toAddPermission", []))

    @jsii.member(jsii_name="toChangeMessageVisibility")
    def to_change_message_visibility(self) -> "Sqs":
        '''(experimental) Changes the visibility timeout of a specified message in a queue to a new value.

        Access Level: Write

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_ChangeMessageVisibility.html

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "toChangeMessageVisibility", []))

    @jsii.member(jsii_name="toChangeMessageVisibilityBatch")
    def to_change_message_visibility_batch(self) -> "Sqs":
        '''(experimental) Changes the visibility timeout of multiple messages.

        Access Level: Write

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_ChangeMessageVisibilityBatch.html

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "toChangeMessageVisibilityBatch", []))

    @jsii.member(jsii_name="toCreateQueue")
    def to_create_queue(self) -> "Sqs":
        '''(experimental) Creates a new queue, or returns the URL of an existing one.

        Access Level: Write

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_CreateQueue.html

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "toCreateQueue", []))

    @jsii.member(jsii_name="toDeleteMessage")
    def to_delete_message(self) -> "Sqs":
        '''(experimental) Deletes the specified message from the specified queue.

        Access Level: Write

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_DeleteMessage.html

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "toDeleteMessage", []))

    @jsii.member(jsii_name="toDeleteMessageBatch")
    def to_delete_message_batch(self) -> "Sqs":
        '''(experimental) Deletes up to ten messages from the specified queue.

        Access Level: Write

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_DeleteMessageBatch.html

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "toDeleteMessageBatch", []))

    @jsii.member(jsii_name="toDeleteQueue")
    def to_delete_queue(self) -> "Sqs":
        '''(experimental) Deletes the queue specified by the queue URL, regardless of whether the queue is empty.

        Access Level: Write

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_DeleteQueue.html

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "toDeleteQueue", []))

    @jsii.member(jsii_name="toGetQueueAttributes")
    def to_get_queue_attributes(self) -> "Sqs":
        '''(experimental) Gets attributes for the specified queue.

        Access Level: Read

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_GetQueueAttributes.html

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "toGetQueueAttributes", []))

    @jsii.member(jsii_name="toGetQueueUrl")
    def to_get_queue_url(self) -> "Sqs":
        '''(experimental) Returns the URL of an existing queue.

        Access Level: Read

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_GetQueueUrl.html

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "toGetQueueUrl", []))

    @jsii.member(jsii_name="toListDeadLetterSourceQueues")
    def to_list_dead_letter_source_queues(self) -> "Sqs":
        '''(experimental) Returns a list of your queues that have the RedrivePolicy queue attribute configured with a dead letter queue.

        Access Level: Read

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_ListDeadLetterSourceQueues.html

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "toListDeadLetterSourceQueues", []))

    @jsii.member(jsii_name="toListQueues")
    def to_list_queues(self) -> "Sqs":
        '''(experimental) Returns a list of your queues.

        Access Level: List

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_ListQueues.html

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "toListQueues", []))

    @jsii.member(jsii_name="toListQueueTags")
    def to_list_queue_tags(self) -> "Sqs":
        '''(experimental) Lists tags added to an SQS queue.

        Access Level: Read

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_ListQueueTags.html

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "toListQueueTags", []))

    @jsii.member(jsii_name="toPurgeQueue")
    def to_purge_queue(self) -> "Sqs":
        '''(experimental) Deletes the messages in a queue specified by the queue URL.

        Access Level: Write

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_PurgeQueue.html

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "toPurgeQueue", []))

    @jsii.member(jsii_name="toReceiveMessage")
    def to_receive_message(self) -> "Sqs":
        '''(experimental) Retrieves one or more messages, with a maximum limit of 10 messages, from the specified queue.

        Access Level: Read

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_ReceiveMessage.html

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "toReceiveMessage", []))

    @jsii.member(jsii_name="toRemovePermission")
    def to_remove_permission(self) -> "Sqs":
        '''(experimental) Revokes any permissions in the queue policy that matches the specified Label parameter.

        Access Level: Permissions management

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_RemovePermission.html

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "toRemovePermission", []))

    @jsii.member(jsii_name="toSendMessage")
    def to_send_message(self) -> "Sqs":
        '''(experimental) Delivers a message to the specified queue.

        Access Level: Write

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_SendMessage.html

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "toSendMessage", []))

    @jsii.member(jsii_name="toSendMessageBatch")
    def to_send_message_batch(self) -> "Sqs":
        '''(experimental) Delivers up to ten messages to the specified queue.

        Access Level: Write

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_SendMessageBatch.html

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "toSendMessageBatch", []))

    @jsii.member(jsii_name="toSetQueueAttributes")
    def to_set_queue_attributes(self) -> "Sqs":
        '''(experimental) Sets the value of one or more queue attributes.

        Access Level: Write

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_SetQueueAttributes.html

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "toSetQueueAttributes", []))

    @jsii.member(jsii_name="toTagQueue")
    def to_tag_queue(self) -> "Sqs":
        '''(experimental) Add tags to the specified SQS queue.

        Access Level: Tagging

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_TagQueue.html

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "toTagQueue", []))

    @jsii.member(jsii_name="toUntagQueue")
    def to_untag_queue(self) -> "Sqs":
        '''(experimental) Remove tags from the specified SQS queue.

        Access Level: Tagging

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_UntagQueue.html

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "toUntagQueue", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Ssm(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Ssm"):
    '''(experimental) Statement provider for service `ssm <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssystemsmanager.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `ssm <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssystemsmanager.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Ssm, self, [sid])

    @jsii.member(jsii_name="ifEcsCluster")
    def if_ecs_cluster(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ssm":
        '''(experimental) Filters access by the ARN of an Amazon ECS cluster.

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/iam-policy-structure.html#amazon-ecs-keys

        Applies to actions:

        - .toStartSession()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "ifEcsCluster", [value, operator]))

    @jsii.member(jsii_name="ifEcsResourceTag")
    def if_ecs_resource_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ssm":
        '''(experimental) Filters access by tag key-value pairs attached to the resource.

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/iam-policy-structure.html#amazon-ecs-keys

        Applies to resource types:

        - task

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "ifEcsResourceTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifOverwrite")
    def if_overwrite(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ssm":
        '''(experimental) Filters access by controlling whether the values for specified resources can be overwritten.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/auth-and-access-control-iam-access-control-identity-based.html#policy-conditions

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "ifOverwrite", [value, operator]))

    @jsii.member(jsii_name="ifRecursive")
    def if_recursive(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ssm":
        '''(experimental) Filters access for resources created in a hierarchical structure.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/auth-and-access-control-iam-access-control-identity-based.html#policy-conditions

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "ifRecursive", [value, operator]))

    @jsii.member(jsii_name="ifResourceTag")
    def if_resource_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ssm":
        '''(experimental) Filters access based on a tag key-value pair assigned to the Systems Manager resource.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/auth-and-access-control-iam-access-control-identity-based.html#policy-conditions

        Applies to actions:

        - .toSendCommand()

        Applies to resource types:

        - document
        - instance
        - maintenancewindow
        - managed-instance
        - opsmetadata
        - parameter
        - patchbaseline

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "ifResourceTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifSessionDocumentAccessCheck")
    def if_session_document_access_check(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Ssm":
        '''(experimental) Filters access by verifying that a user has permission to access either the default Session Manager configuration document or the custom configuration document specified in a request.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/getting-started-sessiondocumentaccesscheck.html

        Applies to actions:

        - .toStartSession()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "ifSessionDocumentAccessCheck", [value]))

    @jsii.member(jsii_name="ifSyncType")
    def if_sync_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ssm":
        '''(experimental) Filters access by verifying that a user also has access to the ResourceDataSync SyncType specified in the request.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/auth-and-access-control-iam-access-control-identity-based.html#policy-conditions

        Applies to actions:

        - .toCreateResourceDataSync()
        - .toDeleteResourceDataSync()
        - .toListResourceDataSync()
        - .toUpdateResourceDataSync()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "ifSyncType", [value, operator]))

    @jsii.member(jsii_name="onAssociation")
    def on_association(
        self,
        association_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type association to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-associations.html

        :param association_id: - Identifier for the associationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "onAssociation", [association_id, account, region, partition]))

    @jsii.member(jsii_name="onAutomationDefinition")
    def on_automation_definition(
        self,
        automation_definition_name: builtins.str,
        version_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type automation-definition to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/automation-documents.html

        :param automation_definition_name: - Identifier for the automationDefinitionName.
        :param version_id: - Identifier for the versionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "onAutomationDefinition", [automation_definition_name, version_id, account, region, partition]))

    @jsii.member(jsii_name="onAutomationExecution")
    def on_automation_execution(
        self,
        automation_execution_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type automation-execution to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/automation-working.html

        :param automation_execution_id: - Identifier for the automationExecutionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "onAutomationExecution", [automation_execution_id, account, region, partition]))

    @jsii.member(jsii_name="onBucket")
    def on_bucket(
        self,
        bucket_name: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type bucket to the statement.

        :param bucket_name: - Identifier for the bucketName.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "onBucket", [bucket_name, partition]))

    @jsii.member(jsii_name="onDocument")
    def on_document(
        self,
        document_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type document to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-ssm-docs.html

        :param document_name: - Identifier for the documentName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "onDocument", [document_name, account, region, partition]))

    @jsii.member(jsii_name="onInstance")
    def on_instance(
        self,
        instance_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type instance to the statement.

        :param instance_id: - Identifier for the instanceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "onInstance", [instance_id, account, region, partition]))

    @jsii.member(jsii_name="onMaintenancewindow")
    def on_maintenancewindow(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type maintenancewindow to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-maintenance.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "onMaintenancewindow", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onManagedInstance")
    def on_managed_instance(
        self,
        instance_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type managed-instance to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/what-is-systems-manager.html

        :param instance_id: - Identifier for the instanceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "onManagedInstance", [instance_id, account, region, partition]))

    @jsii.member(jsii_name="onManagedInstanceInventory")
    def on_managed_instance_inventory(
        self,
        instance_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type managed-instance-inventory to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-inventory-configuring.html

        :param instance_id: - Identifier for the instanceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "onManagedInstanceInventory", [instance_id, account, region, partition]))

    @jsii.member(jsii_name="onOpsitem")
    def on_opsitem(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type opsitem to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/OpsCenter-working-with-OpsItems.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "onOpsitem", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onOpsmetadata")
    def on_opsmetadata(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type opsmetadata to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/API_OpsMetadata.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "onOpsmetadata", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onParameter")
    def on_parameter(
        self,
        parameter_name_without_leading_slash: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type parameter to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html

        :param parameter_name_without_leading_slash: - Identifier for the parameterNameWithoutLeadingSlash.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "onParameter", [parameter_name_without_leading_slash, account, region, partition]))

    @jsii.member(jsii_name="onPatchbaseline")
    def on_patchbaseline(
        self,
        patch_baseline_id_resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type patchbaseline to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-patch.html

        :param patch_baseline_id_resource_id: - Identifier for the patchBaselineIdResourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "onPatchbaseline", [patch_baseline_id_resource_id, account, region, partition]))

    @jsii.member(jsii_name="onResourcedatasync")
    def on_resourcedatasync(
        self,
        sync_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type resourcedatasync to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-inventory-datasync.html

        :param sync_name: - Identifier for the syncName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "onResourcedatasync", [sync_name, account, region, partition]))

    @jsii.member(jsii_name="onServicesetting")
    def on_servicesetting(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type servicesetting to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/API_ServiceSetting.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "onServicesetting", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onSession")
    def on_session(
        self,
        session_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type session to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html

        :param session_id: - Identifier for the sessionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "onSession", [session_id, account, region, partition]))

    @jsii.member(jsii_name="onTask")
    def on_task(
        self,
        task_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type task to the statement.

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/scheduling_tasks.html

        :param task_id: - Identifier for the taskId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifEcsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "onTask", [task_id, account, region, partition]))

    @jsii.member(jsii_name="onWindowtarget")
    def on_windowtarget(
        self,
        window_target_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type windowtarget to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-maintenance-assign-targets.html

        :param window_target_id: - Identifier for the windowTargetId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "onWindowtarget", [window_target_id, account, region, partition]))

    @jsii.member(jsii_name="onWindowtask")
    def on_windowtask(
        self,
        window_task_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type windowtask to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-maintenance-assign-tasks.html

        :param window_task_id: - Identifier for the windowTaskId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "onWindowtask", [window_task_id, account, region, partition]))

    @jsii.member(jsii_name="toAddTagsToResource")
    def to_add_tags_to_resource(self) -> "Ssm":
        '''(experimental) Grants permission to add or overwrite one or more tags for a specified AWS resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_AddTagsToResource.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toAddTagsToResource", []))

    @jsii.member(jsii_name="toCancelCommand")
    def to_cancel_command(self) -> "Ssm":
        '''(experimental) Grants permission to cancel a specified Run Command command.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_CancelCommand.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toCancelCommand", []))

    @jsii.member(jsii_name="toCancelMaintenanceWindowExecution")
    def to_cancel_maintenance_window_execution(self) -> "Ssm":
        '''(experimental) Grants permission to cancel an in-progress maintenance window execution.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_CancelMaintenanceWindowExecution.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toCancelMaintenanceWindowExecution", []))

    @jsii.member(jsii_name="toCreateActivation")
    def to_create_activation(self) -> "Ssm":
        '''(experimental) Grants permission to create an activation that is used to register on-premises servers and virtual machines (VMs) with Systems Manager.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_CreateActivation.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toCreateActivation", []))

    @jsii.member(jsii_name="toCreateAssociation")
    def to_create_association(self) -> "Ssm":
        '''(experimental) Grants permission to associate a specified Systems Manager document with specified instances or other targets.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_CreateAssociation.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toCreateAssociation", []))

    @jsii.member(jsii_name="toCreateAssociationBatch")
    def to_create_association_batch(self) -> "Ssm":
        '''(experimental) Grants permission to combine entries for multiple CreateAssociation operations in a single command.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_CreateAssociationBatch.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toCreateAssociationBatch", []))

    @jsii.member(jsii_name="toCreateDocument")
    def to_create_document(self) -> "Ssm":
        '''(experimental) Grants permission to create a Systems Manager SSM document.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_CreateDocument.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toCreateDocument", []))

    @jsii.member(jsii_name="toCreateMaintenanceWindow")
    def to_create_maintenance_window(self) -> "Ssm":
        '''(experimental) Grants permission to create a maintenance window.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_CreateMaintenanceWindow.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toCreateMaintenanceWindow", []))

    @jsii.member(jsii_name="toCreateOpsItem")
    def to_create_ops_item(self) -> "Ssm":
        '''(experimental) Grants permission to create an OpsItem in OpsCenter.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_CreateOpsItem.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toCreateOpsItem", []))

    @jsii.member(jsii_name="toCreateOpsMetadata")
    def to_create_ops_metadata(self) -> "Ssm":
        '''(experimental) Grants permission to create an OpsMetadata object for an AWS resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_CreateOpsMetadata.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toCreateOpsMetadata", []))

    @jsii.member(jsii_name="toCreatePatchBaseline")
    def to_create_patch_baseline(self) -> "Ssm":
        '''(experimental) Grants permission to create a patch baseline.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_CreatePatchBaseline.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toCreatePatchBaseline", []))

    @jsii.member(jsii_name="toCreateResourceDataSync")
    def to_create_resource_data_sync(self) -> "Ssm":
        '''(experimental) Grants permission to create a resource data sync configuration, which regularly collects inventory data from managed instances and updates the data in an Amazon S3 bucket.

        Access Level: Write

        Possible conditions:

        - .ifSyncType()

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_CreateResourceDataSync.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toCreateResourceDataSync", []))

    @jsii.member(jsii_name="toDeleteActivation")
    def to_delete_activation(self) -> "Ssm":
        '''(experimental) Grants permission to delete a specified activation for managed instances.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DeleteActivation.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDeleteActivation", []))

    @jsii.member(jsii_name="toDeleteAssociation")
    def to_delete_association(self) -> "Ssm":
        '''(experimental) Grants permission to disassociate a specified SSM document from a specified instance.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DeleteAssociation.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDeleteAssociation", []))

    @jsii.member(jsii_name="toDeleteDocument")
    def to_delete_document(self) -> "Ssm":
        '''(experimental) Grants permission to delete a specified SSM document and its instance associations.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DeleteDocument.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDeleteDocument", []))

    @jsii.member(jsii_name="toDeleteInventory")
    def to_delete_inventory(self) -> "Ssm":
        '''(experimental) Grants permission to delete a specified custom inventory type, or the data associated with a custom inventory type.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DeleteInventory.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDeleteInventory", []))

    @jsii.member(jsii_name="toDeleteMaintenanceWindow")
    def to_delete_maintenance_window(self) -> "Ssm":
        '''(experimental) Grants permission to delete a specified maintenance window.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DeleteMaintenanceWindow.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDeleteMaintenanceWindow", []))

    @jsii.member(jsii_name="toDeleteOpsMetadata")
    def to_delete_ops_metadata(self) -> "Ssm":
        '''(experimental) Grants permission to delete an OpsMetadata object.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DeleteOpsMetadata.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDeleteOpsMetadata", []))

    @jsii.member(jsii_name="toDeleteParameter")
    def to_delete_parameter(self) -> "Ssm":
        '''(experimental) Grants permission to delete a specified SSM parameter.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DeleteParameter.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDeleteParameter", []))

    @jsii.member(jsii_name="toDeleteParameters")
    def to_delete_parameters(self) -> "Ssm":
        '''(experimental) Grants permission to delete multiple specified SSM parameters.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DeleteParameters.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDeleteParameters", []))

    @jsii.member(jsii_name="toDeletePatchBaseline")
    def to_delete_patch_baseline(self) -> "Ssm":
        '''(experimental) Grants permission to delete a specified patch baseline.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DeletePatchBaseline.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDeletePatchBaseline", []))

    @jsii.member(jsii_name="toDeleteResourceDataSync")
    def to_delete_resource_data_sync(self) -> "Ssm":
        '''(experimental) Grants permission to delete a specified resource data sync.

        Access Level: Write

        Possible conditions:

        - .ifSyncType()

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DeleteResourceDataSync.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDeleteResourceDataSync", []))

    @jsii.member(jsii_name="toDeregisterManagedInstance")
    def to_deregister_managed_instance(self) -> "Ssm":
        '''(experimental) Grants permission to deregister a specified on-premises server or virtual machine (VM) from Systems Manager.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DeregisterManagedInstance.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDeregisterManagedInstance", []))

    @jsii.member(jsii_name="toDeregisterPatchBaselineForPatchGroup")
    def to_deregister_patch_baseline_for_patch_group(self) -> "Ssm":
        '''(experimental) Grants permission to deregister a specified patch baseline from being the default patch baseline for a specified patch group.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DeregisterPatchBaselineForPatchGroup.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDeregisterPatchBaselineForPatchGroup", []))

    @jsii.member(jsii_name="toDeregisterTargetFromMaintenanceWindow")
    def to_deregister_target_from_maintenance_window(self) -> "Ssm":
        '''(experimental) Grants permission to deregister a specified target from a maintenance window.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DeregisterTargetFromMaintenanceWindow.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDeregisterTargetFromMaintenanceWindow", []))

    @jsii.member(jsii_name="toDeregisterTaskFromMaintenanceWindow")
    def to_deregister_task_from_maintenance_window(self) -> "Ssm":
        '''(experimental) Grants permission to deregister a specified task from a maintenance window.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DeregisterTaskFromMaintenanceWindow.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDeregisterTaskFromMaintenanceWindow", []))

    @jsii.member(jsii_name="toDescribeActivations")
    def to_describe_activations(self) -> "Ssm":
        '''(experimental) Grants permission to view details about a specified managed instance activation, such as when it was created and the number of instances registered using the activation.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeActivations.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeActivations", []))

    @jsii.member(jsii_name="toDescribeAssociation")
    def to_describe_association(self) -> "Ssm":
        '''(experimental) Grants permission to view details about the specified association for a specified instance or target.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeAssociation.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeAssociation", []))

    @jsii.member(jsii_name="toDescribeAssociationExecutions")
    def to_describe_association_executions(self) -> "Ssm":
        '''(experimental) Grants permission to view all executions for a specified association.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeAssociationExecutions.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeAssociationExecutions", []))

    @jsii.member(jsii_name="toDescribeAssociationExecutionTargets")
    def to_describe_association_execution_targets(self) -> "Ssm":
        '''(experimental) Grants permission to view information about a specified association execution.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeAssociationExecutionTargets.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeAssociationExecutionTargets", []))

    @jsii.member(jsii_name="toDescribeAutomationExecutions")
    def to_describe_automation_executions(self) -> "Ssm":
        '''(experimental) Grants permission to view details about all active and terminated Automation executions.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeAutomationExecutions.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeAutomationExecutions", []))

    @jsii.member(jsii_name="toDescribeAutomationStepExecutions")
    def to_describe_automation_step_executions(self) -> "Ssm":
        '''(experimental) Grants permission to view information about all active and terminated step executions in an Automation workflow.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeAutomationStepExecutions.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeAutomationStepExecutions", []))

    @jsii.member(jsii_name="toDescribeAvailablePatches")
    def to_describe_available_patches(self) -> "Ssm":
        '''(experimental) Grants permission to view all patches eligible to include in a patch baseline.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeAvailablePatches.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeAvailablePatches", []))

    @jsii.member(jsii_name="toDescribeDocument")
    def to_describe_document(self) -> "Ssm":
        '''(experimental) Grants permission to view details about a specified SSM document.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeDocument.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeDocument", []))

    @jsii.member(jsii_name="toDescribeDocumentParameters")
    def to_describe_document_parameters(self) -> "Ssm":
        '''(experimental) Grants permission to display information about SSM document parameters in the Systems Manager console (internal Systems Manager action).

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-setting-up-messageAPIs.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeDocumentParameters", []))

    @jsii.member(jsii_name="toDescribeDocumentPermission")
    def to_describe_document_permission(self) -> "Ssm":
        '''(experimental) Grants permission to view the permissions for a specified SSM document.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeDocumentPermission.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeDocumentPermission", []))

    @jsii.member(jsii_name="toDescribeEffectiveInstanceAssociations")
    def to_describe_effective_instance_associations(self) -> "Ssm":
        '''(experimental) Grants permission to view all current associations for a specified instance.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeEffectiveInstanceAssociations.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeEffectiveInstanceAssociations", []))

    @jsii.member(jsii_name="toDescribeEffectivePatchesForPatchBaseline")
    def to_describe_effective_patches_for_patch_baseline(self) -> "Ssm":
        '''(experimental) Grants permission to view details about the patches currently associated with the specified patch baseline (Windows only).

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeEffectivePatchesForPatchBaseline.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeEffectivePatchesForPatchBaseline", []))

    @jsii.member(jsii_name="toDescribeInstanceAssociationsStatus")
    def to_describe_instance_associations_status(self) -> "Ssm":
        '''(experimental) Grants permission to view the status of the associations for a specified instance.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeInstanceAssociationsStatus.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeInstanceAssociationsStatus", []))

    @jsii.member(jsii_name="toDescribeInstanceInformation")
    def to_describe_instance_information(self) -> "Ssm":
        '''(experimental) Grants permission to view details about a specified instance.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeInstanceInformation.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeInstanceInformation", []))

    @jsii.member(jsii_name="toDescribeInstancePatches")
    def to_describe_instance_patches(self) -> "Ssm":
        '''(experimental) Grants permission to view general details about the patches on a specified instance.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeInstancePatches.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeInstancePatches", []))

    @jsii.member(jsii_name="toDescribeInstancePatchStates")
    def to_describe_instance_patch_states(self) -> "Ssm":
        '''(experimental) Grants permission to view status details about patches on a specified instance.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeInstancePatchStates.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeInstancePatchStates", []))

    @jsii.member(jsii_name="toDescribeInstancePatchStatesForPatchGroup")
    def to_describe_instance_patch_states_for_patch_group(self) -> "Ssm":
        '''(experimental) Grants permission to describe the high-level patch state for the instances in the specified patch group.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeInstancePatchStatesForPatchGroup.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeInstancePatchStatesForPatchGroup", []))

    @jsii.member(jsii_name="toDescribeInstanceProperties")
    def to_describe_instance_properties(self) -> "Ssm":
        '''(experimental) Grants permission to user's Amazon EC2 console to render managed instances' nodes.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-setting-up-messageAPIs.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeInstanceProperties", []))

    @jsii.member(jsii_name="toDescribeInventoryDeletions")
    def to_describe_inventory_deletions(self) -> "Ssm":
        '''(experimental) Grants permission to view details about a specified inventory deletion.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeInventoryDeletions.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeInventoryDeletions", []))

    @jsii.member(jsii_name="toDescribeMaintenanceWindowExecutions")
    def to_describe_maintenance_window_executions(self) -> "Ssm":
        '''(experimental) Grants permission to view the executions of a specified maintenance window.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeMaintenanceWindowExecutions.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeMaintenanceWindowExecutions", []))

    @jsii.member(jsii_name="toDescribeMaintenanceWindowExecutionTaskInvocations")
    def to_describe_maintenance_window_execution_task_invocations(self) -> "Ssm":
        '''(experimental) Grants permission to view details of a specified task execution for a maintenance window.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeMaintenanceWindowExecutionTaskInvocations.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeMaintenanceWindowExecutionTaskInvocations", []))

    @jsii.member(jsii_name="toDescribeMaintenanceWindowExecutionTasks")
    def to_describe_maintenance_window_execution_tasks(self) -> "Ssm":
        '''(experimental) Grants permission to view details about the tasks that ran during a specified maintenance window execution.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeMaintenanceWindowExecutionTasks.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeMaintenanceWindowExecutionTasks", []))

    @jsii.member(jsii_name="toDescribeMaintenanceWindows")
    def to_describe_maintenance_windows(self) -> "Ssm":
        '''(experimental) Grants permission to view information about all or specified maintenance windows.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeMaintenanceWindows.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeMaintenanceWindows", []))

    @jsii.member(jsii_name="toDescribeMaintenanceWindowSchedule")
    def to_describe_maintenance_window_schedule(self) -> "Ssm":
        '''(experimental) Grants permission to view details about upcoming executions of a specified maintenance window.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeMaintenanceWindowSchedule.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeMaintenanceWindowSchedule", []))

    @jsii.member(jsii_name="toDescribeMaintenanceWindowsForTarget")
    def to_describe_maintenance_windows_for_target(self) -> "Ssm":
        '''(experimental) Grants permission to view information about the maintenance window targets and tasks associated with a specified instance.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeMaintenanceWindowsForTarget.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeMaintenanceWindowsForTarget", []))

    @jsii.member(jsii_name="toDescribeMaintenanceWindowTargets")
    def to_describe_maintenance_window_targets(self) -> "Ssm":
        '''(experimental) Grants permission to view a list of the targets associated with a specified maintenance window.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeMaintenanceWindowTargets.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeMaintenanceWindowTargets", []))

    @jsii.member(jsii_name="toDescribeMaintenanceWindowTasks")
    def to_describe_maintenance_window_tasks(self) -> "Ssm":
        '''(experimental) Grants permission to view a list of the tasks associated with a specified maintenance window.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeMaintenanceWindowTasks.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeMaintenanceWindowTasks", []))

    @jsii.member(jsii_name="toDescribeOpsItems")
    def to_describe_ops_items(self) -> "Ssm":
        '''(experimental) Grants permission to view details about specified OpsItems.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeOpsItems.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeOpsItems", []))

    @jsii.member(jsii_name="toDescribeParameters")
    def to_describe_parameters(self) -> "Ssm":
        '''(experimental) Grants permission to view details about a specified SSM parameter.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeParameters.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeParameters", []))

    @jsii.member(jsii_name="toDescribePatchBaselines")
    def to_describe_patch_baselines(self) -> "Ssm":
        '''(experimental) Grants permission to view information about patch baselines that meet the specified criteria.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribePatchBaselines.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribePatchBaselines", []))

    @jsii.member(jsii_name="toDescribePatchGroups")
    def to_describe_patch_groups(self) -> "Ssm":
        '''(experimental) Grants permission to view information about the patch baseline for a specified patch group.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribePatchGroups.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribePatchGroups", []))

    @jsii.member(jsii_name="toDescribePatchGroupState")
    def to_describe_patch_group_state(self) -> "Ssm":
        '''(experimental) Grants permission to view aggregated status details for patches for a specified patch group.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribePatchGroupState.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribePatchGroupState", []))

    @jsii.member(jsii_name="toDescribePatchProperties")
    def to_describe_patch_properties(self) -> "Ssm":
        '''(experimental) Grants permission to view details of available patches for a specified operating system and patch property.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribePatchProperties.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribePatchProperties", []))

    @jsii.member(jsii_name="toDescribeSessions")
    def to_describe_sessions(self) -> "Ssm":
        '''(experimental) Grants permission to view a list of recent Session Manager sessions that meet the specified search criteria.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeSessions.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeSessions", []))

    @jsii.member(jsii_name="toGetAutomationExecution")
    def to_get_automation_execution(self) -> "Ssm":
        '''(experimental) Grants permission to view details of a specified Automation execution.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_AutomationExecution.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetAutomationExecution", []))

    @jsii.member(jsii_name="toGetCalendarState")
    def to_get_calendar_state(self) -> "Ssm":
        '''(experimental) Grants permission to view the calendar state for a change calendar or a list of change calendars.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetCalendarState.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetCalendarState", []))

    @jsii.member(jsii_name="toGetCommandInvocation")
    def to_get_command_invocation(self) -> "Ssm":
        '''(experimental) Grants permission to view details about the command execution of a specified invocation or plugin.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetCommandInvocation.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetCommandInvocation", []))

    @jsii.member(jsii_name="toGetConnectionStatus")
    def to_get_connection_status(self) -> "Ssm":
        '''(experimental) Grants permission to view the Session Manager connection status for a specified managed instance.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetConnectionStatus.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetConnectionStatus", []))

    @jsii.member(jsii_name="toGetDefaultPatchBaseline")
    def to_get_default_patch_baseline(self) -> "Ssm":
        '''(experimental) Grants permission to view the current default patch baseline for a specified operating system type.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetDefaultPatchBaseline.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetDefaultPatchBaseline", []))

    @jsii.member(jsii_name="toGetDeployablePatchSnapshotForInstance")
    def to_get_deployable_patch_snapshot_for_instance(self) -> "Ssm":
        '''(experimental) Grants permission to retrieve the current patch baseline snapshot for a specified instance.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetDeployablePatchSnapshotForInstance.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetDeployablePatchSnapshotForInstance", []))

    @jsii.member(jsii_name="toGetDocument")
    def to_get_document(self) -> "Ssm":
        '''(experimental) Grants permission to view the contents of a specified SSM document.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetDocument.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetDocument", []))

    @jsii.member(jsii_name="toGetInventory")
    def to_get_inventory(self) -> "Ssm":
        '''(experimental) Grants permission to view instance inventory details per the specified criteria.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetInventory.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetInventory", []))

    @jsii.member(jsii_name="toGetInventorySchema")
    def to_get_inventory_schema(self) -> "Ssm":
        '''(experimental) Grants permission to view a list of inventory types or attribute names for a specified inventory item type.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetInventorySchema.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetInventorySchema", []))

    @jsii.member(jsii_name="toGetMaintenanceWindow")
    def to_get_maintenance_window(self) -> "Ssm":
        '''(experimental) Grants permission to view details about a specified maintenance window.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetMaintenanceWindow.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetMaintenanceWindow", []))

    @jsii.member(jsii_name="toGetMaintenanceWindowExecution")
    def to_get_maintenance_window_execution(self) -> "Ssm":
        '''(experimental) Grants permission to view details about a specified maintenance window execution.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetMaintenanceWindowExecution.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetMaintenanceWindowExecution", []))

    @jsii.member(jsii_name="toGetMaintenanceWindowExecutionTask")
    def to_get_maintenance_window_execution_task(self) -> "Ssm":
        '''(experimental) Grants permission to view details about a specified maintenance window execution task.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetMaintenanceWindowExecutionTask.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetMaintenanceWindowExecutionTask", []))

    @jsii.member(jsii_name="toGetMaintenanceWindowExecutionTaskInvocation")
    def to_get_maintenance_window_execution_task_invocation(self) -> "Ssm":
        '''(experimental) Grants permission to view details about a specific maintenance window task running on a specific target.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetMaintenanceWindowExecutionTaskInvocation.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetMaintenanceWindowExecutionTaskInvocation", []))

    @jsii.member(jsii_name="toGetMaintenanceWindowTask")
    def to_get_maintenance_window_task(self) -> "Ssm":
        '''(experimental) Grants permission to view details about tasks registered with a specified maintenance window.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetMaintenanceWindowTask.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetMaintenanceWindowTask", []))

    @jsii.member(jsii_name="toGetManifest")
    def to_get_manifest(self) -> "Ssm":
        '''(experimental) Used by Systems Manager and SSM Agent to determine package installation requirements for an instance (internal Systems Manager call).

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetManifest", []))

    @jsii.member(jsii_name="toGetOpsItem")
    def to_get_ops_item(self) -> "Ssm":
        '''(experimental) Grants permission to view information about a specified OpsItem.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetOpsItem.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetOpsItem", []))

    @jsii.member(jsii_name="toGetOpsMetadata")
    def to_get_ops_metadata(self) -> "Ssm":
        '''(experimental) Grants permission to retrieve an OpsMetadata object.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetOpsMetadata.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetOpsMetadata", []))

    @jsii.member(jsii_name="toGetOpsSummary")
    def to_get_ops_summary(self) -> "Ssm":
        '''(experimental) Grants permission to view summary information about OpsItems based on specified filters and aggregators.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetOpsSummary.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetOpsSummary", []))

    @jsii.member(jsii_name="toGetParameter")
    def to_get_parameter(self) -> "Ssm":
        '''(experimental) Grants permission to view information about a specified parameter.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetParameter.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetParameter", []))

    @jsii.member(jsii_name="toGetParameterHistory")
    def to_get_parameter_history(self) -> "Ssm":
        '''(experimental) Grants permission to view details and changes for a specified parameter.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetParameterHistory.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetParameterHistory", []))

    @jsii.member(jsii_name="toGetParameters")
    def to_get_parameters(self) -> "Ssm":
        '''(experimental) Grants permission to view information about multiple specified parameters.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetParameters.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetParameters", []))

    @jsii.member(jsii_name="toGetParametersByPath")
    def to_get_parameters_by_path(self) -> "Ssm":
        '''(experimental) Grants permission to view information about parameters in a specified hierarchy.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetParametersByPath.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetParametersByPath", []))

    @jsii.member(jsii_name="toGetPatchBaseline")
    def to_get_patch_baseline(self) -> "Ssm":
        '''(experimental) Grants permission to view information about a specified patch baseline.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetPatchBaseline.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetPatchBaseline", []))

    @jsii.member(jsii_name="toGetPatchBaselineForPatchGroup")
    def to_get_patch_baseline_for_patch_group(self) -> "Ssm":
        '''(experimental) Grants permission to view the ID of the current patch baseline for a specified patch group.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetPatchBaselineForPatchGroup.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetPatchBaselineForPatchGroup", []))

    @jsii.member(jsii_name="toGetServiceSetting")
    def to_get_service_setting(self) -> "Ssm":
        '''(experimental) Grants permission to view the account-level setting for an AWS service.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetServiceSetting.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetServiceSetting", []))

    @jsii.member(jsii_name="toLabelParameterVersion")
    def to_label_parameter_version(self) -> "Ssm":
        '''(experimental) Grants permission to apply an identifying label to a specified version of a parameter.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_LabelParameterVersion.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toLabelParameterVersion", []))

    @jsii.member(jsii_name="toListAssociations")
    def to_list_associations(self) -> "Ssm":
        '''(experimental) Grants permission to list the associations for a specified SSM document or managed instance.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ListAssociations.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toListAssociations", []))

    @jsii.member(jsii_name="toListAssociationVersions")
    def to_list_association_versions(self) -> "Ssm":
        '''(experimental) Grants permission to list versions of the specified association.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ListAssociationVersions.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toListAssociationVersions", []))

    @jsii.member(jsii_name="toListCommandInvocations")
    def to_list_command_invocations(self) -> "Ssm":
        '''(experimental) Grants permission to list information about command invocations sent to a specified instance.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ListCommandInvocations.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toListCommandInvocations", []))

    @jsii.member(jsii_name="toListCommands")
    def to_list_commands(self) -> "Ssm":
        '''(experimental) Grants permission to list the commands sent to a specified instance.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ListCommands.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toListCommands", []))

    @jsii.member(jsii_name="toListComplianceItems")
    def to_list_compliance_items(self) -> "Ssm":
        '''(experimental) Grants permission to list compliance status for specified resource types on a specified resource.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ListComplianceItems.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toListComplianceItems", []))

    @jsii.member(jsii_name="toListComplianceSummaries")
    def to_list_compliance_summaries(self) -> "Ssm":
        '''(experimental) Grants permission to list a summary count of compliant and noncompliant resources for a specified compliance type.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ListComplianceSummaries.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toListComplianceSummaries", []))

    @jsii.member(jsii_name="toListDocumentMetadataHistory")
    def to_list_document_metadata_history(self) -> "Ssm":
        '''(experimental) Grants permission to view metadata history about a specified SSM document.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ListDocumentMetadataHistory.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toListDocumentMetadataHistory", []))

    @jsii.member(jsii_name="toListDocuments")
    def to_list_documents(self) -> "Ssm":
        '''(experimental) Grants permission to view information about a specified SSM document.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ListDocuments.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toListDocuments", []))

    @jsii.member(jsii_name="toListDocumentVersions")
    def to_list_document_versions(self) -> "Ssm":
        '''(experimental) Grants permission to list all versions of a specified document.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ListDocumentVersions.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toListDocumentVersions", []))

    @jsii.member(jsii_name="toListInstanceAssociations")
    def to_list_instance_associations(self) -> "Ssm":
        '''(experimental) Used by SSM Agent to check for new State Manager associations (internal Systems Manager call).

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-setting-up-messageAPIs.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toListInstanceAssociations", []))

    @jsii.member(jsii_name="toListInventoryEntries")
    def to_list_inventory_entries(self) -> "Ssm":
        '''(experimental) Grants permission to view a list of specified inventory types for a specified instance.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ListInventoryEntries.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toListInventoryEntries", []))

    @jsii.member(jsii_name="toListOpsItemEvents")
    def to_list_ops_item_events(self) -> "Ssm":
        '''(experimental) Grants permission to view details about OpsItemEvents.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ListOpsItemEvents.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toListOpsItemEvents", []))

    @jsii.member(jsii_name="toListOpsMetadata")
    def to_list_ops_metadata(self) -> "Ssm":
        '''(experimental) Grants permission to view a list of OpsMetadata objects.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ListOpsMetadata.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toListOpsMetadata", []))

    @jsii.member(jsii_name="toListResourceComplianceSummaries")
    def to_list_resource_compliance_summaries(self) -> "Ssm":
        '''(experimental) Grants permission to list resource-level summary count.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ListResourceComplianceSummaries.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toListResourceComplianceSummaries", []))

    @jsii.member(jsii_name="toListResourceDataSync")
    def to_list_resource_data_sync(self) -> "Ssm":
        '''(experimental) Grants permission to list information about resource data sync configurations in an account.

        Access Level: List

        Possible conditions:

        - .ifSyncType()

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ListResourceDataSync.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toListResourceDataSync", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Ssm":
        '''(experimental) Grants permission to view a list of resource tags for a specified resource.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toModifyDocumentPermission")
    def to_modify_document_permission(self) -> "Ssm":
        '''(experimental) Grants permission to share a custom SSM document publicly or privately with specified AWS accounts.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ModifyDocumentPermission.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toModifyDocumentPermission", []))

    @jsii.member(jsii_name="toPutComplianceItems")
    def to_put_compliance_items(self) -> "Ssm":
        '''(experimental) Grants permission to register a compliance type and other compliance details on a specified resource.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_PutComplianceItems.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toPutComplianceItems", []))

    @jsii.member(jsii_name="toPutConfigurePackageResult")
    def to_put_configure_package_result(self) -> "Ssm":
        '''(experimental) Used by SSM Agent to generate a report of the results of specific agent requests (internal Systems Manager call).

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toPutConfigurePackageResult", []))

    @jsii.member(jsii_name="toPutInventory")
    def to_put_inventory(self) -> "Ssm":
        '''(experimental) Grants permission to add or update inventory items on multiple specified managed instances.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_PutInventory.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toPutInventory", []))

    @jsii.member(jsii_name="toPutParameter")
    def to_put_parameter(self) -> "Ssm":
        '''(experimental) Grants permission to create an SSM parameter.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_PutParameter.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toPutParameter", []))

    @jsii.member(jsii_name="toRegisterDefaultPatchBaseline")
    def to_register_default_patch_baseline(self) -> "Ssm":
        '''(experimental) Grants permission to specify the default patch baseline for an operating system type.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_RegisterDefaultPatchBaseline.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toRegisterDefaultPatchBaseline", []))

    @jsii.member(jsii_name="toRegisterPatchBaselineForPatchGroup")
    def to_register_patch_baseline_for_patch_group(self) -> "Ssm":
        '''(experimental) Grants permission to specify the default patch baseline for a specified patch group.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_RegisterPatchBaselineForPatchGroup.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toRegisterPatchBaselineForPatchGroup", []))

    @jsii.member(jsii_name="toRegisterTargetWithMaintenanceWindow")
    def to_register_target_with_maintenance_window(self) -> "Ssm":
        '''(experimental) Grants permission to register a target with a specified maintenance window.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_RegisterTargetWithMaintenanceWindow.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toRegisterTargetWithMaintenanceWindow", []))

    @jsii.member(jsii_name="toRegisterTaskWithMaintenanceWindow")
    def to_register_task_with_maintenance_window(self) -> "Ssm":
        '''(experimental) Grants permission to register a task with a specified maintenance window.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_RegisterTaskWithMaintenanceWindow.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toRegisterTaskWithMaintenanceWindow", []))

    @jsii.member(jsii_name="toRemoveTagsFromResource")
    def to_remove_tags_from_resource(self) -> "Ssm":
        '''(experimental) Grants permission to remove a specified tag key from a specified resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_RemoveTagsFromResource.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toRemoveTagsFromResource", []))

    @jsii.member(jsii_name="toResetServiceSetting")
    def to_reset_service_setting(self) -> "Ssm":
        '''(experimental) Grants permission to reset the service setting for an AWS account to the default value.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ResetServiceSetting.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toResetServiceSetting", []))

    @jsii.member(jsii_name="toResumeSession")
    def to_resume_session(self) -> "Ssm":
        '''(experimental) Grants permission to reconnect a Session Manager session to a managed instance.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ResumeSession.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toResumeSession", []))

    @jsii.member(jsii_name="toSendAutomationSignal")
    def to_send_automation_signal(self) -> "Ssm":
        '''(experimental) Grants permission to send a signal to change the current behavior or status of a specified Automation execution.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_SendAutomationSignal.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toSendAutomationSignal", []))

    @jsii.member(jsii_name="toSendCommand")
    def to_send_command(self) -> "Ssm":
        '''(experimental) Grants permission to run commands on one or more specified managed instances.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifResourceTag()

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_SendCommand.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toSendCommand", []))

    @jsii.member(jsii_name="toStartAssociationsOnce")
    def to_start_associations_once(self) -> "Ssm":
        '''(experimental) Grants permission to run a specified association manually.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_StartAssociationsOnce.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toStartAssociationsOnce", []))

    @jsii.member(jsii_name="toStartAutomationExecution")
    def to_start_automation_execution(self) -> "Ssm":
        '''(experimental) Grants permission to initiate the execution of an Automation document.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_StartAutomationExecution.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toStartAutomationExecution", []))

    @jsii.member(jsii_name="toStartChangeRequestExecution")
    def to_start_change_request_execution(self) -> "Ssm":
        '''(experimental) Grants permission to initiate the execution of an Automation Change Template document.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_StartChangeRequestExecution.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toStartChangeRequestExecution", []))

    @jsii.member(jsii_name="toStartSession")
    def to_start_session(self) -> "Ssm":
        '''(experimental) Grants permission to initiate a connection to a specified target for a Session Manager session.

        Access Level: Write

        Possible conditions:

        - .ifSessionDocumentAccessCheck()
        - .ifEcsCluster()

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_StartSession.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toStartSession", []))

    @jsii.member(jsii_name="toStopAutomationExecution")
    def to_stop_automation_execution(self) -> "Ssm":
        '''(experimental) Grants permission to stop a specified Automation execution that is already in progress.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_StopAutomationExecution.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toStopAutomationExecution", []))

    @jsii.member(jsii_name="toTerminateSession")
    def to_terminate_session(self) -> "Ssm":
        '''(experimental) Grants permission to permanently end a Session Manager connection to an instance.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_TerminateSession.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toTerminateSession", []))

    @jsii.member(jsii_name="toUpdateAssociation")
    def to_update_association(self) -> "Ssm":
        '''(experimental) Grants permission to update an association and immediately run the association on the specified targets.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_UpdateAssociation.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toUpdateAssociation", []))

    @jsii.member(jsii_name="toUpdateAssociationStatus")
    def to_update_association_status(self) -> "Ssm":
        '''(experimental) Grants permission to update the status of the SSM document associated with a specified instance.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_UpdateAssociationStatus.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toUpdateAssociationStatus", []))

    @jsii.member(jsii_name="toUpdateDocument")
    def to_update_document(self) -> "Ssm":
        '''(experimental) Grants permission to update one or more values for an SSM document.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_UpdateDocument.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toUpdateDocument", []))

    @jsii.member(jsii_name="toUpdateDocumentDefaultVersion")
    def to_update_document_default_version(self) -> "Ssm":
        '''(experimental) Grants permission to change the default version of an SSM document.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_UpdateDocumentDefaultVersion.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toUpdateDocumentDefaultVersion", []))

    @jsii.member(jsii_name="toUpdateDocumentMetadata")
    def to_update_document_metadata(self) -> "Ssm":
        '''(experimental) Grants permission to update the metadata of an SSM document.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_UpdateDocumentMetadata.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toUpdateDocumentMetadata", []))

    @jsii.member(jsii_name="toUpdateInstanceAssociationStatus")
    def to_update_instance_association_status(self) -> "Ssm":
        '''(experimental) Used by SSM Agent to update the status of the association that it is currently running (internal Systems Manager call).

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toUpdateInstanceAssociationStatus", []))

    @jsii.member(jsii_name="toUpdateInstanceInformation")
    def to_update_instance_information(self) -> "Ssm":
        '''(experimental) Used by SSM Agent to send a heartbeat signal to the Systems Manager service in the cloud.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-setting-up-messageAPIs.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toUpdateInstanceInformation", []))

    @jsii.member(jsii_name="toUpdateMaintenanceWindow")
    def to_update_maintenance_window(self) -> "Ssm":
        '''(experimental) Grants permission to update a specified maintenance window.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_UpdateMaintenanceWindow.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toUpdateMaintenanceWindow", []))

    @jsii.member(jsii_name="toUpdateMaintenanceWindowTarget")
    def to_update_maintenance_window_target(self) -> "Ssm":
        '''(experimental) Grants permission to update a specified maintenance window target.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_UpdateMaintenanceWindowTarget.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toUpdateMaintenanceWindowTarget", []))

    @jsii.member(jsii_name="toUpdateMaintenanceWindowTask")
    def to_update_maintenance_window_task(self) -> "Ssm":
        '''(experimental) Grants permission to update a specified maintenance window task.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_UpdateMaintenanceWindowTask.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toUpdateMaintenanceWindowTask", []))

    @jsii.member(jsii_name="toUpdateManagedInstanceRole")
    def to_update_managed_instance_role(self) -> "Ssm":
        '''(experimental) Grants permission to assign or change the IAM role assigned to a specified managed instance.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_UpdateManagedInstanceRole.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toUpdateManagedInstanceRole", []))

    @jsii.member(jsii_name="toUpdateOpsItem")
    def to_update_ops_item(self) -> "Ssm":
        '''(experimental) Grants permission to edit or change an OpsItem.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_UpdateOpsItem.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toUpdateOpsItem", []))

    @jsii.member(jsii_name="toUpdateOpsMetadata")
    def to_update_ops_metadata(self) -> "Ssm":
        '''(experimental) Grants permission to update an OpsMetadata object.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_UpdateOpsMetadata.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toUpdateOpsMetadata", []))

    @jsii.member(jsii_name="toUpdatePatchBaseline")
    def to_update_patch_baseline(self) -> "Ssm":
        '''(experimental) Grants permission to update a specified patch baseline.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_UpdatePatchBaseline.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toUpdatePatchBaseline", []))

    @jsii.member(jsii_name="toUpdateResourceDataSync")
    def to_update_resource_data_sync(self) -> "Ssm":
        '''(experimental) Grants permission to update a resource data sync.

        Access Level: Write

        Possible conditions:

        - .ifSyncType()

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_UpdateResourceDataSync.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toUpdateResourceDataSync", []))

    @jsii.member(jsii_name="toUpdateServiceSetting")
    def to_update_service_setting(self) -> "Ssm":
        '''(experimental) Grants permission to update the service setting for an AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_UpdateServiceSetting.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toUpdateServiceSetting", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Ssmmessages(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Ssmmessages",
):
    '''(experimental) Statement provider for service `ssmmessages <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsessionmanagermessagegatewayservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `ssmmessages <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsessionmanagermessagegatewayservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Ssmmessages, self, [sid])

    @jsii.member(jsii_name="toCreateControlChannel")
    def to_create_control_channel(self) -> "Ssmmessages":
        '''(experimental) Grants permission to register a control channel for an instance to send control messages to Systems Manager service.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/userguide/getting-started-create-iam-instance-profile.html

        :stability: experimental
        '''
        return typing.cast("Ssmmessages", jsii.invoke(self, "toCreateControlChannel", []))

    @jsii.member(jsii_name="toCreateDataChannel")
    def to_create_data_channel(self) -> "Ssmmessages":
        '''(experimental) Grants permission to register a data channel for an instance to send data messages to Systems Manager service.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/userguide/getting-started-create-iam-instance-profile.html

        :stability: experimental
        '''
        return typing.cast("Ssmmessages", jsii.invoke(self, "toCreateDataChannel", []))

    @jsii.member(jsii_name="toOpenControlChannel")
    def to_open_control_channel(self) -> "Ssmmessages":
        '''(experimental) Grants permission to open a websocket connection for a registered control channel stream from an instance to Systems Manager service.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/userguide/getting-started-create-iam-instance-profile.html

        :stability: experimental
        '''
        return typing.cast("Ssmmessages", jsii.invoke(self, "toOpenControlChannel", []))

    @jsii.member(jsii_name="toOpenDataChannel")
    def to_open_data_channel(self) -> "Ssmmessages":
        '''(experimental) Grants permission to open a websocket connection for a registered data channel stream from an instance to Systems Manager service.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/userguide/getting-started-create-iam-instance-profile.html

        :stability: experimental
        '''
        return typing.cast("Ssmmessages", jsii.invoke(self, "toOpenDataChannel", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Sso(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Sso"):
    '''(experimental) Statement provider for service `sso <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssso.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `sso <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssso.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Sso, self, [sid])

    @jsii.member(jsii_name="onAccount")
    def on_account(
        self,
        account_id: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sso":
        '''(experimental) Adds a resource of type Account to the statement.

        :param account_id: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "onAccount", [account_id, partition]))

    @jsii.member(jsii_name="onInstance")
    def on_instance(
        self,
        instance_id: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sso":
        '''(experimental) Adds a resource of type Instance to the statement.

        :param instance_id: - Identifier for the instanceId.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "onInstance", [instance_id, partition]))

    @jsii.member(jsii_name="onPermissionSet")
    def on_permission_set(
        self,
        instance_id: builtins.str,
        permission_set_id: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sso":
        '''(experimental) Adds a resource of type PermissionSet to the statement.

        :param instance_id: - Identifier for the instanceId.
        :param permission_set_id: - Identifier for the permissionSetId.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "onPermissionSet", [instance_id, permission_set_id, partition]))

    @jsii.member(jsii_name="toAssociateDirectory")
    def to_associate_directory(self) -> "Sso":
        '''(experimental) Grants permission to connect a directory to be used by AWS Single Sign-On.

        Access Level: Write

        Dependent actions:

        - ds:AuthorizeApplication

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toAssociateDirectory", []))

    @jsii.member(jsii_name="toAssociateProfile")
    def to_associate_profile(self) -> "Sso":
        '''(experimental) Grants permission to create an association between a directory user or group and a profile.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toAssociateProfile", []))

    @jsii.member(jsii_name="toAttachManagedPolicyToPermissionSet")
    def to_attach_managed_policy_to_permission_set(self) -> "Sso":
        '''(experimental) Grants permission to attach an AWS managed policy to a permission set.

        Access Level: Permissions management

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_AttachManagedPolicyToPermissionSet.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toAttachManagedPolicyToPermissionSet", []))

    @jsii.member(jsii_name="toCreateAccountAssignment")
    def to_create_account_assignment(self) -> "Sso":
        '''(experimental) Grants permission to assign access to a Principal for a specified AWS account using a specified permission set.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_CreateAccountAssignment.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toCreateAccountAssignment", []))

    @jsii.member(jsii_name="toCreateApplicationInstance")
    def to_create_application_instance(self) -> "Sso":
        '''(experimental) Grants permission to add an application instance to AWS Single Sign-On.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toCreateApplicationInstance", []))

    @jsii.member(jsii_name="toCreateApplicationInstanceCertificate")
    def to_create_application_instance_certificate(self) -> "Sso":
        '''(experimental) Grants permission to add a new certificate for an application instance.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toCreateApplicationInstanceCertificate", []))

    @jsii.member(jsii_name="toCreateInstanceAccessControlAttributeConfiguration")
    def to_create_instance_access_control_attribute_configuration(self) -> "Sso":
        '''(experimental) Grants permission to enable the instance for ABAC and specify the attributes.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_CreateInstanceAccessControlAttributeConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toCreateInstanceAccessControlAttributeConfiguration", []))

    @jsii.member(jsii_name="toCreateManagedApplicationInstance")
    def to_create_managed_application_instance(self) -> "Sso":
        '''(experimental) Grants permission to add a managed application instance to AWS Single Sign-On.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toCreateManagedApplicationInstance", []))

    @jsii.member(jsii_name="toCreatePermissionSet")
    def to_create_permission_set(self) -> "Sso":
        '''(experimental) Grants permission to create a permission set.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_CreatePermissionSet.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toCreatePermissionSet", []))

    @jsii.member(jsii_name="toCreateProfile")
    def to_create_profile(self) -> "Sso":
        '''(experimental) Grants permission to create a profile for an application instance.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toCreateProfile", []))

    @jsii.member(jsii_name="toCreateTrust")
    def to_create_trust(self) -> "Sso":
        '''(experimental) Grants permission to create a federation trust in a target account.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toCreateTrust", []))

    @jsii.member(jsii_name="toDeleteAccountAssignment")
    def to_delete_account_assignment(self) -> "Sso":
        '''(experimental) Grants permission to delete a Principal's access from a specified AWS account using a specified permission set.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DeleteAccountAssignment.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDeleteAccountAssignment", []))

    @jsii.member(jsii_name="toDeleteApplicationInstance")
    def to_delete_application_instance(self) -> "Sso":
        '''(experimental) Grants permission to delete the application instance.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDeleteApplicationInstance", []))

    @jsii.member(jsii_name="toDeleteApplicationInstanceCertificate")
    def to_delete_application_instance_certificate(self) -> "Sso":
        '''(experimental) Grants permission to delete an inactive or expired certificate from the application instance.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDeleteApplicationInstanceCertificate", []))

    @jsii.member(jsii_name="toDeleteInlinePolicyFromPermissionSet")
    def to_delete_inline_policy_from_permission_set(self) -> "Sso":
        '''(experimental) Grants permission to delete the inline policy from a specified permission set.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DeleteInlinePolicyFromPermissionSet.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDeleteInlinePolicyFromPermissionSet", []))

    @jsii.member(jsii_name="toDeleteInstanceAccessControlAttributeConfiguration")
    def to_delete_instance_access_control_attribute_configuration(self) -> "Sso":
        '''(experimental) Grants permission to disable ABAC and remove the attributes list for the instance.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DeleteInstanceAccessControlAttributeConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDeleteInstanceAccessControlAttributeConfiguration", []))

    @jsii.member(jsii_name="toDeleteManagedApplicationInstance")
    def to_delete_managed_application_instance(self) -> "Sso":
        '''(experimental) Grants permission to delete the managed application instance.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDeleteManagedApplicationInstance", []))

    @jsii.member(jsii_name="toDeletePermissionSet")
    def to_delete_permission_set(self) -> "Sso":
        '''(experimental) Grants permission to delete a permission set.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDeletePermissionSet", []))

    @jsii.member(jsii_name="toDeletePermissionsPolicy")
    def to_delete_permissions_policy(self) -> "Sso":
        '''(experimental) Grants permission to delete the permission policy associated with a permission set.

        Access Level: Permissions management

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDeletePermissionsPolicy", []))

    @jsii.member(jsii_name="toDeleteProfile")
    def to_delete_profile(self) -> "Sso":
        '''(experimental) Grants permission to delete the profile for an application instance.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDeleteProfile", []))

    @jsii.member(jsii_name="toDescribeAccountAssignmentCreationStatus")
    def to_describe_account_assignment_creation_status(self) -> "Sso":
        '''(experimental) Grants permission to describe the status of the assignment creation request.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DescribeAccountAssignmentCreationStatus.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDescribeAccountAssignmentCreationStatus", []))

    @jsii.member(jsii_name="toDescribeAccountAssignmentDeletionStatus")
    def to_describe_account_assignment_deletion_status(self) -> "Sso":
        '''(experimental) Grants permission to describe the status of an assignment deletion request.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DescribeAccountAssignmentDeletionStatus.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDescribeAccountAssignmentDeletionStatus", []))

    @jsii.member(jsii_name="toDescribeInstanceAccessControlAttributeConfiguration")
    def to_describe_instance_access_control_attribute_configuration(self) -> "Sso":
        '''(experimental) Grants permission to get the list of attributes used by the instance for ABAC.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DescribeInstanceAccessControlAttributeConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDescribeInstanceAccessControlAttributeConfiguration", []))

    @jsii.member(jsii_name="toDescribePermissionSet")
    def to_describe_permission_set(self) -> "Sso":
        '''(experimental) Grants permission to describe a permission set.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DescribePermissionSet.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDescribePermissionSet", []))

    @jsii.member(jsii_name="toDescribePermissionSetProvisioningStatus")
    def to_describe_permission_set_provisioning_status(self) -> "Sso":
        '''(experimental) Grants permission to describe the status for the given Permission Set Provisioning request.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DescribePermissionSetProvisioningStatus.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDescribePermissionSetProvisioningStatus", []))

    @jsii.member(jsii_name="toDescribePermissionsPolicies")
    def to_describe_permissions_policies(self) -> "Sso":
        '''(experimental) Grants permission to retrieve all the permissions policies associated with a permission set.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDescribePermissionsPolicies", []))

    @jsii.member(jsii_name="toDescribeRegisteredRegions")
    def to_describe_registered_regions(self) -> "Sso":
        '''(experimental) Grants permission to obtain the regions where your organization has enabled AWS Single Sign-on.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDescribeRegisteredRegions", []))

    @jsii.member(jsii_name="toDetachManagedPolicyFromPermissionSet")
    def to_detach_managed_policy_from_permission_set(self) -> "Sso":
        '''(experimental) Grants permission to detach the attached AWS managed policy from the specified permission set.

        Access Level: Permissions management

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DetachManagedPolicyFromPermissionSet.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDetachManagedPolicyFromPermissionSet", []))

    @jsii.member(jsii_name="toDisassociateDirectory")
    def to_disassociate_directory(self) -> "Sso":
        '''(experimental) Grants permission to disassociate a directory to be used by AWS Single Sign-On.

        Access Level: Write

        Dependent actions:

        - ds:UnauthorizeApplication

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDisassociateDirectory", []))

    @jsii.member(jsii_name="toDisassociateProfile")
    def to_disassociate_profile(self) -> "Sso":
        '''(experimental) Grants permission to disassociate a directory user or group from a profile.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDisassociateProfile", []))

    @jsii.member(jsii_name="toGetApplicationInstance")
    def to_get_application_instance(self) -> "Sso":
        '''(experimental) Grants permission to retrieve details for an application instance.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toGetApplicationInstance", []))

    @jsii.member(jsii_name="toGetApplicationTemplate")
    def to_get_application_template(self) -> "Sso":
        '''(experimental) Grants permission to retrieve application template details.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toGetApplicationTemplate", []))

    @jsii.member(jsii_name="toGetInlinePolicyForPermissionSet")
    def to_get_inline_policy_for_permission_set(self) -> "Sso":
        '''(experimental) Grants permission to obtain the inline policy assigned to the permission set.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_GetInlinePolicyForPermissionSet.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toGetInlinePolicyForPermissionSet", []))

    @jsii.member(jsii_name="toGetManagedApplicationInstance")
    def to_get_managed_application_instance(self) -> "Sso":
        '''(experimental) Grants permission to retrieve details for an application instance.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toGetManagedApplicationInstance", []))

    @jsii.member(jsii_name="toGetMfaDeviceManagementForDirectory")
    def to_get_mfa_device_management_for_directory(self) -> "Sso":
        '''(experimental) Grants permission to retrieve Mfa Device Management settings for the directory.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toGetMfaDeviceManagementForDirectory", []))

    @jsii.member(jsii_name="toGetPermissionSet")
    def to_get_permission_set(self) -> "Sso":
        '''(experimental) Grants permission to retrieve details of a permission set.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toGetPermissionSet", []))

    @jsii.member(jsii_name="toGetPermissionsPolicy")
    def to_get_permissions_policy(self) -> "Sso":
        '''(experimental) Grants permission to retrieve all permission policies associated with a permission set.

        Access Level: Read

        Dependent actions:

        - sso:DescribePermissionsPolicies

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toGetPermissionsPolicy", []))

    @jsii.member(jsii_name="toGetProfile")
    def to_get_profile(self) -> "Sso":
        '''(experimental) Grants permission to retrieve a profile for an application instance.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toGetProfile", []))

    @jsii.member(jsii_name="toGetSharedSsoConfiguration")
    def to_get_shared_sso_configuration(self) -> "Sso":
        '''(experimental) Grants permission to retrieve shared configuration for the current SSO instance.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toGetSharedSsoConfiguration", []))

    @jsii.member(jsii_name="toGetSsoConfiguration")
    def to_get_sso_configuration(self) -> "Sso":
        '''(experimental) Grants permission to retrieve configuration for the current SSO instance.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toGetSsoConfiguration", []))

    @jsii.member(jsii_name="toGetSSOStatus")
    def to_get_sso_status(self) -> "Sso":
        '''(experimental) Grants permission to check if AWS Single Sign-On is enabled.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toGetSSOStatus", []))

    @jsii.member(jsii_name="toGetTrust")
    def to_get_trust(self) -> "Sso":
        '''(experimental) Grants permission to retrieve the federation trust in a target account.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toGetTrust", []))

    @jsii.member(jsii_name="toImportApplicationInstanceServiceProviderMetadata")
    def to_import_application_instance_service_provider_metadata(self) -> "Sso":
        '''(experimental) Grants permission to update the application instance by uploading an application SAML metadata file provided by the service provider.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toImportApplicationInstanceServiceProviderMetadata", []))

    @jsii.member(jsii_name="toListAccountAssignmentCreationStatus")
    def to_list_account_assignment_creation_status(self) -> "Sso":
        '''(experimental) Grants permission to list the status of the AWS account assignment creation requests for a specified SSO instance.

        Access Level: List

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListAccountAssignmentCreationStatus.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toListAccountAssignmentCreationStatus", []))

    @jsii.member(jsii_name="toListAccountAssignmentDeletionStatus")
    def to_list_account_assignment_deletion_status(self) -> "Sso":
        '''(experimental) Grants permission to list the status of the AWS account assignment deletion requests for a specified SSO instance.

        Access Level: List

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListAccountAssignmentDeletionStatus.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toListAccountAssignmentDeletionStatus", []))

    @jsii.member(jsii_name="toListAccountAssignments")
    def to_list_account_assignments(self) -> "Sso":
        '''(experimental) Grants permission to list the assignee of the specified AWS account with the specified permission set.

        Access Level: List

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListAccountAssignments.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toListAccountAssignments", []))

    @jsii.member(jsii_name="toListAccountsForProvisionedPermissionSet")
    def to_list_accounts_for_provisioned_permission_set(self) -> "Sso":
        '''(experimental) Grants permission to list all the AWS accounts where the specified permission set is provisioned.

        Access Level: List

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListAccountsForProvisionedPermissionSet.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toListAccountsForProvisionedPermissionSet", []))

    @jsii.member(jsii_name="toListApplicationInstanceCertificates")
    def to_list_application_instance_certificates(self) -> "Sso":
        '''(experimental) Grants permission to retrieve all of the certificates for a given application instance.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toListApplicationInstanceCertificates", []))

    @jsii.member(jsii_name="toListApplicationInstances")
    def to_list_application_instances(self) -> "Sso":
        '''(experimental) Grants permission to retrieve all application instances.

        Access Level: List

        Dependent actions:

        - sso:GetApplicationInstance

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toListApplicationInstances", []))

    @jsii.member(jsii_name="toListApplications")
    def to_list_applications(self) -> "Sso":
        '''(experimental) Grants permission to retrieve all supported applications.

        Access Level: List

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toListApplications", []))

    @jsii.member(jsii_name="toListApplicationTemplates")
    def to_list_application_templates(self) -> "Sso":
        '''(experimental) Grants permission to retrieve all supported application templates.

        Access Level: List

        Dependent actions:

        - sso:GetApplicationTemplate

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toListApplicationTemplates", []))

    @jsii.member(jsii_name="toListDirectoryAssociations")
    def to_list_directory_associations(self) -> "Sso":
        '''(experimental) Grants permission to retrieve details about the directory connected to AWS Single Sign-On.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toListDirectoryAssociations", []))

    @jsii.member(jsii_name="toListInstances")
    def to_list_instances(self) -> "Sso":
        '''(experimental) Grants permission to list the SSO Instances that the caller has access to.

        Access Level: List

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListInstances.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toListInstances", []))

    @jsii.member(jsii_name="toListManagedPoliciesInPermissionSet")
    def to_list_managed_policies_in_permission_set(self) -> "Sso":
        '''(experimental) Grants permission to list the AWS managed policies that are attached to a specified permission set.

        Access Level: List

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListManagedPoliciesInPermissionSet.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toListManagedPoliciesInPermissionSet", []))

    @jsii.member(jsii_name="toListPermissionSetProvisioningStatus")
    def to_list_permission_set_provisioning_status(self) -> "Sso":
        '''(experimental) Grants permission to list the status of the Permission Set Provisioning requests for a specified SSO instance.

        Access Level: List

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListPermissionSetProvisioningStatus.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toListPermissionSetProvisioningStatus", []))

    @jsii.member(jsii_name="toListPermissionSets")
    def to_list_permission_sets(self) -> "Sso":
        '''(experimental) Grants permission to retrieve all permission sets.

        Access Level: List

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toListPermissionSets", []))

    @jsii.member(jsii_name="toListPermissionSetsProvisionedToAccount")
    def to_list_permission_sets_provisioned_to_account(self) -> "Sso":
        '''(experimental) Grants permission to list all the permission sets that are provisioned to a specified AWS account.

        Access Level: List

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListPermissionSetsProvisionedToAccount.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toListPermissionSetsProvisionedToAccount", []))

    @jsii.member(jsii_name="toListProfileAssociations")
    def to_list_profile_associations(self) -> "Sso":
        '''(experimental) Grants permission to retrieve the directory user or group associated with the profile.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toListProfileAssociations", []))

    @jsii.member(jsii_name="toListProfiles")
    def to_list_profiles(self) -> "Sso":
        '''(experimental) Grants permission to retrieve all profiles for an application instance.

        Access Level: List

        Dependent actions:

        - sso:GetProfile

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toListProfiles", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Sso":
        '''(experimental) Grants permission to list the tags that are attached to a specified resource.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toProvisionPermissionSet")
    def to_provision_permission_set(self) -> "Sso":
        '''(experimental) Grants permission to provision a specified permission set to the specified target.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ProvisionPermissionSet.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toProvisionPermissionSet", []))

    @jsii.member(jsii_name="toPutInlinePolicyToPermissionSet")
    def to_put_inline_policy_to_permission_set(self) -> "Sso":
        '''(experimental) Grants permission to attach an IAM inline policy to a permission set.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_PutInlinePolicyToPermissionSet.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toPutInlinePolicyToPermissionSet", []))

    @jsii.member(jsii_name="toPutMfaDeviceManagementForDirectory")
    def to_put_mfa_device_management_for_directory(self) -> "Sso":
        '''(experimental) Grants permission to put Mfa Device Management settings for the directory.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toPutMfaDeviceManagementForDirectory", []))

    @jsii.member(jsii_name="toPutPermissionsPolicy")
    def to_put_permissions_policy(self) -> "Sso":
        '''(experimental) Grants permission to add a policy to a permission set.

        Access Level: Permissions management

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toPutPermissionsPolicy", []))

    @jsii.member(jsii_name="toSearchGroups")
    def to_search_groups(self) -> "Sso":
        '''(experimental) Grants permission to search for groups within the associated directory.

        Access Level: Read

        Dependent actions:

        - ds:DescribeDirectories

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toSearchGroups", []))

    @jsii.member(jsii_name="toSearchUsers")
    def to_search_users(self) -> "Sso":
        '''(experimental) Grants permission to search for users within the associated directory.

        Access Level: Read

        Dependent actions:

        - ds:DescribeDirectories

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toSearchUsers", []))

    @jsii.member(jsii_name="toStartSSO")
    def to_start_sso(self) -> "Sso":
        '''(experimental) Grants permission to initialize AWS Single Sign-On.

        Access Level: Write

        Dependent actions:

        - organizations:DescribeOrganization
        - organizations:EnableAWSServiceAccess

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toStartSSO", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Sso":
        '''(experimental) Grants permission to associate a set of tags with a specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Sso":
        '''(experimental) Grants permission to disassociate a set of tags from a specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateApplicationInstanceActiveCertificate")
    def to_update_application_instance_active_certificate(self) -> "Sso":
        '''(experimental) Grants permission to set a certificate as the active one for this application instance.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toUpdateApplicationInstanceActiveCertificate", []))

    @jsii.member(jsii_name="toUpdateApplicationInstanceDisplayData")
    def to_update_application_instance_display_data(self) -> "Sso":
        '''(experimental) Grants permission to update display data of an application instance.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toUpdateApplicationInstanceDisplayData", []))

    @jsii.member(jsii_name="toUpdateApplicationInstanceResponseConfiguration")
    def to_update_application_instance_response_configuration(self) -> "Sso":
        '''(experimental) Grants permission to update federation response configuration for the application instance.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toUpdateApplicationInstanceResponseConfiguration", []))

    @jsii.member(jsii_name="toUpdateApplicationInstanceResponseSchemaConfiguration")
    def to_update_application_instance_response_schema_configuration(self) -> "Sso":
        '''(experimental) Grants permission to update federation response schema configuration for the application instance.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toUpdateApplicationInstanceResponseSchemaConfiguration", []))

    @jsii.member(jsii_name="toUpdateApplicationInstanceSecurityConfiguration")
    def to_update_application_instance_security_configuration(self) -> "Sso":
        '''(experimental) Grants permission to update security details for the application instance.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toUpdateApplicationInstanceSecurityConfiguration", []))

    @jsii.member(jsii_name="toUpdateApplicationInstanceServiceProviderConfiguration")
    def to_update_application_instance_service_provider_configuration(self) -> "Sso":
        '''(experimental) Grants permission to update service provider related configuration for the application instance.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toUpdateApplicationInstanceServiceProviderConfiguration", []))

    @jsii.member(jsii_name="toUpdateApplicationInstanceStatus")
    def to_update_application_instance_status(self) -> "Sso":
        '''(experimental) Grants permission to update the status of an application instance.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toUpdateApplicationInstanceStatus", []))

    @jsii.member(jsii_name="toUpdateDirectoryAssociation")
    def to_update_directory_association(self) -> "Sso":
        '''(experimental) Grants permission to update the user attribute mappings for your connected directory.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toUpdateDirectoryAssociation", []))

    @jsii.member(jsii_name="toUpdateInstanceAccessControlAttributeConfiguration")
    def to_update_instance_access_control_attribute_configuration(self) -> "Sso":
        '''(experimental) Grants permission to update the attributes to use with the instance for ABAC.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_UpdateInstanceAccessControlAttributeConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toUpdateInstanceAccessControlAttributeConfiguration", []))

    @jsii.member(jsii_name="toUpdateManagedApplicationInstanceStatus")
    def to_update_managed_application_instance_status(self) -> "Sso":
        '''(experimental) Grants permission to update the status of a managed application instance.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toUpdateManagedApplicationInstanceStatus", []))

    @jsii.member(jsii_name="toUpdatePermissionSet")
    def to_update_permission_set(self) -> "Sso":
        '''(experimental) Grants permission to update the permission set.

        Access Level: Permissions management

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toUpdatePermissionSet", []))

    @jsii.member(jsii_name="toUpdateProfile")
    def to_update_profile(self) -> "Sso":
        '''(experimental) Grants permission to update the profile for an application instance.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toUpdateProfile", []))

    @jsii.member(jsii_name="toUpdateSSOConfiguration")
    def to_update_sso_configuration(self) -> "Sso":
        '''(experimental) Grants permission to update the configuration for the current SSO instance.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toUpdateSSOConfiguration", []))

    @jsii.member(jsii_name="toUpdateTrust")
    def to_update_trust(self) -> "Sso":
        '''(experimental) Grants permission to update the federation trust in a target account.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toUpdateTrust", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class SsoDirectory(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.SsoDirectory",
):
    '''(experimental) Statement provider for service `sso-directory <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsssodirectory.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `sso-directory <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsssodirectory.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(SsoDirectory, self, [sid])

    @jsii.member(jsii_name="toAddMemberToGroup")
    def to_add_member_to_group(self) -> "SsoDirectory":
        '''(experimental) Grants permission to add a member to a group in the directory that AWS SSO provides by default.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toAddMemberToGroup", []))

    @jsii.member(jsii_name="toCompleteVirtualMfaDeviceRegistration")
    def to_complete_virtual_mfa_device_registration(self) -> "SsoDirectory":
        '''(experimental) Grants permission to complete the creation process of a virtual MFA device.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toCompleteVirtualMfaDeviceRegistration", []))

    @jsii.member(jsii_name="toCompleteWebAuthnDeviceRegistration")
    def to_complete_web_authn_device_registration(self) -> "SsoDirectory":
        '''(experimental) Grants permission to complete the registration process of a WebAuthn device.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toCompleteWebAuthnDeviceRegistration", []))

    @jsii.member(jsii_name="toCreateAlias")
    def to_create_alias(self) -> "SsoDirectory":
        '''(experimental) Grants permission to create an alias for the directory that AWS SSO provides by default.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toCreateAlias", []))

    @jsii.member(jsii_name="toCreateBearerToken")
    def to_create_bearer_token(self) -> "SsoDirectory":
        '''(experimental) Grants permission to create a bearer token for a given provisioning tenant.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toCreateBearerToken", []))

    @jsii.member(jsii_name="toCreateExternalIdPConfigurationForDirectory")
    def to_create_external_id_p_configuration_for_directory(self) -> "SsoDirectory":
        '''(experimental) Grants permission to create an External Identity Provider configuration for the directory.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toCreateExternalIdPConfigurationForDirectory", []))

    @jsii.member(jsii_name="toCreateGroup")
    def to_create_group(self) -> "SsoDirectory":
        '''(experimental) Grants permission to create a group in the directory that AWS SSO provides by default.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toCreateGroup", []))

    @jsii.member(jsii_name="toCreateProvisioningTenant")
    def to_create_provisioning_tenant(self) -> "SsoDirectory":
        '''(experimental) Grants permission to create a provisioning tenant for a given directory.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toCreateProvisioningTenant", []))

    @jsii.member(jsii_name="toCreateUser")
    def to_create_user(self) -> "SsoDirectory":
        '''(experimental) Grants permission to create a user in the directory that AWS SSO provides by default.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toCreateUser", []))

    @jsii.member(jsii_name="toDeleteBearerToken")
    def to_delete_bearer_token(self) -> "SsoDirectory":
        '''(experimental) Grants permission to delete a bearer token.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toDeleteBearerToken", []))

    @jsii.member(jsii_name="toDeleteExternalIdPCertificate")
    def to_delete_external_id_p_certificate(self) -> "SsoDirectory":
        '''(experimental) Grants permission to delete the given external IdP certificate.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toDeleteExternalIdPCertificate", []))

    @jsii.member(jsii_name="toDeleteExternalIdPConfigurationForDirectory")
    def to_delete_external_id_p_configuration_for_directory(self) -> "SsoDirectory":
        '''(experimental) Grants permission to delete an External Identity Provider configuration associated with the directory.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toDeleteExternalIdPConfigurationForDirectory", []))

    @jsii.member(jsii_name="toDeleteGroup")
    def to_delete_group(self) -> "SsoDirectory":
        '''(experimental) Grants permission to delete a group from the directory that AWS SSO provides by default.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toDeleteGroup", []))

    @jsii.member(jsii_name="toDeleteMfaDeviceForUser")
    def to_delete_mfa_device_for_user(self) -> "SsoDirectory":
        '''(experimental) Grants permission to delete a MFA device by device name for a given user.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toDeleteMfaDeviceForUser", []))

    @jsii.member(jsii_name="toDeleteProvisioningTenant")
    def to_delete_provisioning_tenant(self) -> "SsoDirectory":
        '''(experimental) Grants permission to delete the provisioning tenant.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toDeleteProvisioningTenant", []))

    @jsii.member(jsii_name="toDeleteUser")
    def to_delete_user(self) -> "SsoDirectory":
        '''(experimental) Grants permission to delete a user from the directory that AWS SSO provides by default.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toDeleteUser", []))

    @jsii.member(jsii_name="toDescribeDirectory")
    def to_describe_directory(self) -> "SsoDirectory":
        '''(experimental) Grants permission to retrieve information about the directory that AWS SSO provides by default.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toDescribeDirectory", []))

    @jsii.member(jsii_name="toDescribeGroup")
    def to_describe_group(self) -> "SsoDirectory":
        '''(experimental) Grants permission to query the group data, not including user and group members.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toDescribeGroup", []))

    @jsii.member(jsii_name="toDescribeGroups")
    def to_describe_groups(self) -> "SsoDirectory":
        '''(experimental) Grants permission to retrieve information about groups from the directory that AWS SSO provides by default.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toDescribeGroups", []))

    @jsii.member(jsii_name="toDescribeProvisioningTenant")
    def to_describe_provisioning_tenant(self) -> "SsoDirectory":
        '''(experimental) Grants permission to describes the provisioning tenant.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toDescribeProvisioningTenant", []))

    @jsii.member(jsii_name="toDescribeUser")
    def to_describe_user(self) -> "SsoDirectory":
        '''(experimental) Grants permission to retrieve information about a user from the directory that AWS SSO provides by default.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toDescribeUser", []))

    @jsii.member(jsii_name="toDescribeUserByUniqueAttribute")
    def to_describe_user_by_unique_attribute(self) -> "SsoDirectory":
        '''(experimental) Grants permission to describe user with a valid unique attribute represented for the user.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toDescribeUserByUniqueAttribute", []))

    @jsii.member(jsii_name="toDescribeUsers")
    def to_describe_users(self) -> "SsoDirectory":
        '''(experimental) Grants permission to retrieve information about user from the directory that AWS SSO provides by default.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toDescribeUsers", []))

    @jsii.member(jsii_name="toDisableExternalIdPConfigurationForDirectory")
    def to_disable_external_id_p_configuration_for_directory(self) -> "SsoDirectory":
        '''(experimental) Grants permission to disable authentication of end users with an External Identity Provider.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toDisableExternalIdPConfigurationForDirectory", []))

    @jsii.member(jsii_name="toDisableUser")
    def to_disable_user(self) -> "SsoDirectory":
        '''(experimental) Grants permission to deactivate a user in the directory that AWS SSO provides by default.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toDisableUser", []))

    @jsii.member(jsii_name="toEnableExternalIdPConfigurationForDirectory")
    def to_enable_external_id_p_configuration_for_directory(self) -> "SsoDirectory":
        '''(experimental) Grants permission to enable authentication of end users with an External Identity Provider.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toEnableExternalIdPConfigurationForDirectory", []))

    @jsii.member(jsii_name="toEnableUser")
    def to_enable_user(self) -> "SsoDirectory":
        '''(experimental) Grants permission to activate user in the directory that AWS SSO provides by default.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toEnableUser", []))

    @jsii.member(jsii_name="toGetAWSSPConfigurationForDirectory")
    def to_get_awssp_configuration_for_directory(self) -> "SsoDirectory":
        '''(experimental) Grants permission to retrieve the AWS SSO Service Provider configurations for the directory.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toGetAWSSPConfigurationForDirectory", []))

    @jsii.member(jsii_name="toGetUserPoolInfo")
    def to_get_user_pool_info(self) -> "SsoDirectory":
        '''(experimental) Grants permission to get UserPool Info.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toGetUserPoolInfo", []))

    @jsii.member(jsii_name="toImportExternalIdPCertificate")
    def to_import_external_id_p_certificate(self) -> "SsoDirectory":
        '''(experimental) Grants permission to import the IdP certificate used for verifying external IdP responses.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toImportExternalIdPCertificate", []))

    @jsii.member(jsii_name="toIsMemberInGroup")
    def to_is_member_in_group(self) -> "SsoDirectory":
        '''(experimental) Grants permission to check if a member is a part of the group in the directory that AWS SSO provides by default.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toIsMemberInGroup", []))

    @jsii.member(jsii_name="toListBearerTokens")
    def to_list_bearer_tokens(self) -> "SsoDirectory":
        '''(experimental) Grants permission to list bearer tokens for a given provisioning tenant.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toListBearerTokens", []))

    @jsii.member(jsii_name="toListExternalIdPCertificates")
    def to_list_external_id_p_certificates(self) -> "SsoDirectory":
        '''(experimental) Grants permission to list the external IdP certificates of a given directory and IdP.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toListExternalIdPCertificates", []))

    @jsii.member(jsii_name="toListExternalIdPConfigurationsForDirectory")
    def to_list_external_id_p_configurations_for_directory(self) -> "SsoDirectory":
        '''(experimental) Grants permission to list all the External Identity Provider configurations created for the directory.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toListExternalIdPConfigurationsForDirectory", []))

    @jsii.member(jsii_name="toListGroupsForMember")
    def to_list_groups_for_member(self) -> "SsoDirectory":
        '''(experimental) Grants permission to list groups of the target member.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toListGroupsForMember", []))

    @jsii.member(jsii_name="toListGroupsForUser")
    def to_list_groups_for_user(self) -> "SsoDirectory":
        '''(experimental) Grants permission to list groups for a user from the directory that AWS SSO provides by default.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toListGroupsForUser", []))

    @jsii.member(jsii_name="toListMembersInGroup")
    def to_list_members_in_group(self) -> "SsoDirectory":
        '''(experimental) Grants permission to retrieve all members that are part of a group in the directory that AWS SSO provides by default.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toListMembersInGroup", []))

    @jsii.member(jsii_name="toListMfaDevicesForUser")
    def to_list_mfa_devices_for_user(self) -> "SsoDirectory":
        '''(experimental) Grants permission to list all active MFA devices and their MFA device metadata for a user.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toListMfaDevicesForUser", []))

    @jsii.member(jsii_name="toListProvisioningTenants")
    def to_list_provisioning_tenants(self) -> "SsoDirectory":
        '''(experimental) Grants permission to list provisioning tenants for a given directory.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toListProvisioningTenants", []))

    @jsii.member(jsii_name="toRemoveMemberFromGroup")
    def to_remove_member_from_group(self) -> "SsoDirectory":
        '''(experimental) Grants permission to remove a member that is part of a group in the directory that AWS SSO provides by default.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toRemoveMemberFromGroup", []))

    @jsii.member(jsii_name="toSearchGroups")
    def to_search_groups(self) -> "SsoDirectory":
        '''(experimental) Grants permission to search for groups within the associated directory.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toSearchGroups", []))

    @jsii.member(jsii_name="toSearchUsers")
    def to_search_users(self) -> "SsoDirectory":
        '''(experimental) Grants permission to search for users within the associated directory.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toSearchUsers", []))

    @jsii.member(jsii_name="toStartVirtualMfaDeviceRegistration")
    def to_start_virtual_mfa_device_registration(self) -> "SsoDirectory":
        '''(experimental) Grants permission to begin the creation process of virtual mfa device.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toStartVirtualMfaDeviceRegistration", []))

    @jsii.member(jsii_name="toStartWebAuthnDeviceRegistration")
    def to_start_web_authn_device_registration(self) -> "SsoDirectory":
        '''(experimental) Grants permission to begin the registration process of a WebAuthn device.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toStartWebAuthnDeviceRegistration", []))

    @jsii.member(jsii_name="toUpdateExternalIdPConfigurationForDirectory")
    def to_update_external_id_p_configuration_for_directory(self) -> "SsoDirectory":
        '''(experimental) Grants permission to update an External Identity Provider configuration associated with the directory.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toUpdateExternalIdPConfigurationForDirectory", []))

    @jsii.member(jsii_name="toUpdateGroup")
    def to_update_group(self) -> "SsoDirectory":
        '''(experimental) Grants permission to update information about a group in the directory that AWS SSO provides by default.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toUpdateGroup", []))

    @jsii.member(jsii_name="toUpdateGroupDisplayName")
    def to_update_group_display_name(self) -> "SsoDirectory":
        '''(experimental) Grants permission to update group display name update group display name response.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toUpdateGroupDisplayName", []))

    @jsii.member(jsii_name="toUpdateMfaDeviceForUser")
    def to_update_mfa_device_for_user(self) -> "SsoDirectory":
        '''(experimental) Grants permission to update MFA device information.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toUpdateMfaDeviceForUser", []))

    @jsii.member(jsii_name="toUpdatePassword")
    def to_update_password(self) -> "SsoDirectory":
        '''(experimental) Grants permission to update a password by sending password reset link via email or generating one time password for a user in the directory that AWS SSO provides by default.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toUpdatePassword", []))

    @jsii.member(jsii_name="toUpdateUser")
    def to_update_user(self) -> "SsoDirectory":
        '''(experimental) Grants permission to update user information in the directory that AWS SSO provides by default.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toUpdateUser", []))

    @jsii.member(jsii_name="toUpdateUserName")
    def to_update_user_name(self) -> "SsoDirectory":
        '''(experimental) Grants permission to update user name update user name response.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toUpdateUserName", []))

    @jsii.member(jsii_name="toVerifyEmail")
    def to_verify_email(self) -> "SsoDirectory":
        '''(experimental) Grants permission to verify an email address of an User.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toVerifyEmail", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class States(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.States"):
    '''(experimental) Statement provider for service `states <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsstepfunctions.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `states <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsstepfunctions.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(States, self, [sid])

    @jsii.member(jsii_name="onActivity")
    def on_activity(
        self,
        activity_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "States":
        '''(experimental) Adds a resource of type activity to the statement.

        https://docs.aws.amazon.com/step-functions/latest/dg/concepts-activities.html

        :param activity_name: - Identifier for the activityName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "onActivity", [activity_name, account, region, partition]))

    @jsii.member(jsii_name="onExecution")
    def on_execution(
        self,
        state_machine_name: builtins.str,
        execution_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "States":
        '''(experimental) Adds a resource of type execution to the statement.

        https://docs.aws.amazon.com/step-functions/latest/dg/concepts-state-machine-executions.html

        :param state_machine_name: - Identifier for the stateMachineName.
        :param execution_id: - Identifier for the executionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "onExecution", [state_machine_name, execution_id, account, region, partition]))

    @jsii.member(jsii_name="onStatemachine")
    def on_statemachine(
        self,
        state_machine_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "States":
        '''(experimental) Adds a resource of type statemachine to the statement.

        https://docs.aws.amazon.com/step-functions/latest/dg/concepts-amazon-states-language.html

        :param state_machine_name: - Identifier for the stateMachineName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "onStatemachine", [state_machine_name, account, region, partition]))

    @jsii.member(jsii_name="toCreateActivity")
    def to_create_activity(self) -> "States":
        '''(experimental) Grants permission to create an activity.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_CreateActivity.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toCreateActivity", []))

    @jsii.member(jsii_name="toCreateStateMachine")
    def to_create_state_machine(self) -> "States":
        '''(experimental) Grants permission to create a state machine.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_CreateStateMachine.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toCreateStateMachine", []))

    @jsii.member(jsii_name="toDeleteActivity")
    def to_delete_activity(self) -> "States":
        '''(experimental) Grants permission to delete an activity.

        Access Level: Write

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_DeleteActivity.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toDeleteActivity", []))

    @jsii.member(jsii_name="toDeleteStateMachine")
    def to_delete_state_machine(self) -> "States":
        '''(experimental) Grants permission to delete a state machine.

        Access Level: Write

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_DeleteStateMachine.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toDeleteStateMachine", []))

    @jsii.member(jsii_name="toDescribeActivity")
    def to_describe_activity(self) -> "States":
        '''(experimental) Grants permission to describe an activity.

        Access Level: Read

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_DescribeActivity.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toDescribeActivity", []))

    @jsii.member(jsii_name="toDescribeExecution")
    def to_describe_execution(self) -> "States":
        '''(experimental) Grants permission to describe an execution.

        Access Level: Read

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_DescribeExecution.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toDescribeExecution", []))

    @jsii.member(jsii_name="toDescribeStateMachine")
    def to_describe_state_machine(self) -> "States":
        '''(experimental) Grants permission to describe a state machine.

        Access Level: Read

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_DescribeStateMachine.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toDescribeStateMachine", []))

    @jsii.member(jsii_name="toDescribeStateMachineForExecution")
    def to_describe_state_machine_for_execution(self) -> "States":
        '''(experimental) Grants permission to describe the state machine for an execution.

        Access Level: Read

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_DescribeStateMachineForExecution.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toDescribeStateMachineForExecution", []))

    @jsii.member(jsii_name="toGetActivityTask")
    def to_get_activity_task(self) -> "States":
        '''(experimental) Grants permission to be used by workers to retrieve a task (with the specified activity ARN) which has been scheduled for execution by a running state machine.

        Access Level: Write

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_GetActivityTask.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toGetActivityTask", []))

    @jsii.member(jsii_name="toGetExecutionHistory")
    def to_get_execution_history(self) -> "States":
        '''(experimental) Grants permission to return the history of the specified execution as a list of events.

        Access Level: Read

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_GetExecutionHistory.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toGetExecutionHistory", []))

    @jsii.member(jsii_name="toListActivities")
    def to_list_activities(self) -> "States":
        '''(experimental) Grants permission to list the existing activities.

        Access Level: List

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_ListActivities.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toListActivities", []))

    @jsii.member(jsii_name="toListExecutions")
    def to_list_executions(self) -> "States":
        '''(experimental) Grants permission to list the executions of a state machine.

        Access Level: Read

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_ListExecutions.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toListExecutions", []))

    @jsii.member(jsii_name="toListStateMachines")
    def to_list_state_machines(self) -> "States":
        '''(experimental) Grants permission to lists the existing state machines.

        Access Level: List

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_ListStateMachines.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toListStateMachines", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "States":
        '''(experimental) Grants permission to list tags for an AWS Step Functions resource.

        Access Level: Read

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toSendTaskFailure")
    def to_send_task_failure(self) -> "States":
        '''(experimental) Grants permission to report that the task identified by the taskToken failed.

        Access Level: Write

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_SendTaskFailure.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toSendTaskFailure", []))

    @jsii.member(jsii_name="toSendTaskHeartbeat")
    def to_send_task_heartbeat(self) -> "States":
        '''(experimental) Grants permission to report to the service that the task represented by the specified taskToken is still making progress.

        Access Level: Write

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_SendTaskHeartbeat.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toSendTaskHeartbeat", []))

    @jsii.member(jsii_name="toSendTaskSuccess")
    def to_send_task_success(self) -> "States":
        '''(experimental) Grants permission to report that the task identified by the taskToken completed successfully.

        Access Level: Write

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_SendTaskSuccess.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toSendTaskSuccess", []))

    @jsii.member(jsii_name="toStartExecution")
    def to_start_execution(self) -> "States":
        '''(experimental) Grants permission to start a state machine execution.

        Access Level: Write

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_StartExecution.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toStartExecution", []))

    @jsii.member(jsii_name="toStartSyncExecution")
    def to_start_sync_execution(self) -> "States":
        '''(experimental) Grants permission to start a Synchronous Express state machine execution.

        Access Level: Write

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_StartSyncExecution.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toStartSyncExecution", []))

    @jsii.member(jsii_name="toStopExecution")
    def to_stop_execution(self) -> "States":
        '''(experimental) Grants permission to stop an execution.

        Access Level: Write

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_StopExecution.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toStopExecution", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "States":
        '''(experimental) Grants permission to tag an AWS Step Functions resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "States":
        '''(experimental) Grants permission to remove a tag from an AWS Step Functions resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateStateMachine")
    def to_update_state_machine(self) -> "States":
        '''(experimental) Grants permission to update a state machine.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_UpdateStateMachine.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toUpdateStateMachine", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Storagegateway(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Storagegateway",
):
    '''(experimental) Statement provider for service `storagegateway <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonstoragegateway.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `storagegateway <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonstoragegateway.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Storagegateway, self, [sid])

    @jsii.member(jsii_name="onDevice")
    def on_device(
        self,
        gateway_id: builtins.str,
        vtldevice: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Storagegateway":
        '''(experimental) Adds a resource of type device to the statement.

        https://docs.aws.amazon.com/storagegateway/latest/userguide/resource_vtl-devices.html

        :param gateway_id: - Identifier for the gatewayId.
        :param vtldevice: - Identifier for the vtldevice.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "onDevice", [gateway_id, vtldevice, account, region, partition]))

    @jsii.member(jsii_name="onFsAssociation")
    def on_fs_association(
        self,
        fsa_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Storagegateway":
        '''(experimental) Adds a resource of type fs-association to the statement.

        https://docs.aws.amazon.com/storagegateway/latest/userguide/API_AssociateFileSystem.html

        :param fsa_id: - Identifier for the fsaId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "onFsAssociation", [fsa_id, account, region, partition]))

    @jsii.member(jsii_name="onGateway")
    def on_gateway(
        self,
        gateway_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Storagegateway":
        '''(experimental) Adds a resource of type gateway to the statement.

        https://docs.aws.amazon.com/storagegateway/latest/userguide/StorageGatewayConcepts.html

        :param gateway_id: - Identifier for the gatewayId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "onGateway", [gateway_id, account, region, partition]))

    @jsii.member(jsii_name="onShare")
    def on_share(
        self,
        share_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Storagegateway":
        '''(experimental) Adds a resource of type share to the statement.

        https://docs.aws.amazon.com/storagegateway/latest/userguide/GettingStartedCreateFileShare.html

        :param share_id: - Identifier for the shareId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "onShare", [share_id, account, region, partition]))

    @jsii.member(jsii_name="onTape")
    def on_tape(
        self,
        tape_barcode: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Storagegateway":
        '''(experimental) Adds a resource of type tape to the statement.

        https://docs.aws.amazon.com/storagegateway/latest/userguide/StorageGatewayConcepts.html#storage-gateway-vtl-concepts

        :param tape_barcode: - Identifier for the tapeBarcode.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "onTape", [tape_barcode, account, region, partition]))

    @jsii.member(jsii_name="onTapepool")
    def on_tapepool(
        self,
        pool_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Storagegateway":
        '''(experimental) Adds a resource of type tapepool to the statement.

        https://docs.aws.amazon.com/storagegateway/latest/userguide/CreatingCustomTapePool.html

        :param pool_id: - Identifier for the poolId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "onTapepool", [pool_id, account, region, partition]))

    @jsii.member(jsii_name="onTarget")
    def on_target(
        self,
        gateway_id: builtins.str,
        iscsi_target: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Storagegateway":
        '''(experimental) Adds a resource of type target to the statement.

        https://docs.aws.amazon.com/storagegateway/latest/userguide/GettingStartedCreateVolumes.html

        :param gateway_id: - Identifier for the gatewayId.
        :param iscsi_target: - Identifier for the iscsiTarget.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "onTarget", [gateway_id, iscsi_target, account, region, partition]))

    @jsii.member(jsii_name="onVolume")
    def on_volume(
        self,
        gateway_id: builtins.str,
        volume_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Storagegateway":
        '''(experimental) Adds a resource of type volume to the statement.

        https://docs.aws.amazon.com/storagegateway/latest/userguide/StorageGatewayConcepts.html#volume-gateway-concepts

        :param gateway_id: - Identifier for the gatewayId.
        :param volume_id: - Identifier for the volumeId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "onVolume", [gateway_id, volume_id, account, region, partition]))

    @jsii.member(jsii_name="toActivateGateway")
    def to_activate_gateway(self) -> "Storagegateway":
        '''(experimental) Grants permission to activate the gateway you previously deployed on your host.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_ActivateGateway.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toActivateGateway", []))

    @jsii.member(jsii_name="toAddCache")
    def to_add_cache(self) -> "Storagegateway":
        '''(experimental) Grants permission to configure one or more gateway local disks as cache for a cached-volume gateway.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_AddCache.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toAddCache", []))

    @jsii.member(jsii_name="toAddTagsToResource")
    def to_add_tags_to_resource(self) -> "Storagegateway":
        '''(experimental) Grants permission to add one or more tags to the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_AddTagsToResource.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toAddTagsToResource", []))

    @jsii.member(jsii_name="toAddUploadBuffer")
    def to_add_upload_buffer(self) -> "Storagegateway":
        '''(experimental) Grants permission to configure one or more gateway local disks as upload buffer for a specified gateway.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_AddUploadBuffer.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toAddUploadBuffer", []))

    @jsii.member(jsii_name="toAddWorkingStorage")
    def to_add_working_storage(self) -> "Storagegateway":
        '''(experimental) Grants permission to configure one or more gateway local disks as working storage for a gateway.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_AddWorkingStorage.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toAddWorkingStorage", []))

    @jsii.member(jsii_name="toAssignTapePool")
    def to_assign_tape_pool(self) -> "Storagegateway":
        '''(experimental) Grants permission to move a tape to the target pool specified.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_AssignTapePool.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toAssignTapePool", []))

    @jsii.member(jsii_name="toAssociateFileSystem")
    def to_associate_file_system(self) -> "Storagegateway":
        '''(experimental) Grants permission to associate an Amazon FSx file system with the Amazon FSx file gateway.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_AssociateFileSystem.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toAssociateFileSystem", []))

    @jsii.member(jsii_name="toAttachVolume")
    def to_attach_volume(self) -> "Storagegateway":
        '''(experimental) Grants permission to connect a volume to an iSCSI connection and then attaches the volume to the specified gateway.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_AttachVolume.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toAttachVolume", []))

    @jsii.member(jsii_name="toBypassGovernanceRetention")
    def to_bypass_governance_retention(self) -> "Storagegateway":
        '''(experimental) Grants permission to allow the governance retention lock on a pool to be bypassed.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/userguide/CreatingCustomTapePool.html#TapeRetentionLock

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toBypassGovernanceRetention", []))

    @jsii.member(jsii_name="toCancelArchival")
    def to_cancel_archival(self) -> "Storagegateway":
        '''(experimental) Grants permission to cancel archiving of a virtual tape to the virtual tape shelf (VTS) after the archiving process is initiated.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_CancelArchival.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toCancelArchival", []))

    @jsii.member(jsii_name="toCancelRetrieval")
    def to_cancel_retrieval(self) -> "Storagegateway":
        '''(experimental) Grants permission to cancel retrieval of a virtual tape from the virtual tape shelf (VTS) to a gateway after the retrieval process is initiated.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_CancelRetrieval.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toCancelRetrieval", []))

    @jsii.member(jsii_name="toCreateCachediSCSIVolume")
    def to_create_cachedi_scsi_volume(self) -> "Storagegateway":
        '''(experimental) Grants permission to create a cached volume on a specified cached gateway.

        This operation is supported only for the gateway-cached volume architecture

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_CreateCachediSCSIVolume.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toCreateCachediSCSIVolume", []))

    @jsii.member(jsii_name="toCreateNFSFileShare")
    def to_create_nfs_file_share(self) -> "Storagegateway":
        '''(experimental) Grants permission to create a NFS file share on an existing file gateway.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_CreateNFSFileShare.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toCreateNFSFileShare", []))

    @jsii.member(jsii_name="toCreateSMBFileShare")
    def to_create_smb_file_share(self) -> "Storagegateway":
        '''(experimental) Grants permission to create a SMB file share on an existing file gateway.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_CreateSMBFileShare.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toCreateSMBFileShare", []))

    @jsii.member(jsii_name="toCreateSnapshot")
    def to_create_snapshot(self) -> "Storagegateway":
        '''(experimental) Grants permission to initiate a snapshot of a volume.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_CreateSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toCreateSnapshot", []))

    @jsii.member(jsii_name="toCreateSnapshotFromVolumeRecoveryPoint")
    def to_create_snapshot_from_volume_recovery_point(self) -> "Storagegateway":
        '''(experimental) Grants permission to initiate a snapshot of a gateway from a volume recovery point.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_CreateSnapshotFromVolumeRecoveryPoint.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toCreateSnapshotFromVolumeRecoveryPoint", []))

    @jsii.member(jsii_name="toCreateStorediSCSIVolume")
    def to_create_storedi_scsi_volume(self) -> "Storagegateway":
        '''(experimental) Grants permission to create a volume on a specified gateway.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_CreateStorediSCSIVolume.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toCreateStorediSCSIVolume", []))

    @jsii.member(jsii_name="toCreateTapePool")
    def to_create_tape_pool(self) -> "Storagegateway":
        '''(experimental) Grants permission to create a tape pool.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_CreateTapePool.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toCreateTapePool", []))

    @jsii.member(jsii_name="toCreateTapes")
    def to_create_tapes(self) -> "Storagegateway":
        '''(experimental) Grants permission to create one or more virtual tapes.

        You write data to the virtual tapes and then archive the tapes

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_CreateTapes.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toCreateTapes", []))

    @jsii.member(jsii_name="toCreateTapeWithBarcode")
    def to_create_tape_with_barcode(self) -> "Storagegateway":
        '''(experimental) Grants permission to create a virtual tape by using your own barcode.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_CreateTapeWithBarcode.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toCreateTapeWithBarcode", []))

    @jsii.member(jsii_name="toDeleteAutomaticTapeCreationPolicy")
    def to_delete_automatic_tape_creation_policy(self) -> "Storagegateway":
        '''(experimental) Grants permission to delete the automatic tape creation policy configured on a gateway-VTL.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DeleteAutomaticTapeCreationPolicy.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDeleteAutomaticTapeCreationPolicy", []))

    @jsii.member(jsii_name="toDeleteBandwidthRateLimit")
    def to_delete_bandwidth_rate_limit(self) -> "Storagegateway":
        '''(experimental) Grants permission to delete the bandwidth rate limits of a gateway.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DeleteBandwidthRateLimit.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDeleteBandwidthRateLimit", []))

    @jsii.member(jsii_name="toDeleteChapCredentials")
    def to_delete_chap_credentials(self) -> "Storagegateway":
        '''(experimental) Grants permission to delete Challenge-Handshake Authentication Protocol (CHAP) credentials for a specified iSCSI target and initiator pair.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DeleteChapCredentials.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDeleteChapCredentials", []))

    @jsii.member(jsii_name="toDeleteFileShare")
    def to_delete_file_share(self) -> "Storagegateway":
        '''(experimental) Grants permission to delete a file share from a file gateway.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DeleteFileShare.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDeleteFileShare", []))

    @jsii.member(jsii_name="toDeleteGateway")
    def to_delete_gateway(self) -> "Storagegateway":
        '''(experimental) Grants permission to delete a gateway.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DeleteGateway.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDeleteGateway", []))

    @jsii.member(jsii_name="toDeleteSnapshotSchedule")
    def to_delete_snapshot_schedule(self) -> "Storagegateway":
        '''(experimental) Grants permission to delete a snapshot of a volume.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DeleteSnapshotSchedule.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDeleteSnapshotSchedule", []))

    @jsii.member(jsii_name="toDeleteTape")
    def to_delete_tape(self) -> "Storagegateway":
        '''(experimental) Grants permission to delete the specified virtual tape.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DeleteTape.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDeleteTape", []))

    @jsii.member(jsii_name="toDeleteTapeArchive")
    def to_delete_tape_archive(self) -> "Storagegateway":
        '''(experimental) Grants permission to delete the specified virtual tape from the virtual tape shelf (VTS).

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DeleteTapeArchive.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDeleteTapeArchive", []))

    @jsii.member(jsii_name="toDeleteTapePool")
    def to_delete_tape_pool(self) -> "Storagegateway":
        '''(experimental) Grants permission to delete the specified tape pool.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DeleteTapePool.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDeleteTapePool", []))

    @jsii.member(jsii_name="toDeleteVolume")
    def to_delete_volume(self) -> "Storagegateway":
        '''(experimental) Grants permission to delete the specified gateway volume that you previously created using the CreateCachediSCSIVolume or CreateStorediSCSIVolume API.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DeleteVolume.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDeleteVolume", []))

    @jsii.member(jsii_name="toDescribeAvailabilityMonitorTest")
    def to_describe_availability_monitor_test(self) -> "Storagegateway":
        '''(experimental) Grants permission to get the information about the most recent high availability monitoring test that was performed on the gateway.

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeAvailabilityMonitorTest.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeAvailabilityMonitorTest", []))

    @jsii.member(jsii_name="toDescribeBandwidthRateLimit")
    def to_describe_bandwidth_rate_limit(self) -> "Storagegateway":
        '''(experimental) Grants permission to get the bandwidth rate limits of a gateway.

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeBandwidthRateLimit.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeBandwidthRateLimit", []))

    @jsii.member(jsii_name="toDescribeBandwidthRateLimitSchedule")
    def to_describe_bandwidth_rate_limit_schedule(self) -> "Storagegateway":
        '''(experimental) Grants permission to get the bandwidth rate limit schedule of a gateway.

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeBandwidthRateLimitSchedule.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeBandwidthRateLimitSchedule", []))

    @jsii.member(jsii_name="toDescribeCache")
    def to_describe_cache(self) -> "Storagegateway":
        '''(experimental) Grants permission to get information about the cache of a gateway.

        This operation is supported only for the gateway-cached volume architecture

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeCache.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeCache", []))

    @jsii.member(jsii_name="toDescribeCachediSCSIVolumes")
    def to_describe_cachedi_scsi_volumes(self) -> "Storagegateway":
        '''(experimental) Grants permission to get a description of the gateway volumes specified in the request.

        This operation is supported only for the gateway-cached volume architecture

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeCachediSCSIVolumes.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeCachediSCSIVolumes", []))

    @jsii.member(jsii_name="toDescribeChapCredentials")
    def to_describe_chap_credentials(self) -> "Storagegateway":
        '''(experimental) Grants permission to get an array of Challenge-Handshake Authentication Protocol (CHAP) credentials information for a specified iSCSI target, one for each target-initiator pair.

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeChapCredentials.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeChapCredentials", []))

    @jsii.member(jsii_name="toDescribeFileSystemAssociations")
    def to_describe_file_system_associations(self) -> "Storagegateway":
        '''(experimental) Grants permission to get a description for one or more file system associations.

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeFileSystemAssociations.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeFileSystemAssociations", []))

    @jsii.member(jsii_name="toDescribeGatewayInformation")
    def to_describe_gateway_information(self) -> "Storagegateway":
        '''(experimental) Grants permission to get metadata about a gateway such as its name, network interfaces, configured time zone, and the state (whether the gateway is running or not).

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeGatewayInformation.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeGatewayInformation", []))

    @jsii.member(jsii_name="toDescribeMaintenanceStartTime")
    def to_describe_maintenance_start_time(self) -> "Storagegateway":
        '''(experimental) Grants permission to get your gateway's weekly maintenance start time including the day and time of the week.

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeMaintenanceStartTime.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeMaintenanceStartTime", []))

    @jsii.member(jsii_name="toDescribeNFSFileShares")
    def to_describe_nfs_file_shares(self) -> "Storagegateway":
        '''(experimental) Grants permission to get a description for one or more file shares from a file gateway.

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeNFSFileShares.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeNFSFileShares", []))

    @jsii.member(jsii_name="toDescribeSMBFileShares")
    def to_describe_smb_file_shares(self) -> "Storagegateway":
        '''(experimental) Grants permission to get a description for one or more file shares from a file gateway.

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeSMBFileShares.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeSMBFileShares", []))

    @jsii.member(jsii_name="toDescribeSMBSettings")
    def to_describe_smb_settings(self) -> "Storagegateway":
        '''(experimental) Grants permission to get a description of a Server Message Block (SMB) file share settings from a file gateway.

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeSMBSettings.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeSMBSettings", []))

    @jsii.member(jsii_name="toDescribeSnapshotSchedule")
    def to_describe_snapshot_schedule(self) -> "Storagegateway":
        '''(experimental) Grants permission to describe the snapshot schedule for the specified gateway volume.

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeSnapshotSchedule.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeSnapshotSchedule", []))

    @jsii.member(jsii_name="toDescribeStorediSCSIVolumes")
    def to_describe_storedi_scsi_volumes(self) -> "Storagegateway":
        '''(experimental) Grants permission to get the description of the gateway volumes specified in the request.

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeStorediSCSIVolumes.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeStorediSCSIVolumes", []))

    @jsii.member(jsii_name="toDescribeTapeArchives")
    def to_describe_tape_archives(self) -> "Storagegateway":
        '''(experimental) Grants permission to get a description of specified virtual tapes in the virtual tape shelf (VTS).

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeTapeArchives.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeTapeArchives", []))

    @jsii.member(jsii_name="toDescribeTapeRecoveryPoints")
    def to_describe_tape_recovery_points(self) -> "Storagegateway":
        '''(experimental) Grants permission to get a list of virtual tape recovery points that are available for the specified gateway-VTL.

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeTapeRecoveryPoints.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeTapeRecoveryPoints", []))

    @jsii.member(jsii_name="toDescribeTapes")
    def to_describe_tapes(self) -> "Storagegateway":
        '''(experimental) Grants permission to get a description of the specified Amazon Resource Name (ARN) of virtual tapes.

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeTapes.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeTapes", []))

    @jsii.member(jsii_name="toDescribeUploadBuffer")
    def to_describe_upload_buffer(self) -> "Storagegateway":
        '''(experimental) Grants permission to get information about the upload buffer of a gateway.

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeUploadBuffer.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeUploadBuffer", []))

    @jsii.member(jsii_name="toDescribeVTLDevices")
    def to_describe_vtl_devices(self) -> "Storagegateway":
        '''(experimental) Grants permission to get a description of virtual tape library (VTL) devices for the specified gateway.

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeVTLDevices.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeVTLDevices", []))

    @jsii.member(jsii_name="toDescribeWorkingStorage")
    def to_describe_working_storage(self) -> "Storagegateway":
        '''(experimental) Grants permission to get information about the working storage of a gateway.

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeWorkingStorage.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeWorkingStorage", []))

    @jsii.member(jsii_name="toDetachVolume")
    def to_detach_volume(self) -> "Storagegateway":
        '''(experimental) Grants permission to disconnect a volume from an iSCSI connection and then detaches the volume from the specified gateway.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DetachVolume.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDetachVolume", []))

    @jsii.member(jsii_name="toDisableGateway")
    def to_disable_gateway(self) -> "Storagegateway":
        '''(experimental) Grants permission to disable a gateway when the gateway is no longer functioning.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DisableGateway.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDisableGateway", []))

    @jsii.member(jsii_name="toDisassociateFileSystem")
    def to_disassociate_file_system(self) -> "Storagegateway":
        '''(experimental) Grants permission to disassociate an Amazon FSx file system from an Amazon FSx file gateway.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DisassociateFileSystem.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDisassociateFileSystem", []))

    @jsii.member(jsii_name="toJoinDomain")
    def to_join_domain(self) -> "Storagegateway":
        '''(experimental) Grants permission to enable you to join an Active Directory Domain.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_JoinDomain.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toJoinDomain", []))

    @jsii.member(jsii_name="toListAutomaticTapeCreationPolicies")
    def to_list_automatic_tape_creation_policies(self) -> "Storagegateway":
        '''(experimental) Grants permission to list the automatic tape creation policies configured on the specified gateway-VTL or all gateway-VTLs owned by your account.

        Access Level: List

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_ListAutomaticTapeCreationPolicies.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toListAutomaticTapeCreationPolicies", []))

    @jsii.member(jsii_name="toListFileShares")
    def to_list_file_shares(self) -> "Storagegateway":
        '''(experimental) Grants permission to get a list of the file shares for a specific file gateway, or the list of file shares that belong to the calling user account.

        Access Level: List

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_ListFileShares.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toListFileShares", []))

    @jsii.member(jsii_name="toListFileSystemAssociations")
    def to_list_file_system_associations(self) -> "Storagegateway":
        '''(experimental) Grants permission to get a list of the file system associations for the specified gateway.

        Access Level: List

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_ListFileSystemAssociations.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toListFileSystemAssociations", []))

    @jsii.member(jsii_name="toListGateways")
    def to_list_gateways(self) -> "Storagegateway":
        '''(experimental) Grants permission to list gateways owned by an AWS account in a region specified in the request.

        The returned list is ordered by gateway Amazon Resource Name (ARN)

        Access Level: List

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_ListGateways.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toListGateways", []))

    @jsii.member(jsii_name="toListLocalDisks")
    def to_list_local_disks(self) -> "Storagegateway":
        '''(experimental) Grants permission to get a list of the gateway's local disks.

        Access Level: List

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_ListLocalDisks.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toListLocalDisks", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Storagegateway":
        '''(experimental) Grants permission to get the tags that have been added to the specified resource.

        Access Level: List

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTapePools")
    def to_list_tape_pools(self) -> "Storagegateway":
        '''(experimental) Grants permission to list tape pools owned by your AWS account.

        Access Level: List

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_ListTapePools.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toListTapePools", []))

    @jsii.member(jsii_name="toListTapes")
    def to_list_tapes(self) -> "Storagegateway":
        '''(experimental) Grants permission to list virtual tapes in your virtual tape library (VTL) and your virtual tape shelf (VTS).

        Access Level: List

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_ListTapes.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toListTapes", []))

    @jsii.member(jsii_name="toListVolumeInitiators")
    def to_list_volume_initiators(self) -> "Storagegateway":
        '''(experimental) Grants permission to list iSCSI initiators that are connected to a volume.

        Access Level: List

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_ListVolumeInitiators.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toListVolumeInitiators", []))

    @jsii.member(jsii_name="toListVolumeRecoveryPoints")
    def to_list_volume_recovery_points(self) -> "Storagegateway":
        '''(experimental) Grants permission to list the recovery points for a specified gateway.

        Access Level: List

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_ListVolumeRecoveryPoints.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toListVolumeRecoveryPoints", []))

    @jsii.member(jsii_name="toListVolumes")
    def to_list_volumes(self) -> "Storagegateway":
        '''(experimental) Grants permission to list the iSCSI stored volumes of a gateway.

        Access Level: List

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_ListVolumes.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toListVolumes", []))

    @jsii.member(jsii_name="toNotifyWhenUploaded")
    def to_notify_when_uploaded(self) -> "Storagegateway":
        '''(experimental) Grants permission to send you a notification through CloudWatch Events when all files written to your NFS file share have been uploaded to Amazon S3.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_NotifyWhenUploaded.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toNotifyWhenUploaded", []))

    @jsii.member(jsii_name="toRefreshCache")
    def to_refresh_cache(self) -> "Storagegateway":
        '''(experimental) Grants permission to refresh the cache for the specified file share.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_RefreshCache.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toRefreshCache", []))

    @jsii.member(jsii_name="toRemoveTagsFromResource")
    def to_remove_tags_from_resource(self) -> "Storagegateway":
        '''(experimental) Grants permission to remove one or more tags from the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_RemoveTagsFromResource.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toRemoveTagsFromResource", []))

    @jsii.member(jsii_name="toResetCache")
    def to_reset_cache(self) -> "Storagegateway":
        '''(experimental) Grants permission to reset all cache disks that have encountered a error and makes the disks available for reconfiguration as cache storage.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_ResetCache.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toResetCache", []))

    @jsii.member(jsii_name="toRetrieveTapeArchive")
    def to_retrieve_tape_archive(self) -> "Storagegateway":
        '''(experimental) Grants permission to retrieve an archived virtual tape from the virtual tape shelf (VTS) to a gateway-VTL.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_RetrieveTapeArchive.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toRetrieveTapeArchive", []))

    @jsii.member(jsii_name="toRetrieveTapeRecoveryPoint")
    def to_retrieve_tape_recovery_point(self) -> "Storagegateway":
        '''(experimental) Grants permission to retrieve the recovery point for the specified virtual tape.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_RetrieveTapeRecoveryPoint.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toRetrieveTapeRecoveryPoint", []))

    @jsii.member(jsii_name="toSetLocalConsolePassword")
    def to_set_local_console_password(self) -> "Storagegateway":
        '''(experimental) Grants permission to set the password for your VM local console.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_SetLocalConsolePassword.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toSetLocalConsolePassword", []))

    @jsii.member(jsii_name="toSetSMBGuestPassword")
    def to_set_smb_guest_password(self) -> "Storagegateway":
        '''(experimental) Grants permission to set the password for SMB Guest user.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_SetSMBGuestPassword.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toSetSMBGuestPassword", []))

    @jsii.member(jsii_name="toShutdownGateway")
    def to_shutdown_gateway(self) -> "Storagegateway":
        '''(experimental) Grants permission to shut down a gateway.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_ShutdownGateway.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toShutdownGateway", []))

    @jsii.member(jsii_name="toStartAvailabilityMonitorTest")
    def to_start_availability_monitor_test(self) -> "Storagegateway":
        '''(experimental) Grants permission to start a test that verifies that the specified gateway is configured for High Availability monitoring in your host environment.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_StartAvailabilityMonitorTest.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toStartAvailabilityMonitorTest", []))

    @jsii.member(jsii_name="toStartGateway")
    def to_start_gateway(self) -> "Storagegateway":
        '''(experimental) Grants permission to start a gateway that you previously shut down.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_StartGateway.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toStartGateway", []))

    @jsii.member(jsii_name="toUpdateAutomaticTapeCreationPolicy")
    def to_update_automatic_tape_creation_policy(self) -> "Storagegateway":
        '''(experimental) Grants permission to update the automatic tape creation policy configured on a gateway-VTL.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_UpdateAutomaticTapeCreationPolicy.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toUpdateAutomaticTapeCreationPolicy", []))

    @jsii.member(jsii_name="toUpdateBandwidthRateLimit")
    def to_update_bandwidth_rate_limit(self) -> "Storagegateway":
        '''(experimental) Grants permission to update the bandwidth rate limits of a gateway.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_UpdateBandwidthRateLimit.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toUpdateBandwidthRateLimit", []))

    @jsii.member(jsii_name="toUpdateBandwidthRateLimitSchedule")
    def to_update_bandwidth_rate_limit_schedule(self) -> "Storagegateway":
        '''(experimental) Grants permission to update the bandwidth rate limit schedule of a gateway.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_UpdateBandwidthRateLimitSchedule.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toUpdateBandwidthRateLimitSchedule", []))

    @jsii.member(jsii_name="toUpdateChapCredentials")
    def to_update_chap_credentials(self) -> "Storagegateway":
        '''(experimental) Grants permission to update the Challenge-Handshake Authentication Protocol (CHAP) credentials for a specified iSCSI target.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_UpdateChapCredentials.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toUpdateChapCredentials", []))

    @jsii.member(jsii_name="toUpdateFileSystemAssociation")
    def to_update_file_system_association(self) -> "Storagegateway":
        '''(experimental) Grants permission to update a file system association.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_UpdateFileSystemAssociation.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toUpdateFileSystemAssociation", []))

    @jsii.member(jsii_name="toUpdateGatewayInformation")
    def to_update_gateway_information(self) -> "Storagegateway":
        '''(experimental) Grants permission to update a gateway's metadata, which includes the gateway's name and time zone.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_UpdateGatewayInformation.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toUpdateGatewayInformation", []))

    @jsii.member(jsii_name="toUpdateGatewaySoftwareNow")
    def to_update_gateway_software_now(self) -> "Storagegateway":
        '''(experimental) Grants permission to update the gateway virtual machine (VM) software.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_UpdateGatewaySoftwareNow.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toUpdateGatewaySoftwareNow", []))

    @jsii.member(jsii_name="toUpdateMaintenanceStartTime")
    def to_update_maintenance_start_time(self) -> "Storagegateway":
        '''(experimental) Grants permission to update a gateway's weekly maintenance start time information, including day and time of the week.

        The maintenance time is the time in your gateway's time zone

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_UpdateMaintenanceStartTime.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toUpdateMaintenanceStartTime", []))

    @jsii.member(jsii_name="toUpdateNFSFileShare")
    def to_update_nfs_file_share(self) -> "Storagegateway":
        '''(experimental) Grants permission to update a NFS file share.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_UpdateNFSFileShare.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toUpdateNFSFileShare", []))

    @jsii.member(jsii_name="toUpdateSMBFileShare")
    def to_update_smb_file_share(self) -> "Storagegateway":
        '''(experimental) Grants permission to update a SMB file share.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_UpdateSMBFileShare.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toUpdateSMBFileShare", []))

    @jsii.member(jsii_name="toUpdateSMBFileShareVisibility")
    def to_update_smb_file_share_visibility(self) -> "Storagegateway":
        '''(experimental) Grants permission to update whether the shares on a gateway are visible in a net view or browse list.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_UpdateSMBFileShareVisibility.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toUpdateSMBFileShareVisibility", []))

    @jsii.member(jsii_name="toUpdateSMBSecurityStrategy")
    def to_update_smb_security_strategy(self) -> "Storagegateway":
        '''(experimental) Grants permission to update the SMB security strategy on a file gateway.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_UpdateSMBSecurityStrategy.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toUpdateSMBSecurityStrategy", []))

    @jsii.member(jsii_name="toUpdateSnapshotSchedule")
    def to_update_snapshot_schedule(self) -> "Storagegateway":
        '''(experimental) Grants permission to update a snapshot schedule configured for a gateway volume.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_UpdateSnapshotSchedule.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toUpdateSnapshotSchedule", []))

    @jsii.member(jsii_name="toUpdateVTLDeviceType")
    def to_update_vtl_device_type(self) -> "Storagegateway":
        '''(experimental) Grants permission to update the type of medium changer in a gateway-VTL.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_UpdateVTLDeviceType.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toUpdateVTLDeviceType", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Sts(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Sts"):
    '''(experimental) Statement provider for service `sts <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssecuritytokenservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `sts <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssecuritytokenservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Sts, self, [sid])

    @jsii.member(jsii_name="ifAmazonAppId")
    def if_amazon_app_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the Login with Amazon application ID.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_id

        Applies to actions:

        - .toAssumeRoleWithWebIdentity()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifAmazonAppId", [value, operator]))

    @jsii.member(jsii_name="ifAmazonUserId")
    def if_amazon_user_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the Login with Amazon user ID.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_id

        Applies to actions:

        - .toAssumeRoleWithWebIdentity()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifAmazonUserId", [value, operator]))

    @jsii.member(jsii_name="ifAwsFederatedProvider")
    def if_aws_federated_provider(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the IdP that was used to authenticate the user.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_federatedprovider

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifAwsFederatedProvider", [value, operator]))

    @jsii.member(jsii_name="ifCognitoAmr")
    def if_cognito_amr(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the login information for Amazon Cognito.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_amr

        Applies to actions:

        - .toAssumeRoleWithWebIdentity()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifCognitoAmr", [value, operator]))

    @jsii.member(jsii_name="ifCognitoAud")
    def if_cognito_aud(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the Amazon Cognito identity pool ID.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_aud

        Applies to actions:

        - .toAssumeRoleWithWebIdentity()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifCognitoAud", [value, operator]))

    @jsii.member(jsii_name="ifCognitoSub")
    def if_cognito_sub(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the subject of the claim (the Amazon Cognito user ID).

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_sub

        Applies to actions:

        - .toAssumeRoleWithWebIdentity()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifCognitoSub", [value, operator]))

    @jsii.member(jsii_name="ifExternalId")
    def if_external_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the unique identifier required when you assume a role in another account.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_externalid

        Applies to actions:

        - .toAssumeRole()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifExternalId", [value, operator]))

    @jsii.member(jsii_name="ifFacebookAppId")
    def if_facebook_app_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the Facebook application ID.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_id

        Applies to actions:

        - .toAssumeRoleWithWebIdentity()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifFacebookAppId", [value, operator]))

    @jsii.member(jsii_name="ifFacebookId")
    def if_facebook_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the Facebook user ID.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_id

        Applies to actions:

        - .toAssumeRoleWithWebIdentity()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifFacebookId", [value, operator]))

    @jsii.member(jsii_name="ifGoogleAud")
    def if_google_aud(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the Google application ID.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_aud

        Applies to actions:

        - .toAssumeRoleWithWebIdentity()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifGoogleAud", [value, operator]))

    @jsii.member(jsii_name="ifGoogleOaud")
    def if_google_oaud(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the Google audience.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_oaud

        Applies to actions:

        - .toAssumeRoleWithWebIdentity()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifGoogleOaud", [value, operator]))

    @jsii.member(jsii_name="ifGoogleSub")
    def if_google_sub(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the subject of the claim (the Google user ID).

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_sub

        Applies to actions:

        - .toAssumeRoleWithWebIdentity()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifGoogleSub", [value, operator]))

    @jsii.member(jsii_name="ifIamResourceTag")
    def if_iam_resource_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the tags that are attached to the role that is being assumed.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_ResourceTag

        Applies to actions:

        - .toAssumeRole()

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifIamResourceTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifRoleSessionName")
    def if_role_session_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the role session name required when you assume a role.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_rolesessionname

        Applies to actions:

        - .toAssumeRole()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifRoleSessionName", [value, operator]))

    @jsii.member(jsii_name="ifSamlAud")
    def if_saml_aud(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the endpoint URL to which SAML assertions are presented.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_aud

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifSamlAud", [value, operator]))

    @jsii.member(jsii_name="ifSamlCn")
    def if_saml_cn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the eduOrg attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_cn

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifSamlCn", [value, operator]))

    @jsii.member(jsii_name="ifSamlCommonName")
    def if_saml_common_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the commonName attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_commonname

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifSamlCommonName", [value, operator]))

    @jsii.member(jsii_name="ifSamlDoc")
    def if_saml_doc(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the principal that was used to assume the role.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_doc

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifSamlDoc", [value, operator]))

    @jsii.member(jsii_name="ifSamlEduorghomepageuri")
    def if_saml_eduorghomepageuri(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the eduOrg attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_eduorghomepageuri

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifSamlEduorghomepageuri", [value, operator]))

    @jsii.member(jsii_name="ifSamlEduorgidentityauthnpolicyuri")
    def if_saml_eduorgidentityauthnpolicyuri(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the eduOrg attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_aud

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifSamlEduorgidentityauthnpolicyuri", [value, operator]))

    @jsii.member(jsii_name="ifSamlEduorglegalname")
    def if_saml_eduorglegalname(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the eduOrg attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_eduorglegalname

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifSamlEduorglegalname", [value, operator]))

    @jsii.member(jsii_name="ifSamlEduorgsuperioruri")
    def if_saml_eduorgsuperioruri(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the eduOrg attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_eduorgsuperioruri

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifSamlEduorgsuperioruri", [value, operator]))

    @jsii.member(jsii_name="ifSamlEduorgwhitepagesuri")
    def if_saml_eduorgwhitepagesuri(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the eduOrg attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_eduorgwhitepagesuri

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifSamlEduorgwhitepagesuri", [value, operator]))

    @jsii.member(jsii_name="ifSamlEdupersonaffiliation")
    def if_saml_edupersonaffiliation(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the eduPerson attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_edupersonaffiliation

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifSamlEdupersonaffiliation", [value, operator]))

    @jsii.member(jsii_name="ifSamlEdupersonassurance")
    def if_saml_edupersonassurance(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the eduPerson attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_edupersonassurance

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifSamlEdupersonassurance", [value, operator]))

    @jsii.member(jsii_name="ifSamlEdupersonentitlement")
    def if_saml_edupersonentitlement(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the eduPerson attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_edupersonentitlement

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifSamlEdupersonentitlement", [value, operator]))

    @jsii.member(jsii_name="ifSamlEdupersonnickname")
    def if_saml_edupersonnickname(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the eduPerson attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_edupersonnickname

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifSamlEdupersonnickname", [value, operator]))

    @jsii.member(jsii_name="ifSamlEdupersonorgdn")
    def if_saml_edupersonorgdn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the eduPerson attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_edupersonorgdn

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifSamlEdupersonorgdn", [value, operator]))

    @jsii.member(jsii_name="ifSamlEdupersonorgunitdn")
    def if_saml_edupersonorgunitdn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the eduPerson attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_edupersonorgunitdn

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifSamlEdupersonorgunitdn", [value, operator]))

    @jsii.member(jsii_name="ifSamlEdupersonprimaryaffiliation")
    def if_saml_edupersonprimaryaffiliation(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the eduPerson attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_edupersonprimaryaffiliation

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifSamlEdupersonprimaryaffiliation", [value, operator]))

    @jsii.member(jsii_name="ifSamlEdupersonprimaryorgunitdn")
    def if_saml_edupersonprimaryorgunitdn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the eduPerson attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_edupersonprimaryorgunitdn

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifSamlEdupersonprimaryorgunitdn", [value, operator]))

    @jsii.member(jsii_name="ifSamlEdupersonprincipalname")
    def if_saml_edupersonprincipalname(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the eduPerson attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_edupersonprincipalname

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifSamlEdupersonprincipalname", [value, operator]))

    @jsii.member(jsii_name="ifSamlEdupersonscopedaffiliation")
    def if_saml_edupersonscopedaffiliation(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the eduPerson attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_edupersonscopedaffiliation

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifSamlEdupersonscopedaffiliation", [value, operator]))

    @jsii.member(jsii_name="ifSamlEdupersontargetedid")
    def if_saml_edupersontargetedid(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the eduPerson attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_edupersontargetedid

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifSamlEdupersontargetedid", [value, operator]))

    @jsii.member(jsii_name="ifSamlGivenName")
    def if_saml_given_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the givenName attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_givenname

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifSamlGivenName", [value, operator]))

    @jsii.member(jsii_name="ifSamlIss")
    def if_saml_iss(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the issuer, which is represented by a URN.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_iss

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifSamlIss", [value, operator]))

    @jsii.member(jsii_name="ifSamlMail")
    def if_saml_mail(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the mail attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_mail

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifSamlMail", [value, operator]))

    @jsii.member(jsii_name="ifSamlName")
    def if_saml_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the name attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_name

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifSamlName", [value, operator]))

    @jsii.member(jsii_name="ifSamlNamequalifier")
    def if_saml_namequalifier(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the hash value of the issuer, account ID, and friendly name.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_namequalifier

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifSamlNamequalifier", [value, operator]))

    @jsii.member(jsii_name="ifSamlOrganizationStatus")
    def if_saml_organization_status(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the organizationStatus attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_organizationstatus

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifSamlOrganizationStatus", [value, operator]))

    @jsii.member(jsii_name="ifSamlPrimaryGroupSID")
    def if_saml_primary_group_sid(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the primaryGroupSID attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_primarygroupsid

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifSamlPrimaryGroupSID", [value, operator]))

    @jsii.member(jsii_name="ifSamlSub")
    def if_saml_sub(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the subject of the claim (the SAML user ID).

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_sub

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifSamlSub", [value, operator]))

    @jsii.member(jsii_name="ifSamlSubType")
    def if_saml_sub_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the value persistent, transient, or the full Format URI.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_subtype

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifSamlSubType", [value, operator]))

    @jsii.member(jsii_name="ifSamlSurname")
    def if_saml_surname(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the surname attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_surname

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifSamlSurname", [value, operator]))

    @jsii.member(jsii_name="ifSamlUid")
    def if_saml_uid(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the uid attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_uid

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifSamlUid", [value, operator]))

    @jsii.member(jsii_name="ifSamlX500UniqueIdentifier")
    def if_saml_x500_unique_identifier(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the uid attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_x500uniqueidentifier

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifSamlX500UniqueIdentifier", [value, operator]))

    @jsii.member(jsii_name="ifTransitiveTagKeys")
    def if_transitive_tag_keys(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters actions based on the transitive tag keys that are passed in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_TransitiveTagKeys

        Applies to actions:

        - .toAssumeRole()
        - .toAssumeRoleWithSAML()
        - .toAssumeRoleWithWebIdentity()
        - .toTagSession()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "ifTransitiveTagKeys", [value, operator]))

    @jsii.member(jsii_name="onRole")
    def on_role(
        self,
        role_name_with_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sts":
        '''(experimental) Adds a resource of type role to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html

        :param role_name_with_path: - Identifier for the roleNameWithPath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "onRole", [role_name_with_path, account, partition]))

    @jsii.member(jsii_name="onUser")
    def on_user(
        self,
        user_name_with_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sts":
        '''(experimental) Adds a resource of type user to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users.html

        :param user_name_with_path: - Identifier for the userNameWithPath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "onUser", [user_name_with_path, account, partition]))

    @jsii.member(jsii_name="toAssumeRole")
    def to_assume_role(self) -> "Sts":
        '''(experimental) Returns a set of temporary security credentials that you can use to access AWS resources that you might not normally have access to.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsPrincipalTag()
        - .ifAwsRequestTag()
        - .ifTransitiveTagKeys()
        - .ifExternalId()
        - .ifRoleSessionName()
        - .ifIamResourceTag()

        https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "toAssumeRole", []))

    @jsii.member(jsii_name="toAssumeRoleWithSAML")
    def to_assume_role_with_saml(self) -> "Sts":
        '''(experimental) Returns a set of temporary security credentials for users who have been authenticated via a SAML authentication response.

        Access Level: Write

        Possible conditions:

        - .ifSamlNamequalifier()
        - .ifSamlSub()
        - .ifSamlSubType()
        - .ifSamlAud()
        - .ifSamlIss()
        - .ifSamlDoc()
        - .ifSamlCn()
        - .ifSamlCommonName()
        - .ifSamlEduorghomepageuri()
        - .ifSamlEduorgidentityauthnpolicyuri()
        - .ifSamlEduorglegalname()
        - .ifSamlEduorgsuperioruri()
        - .ifSamlEduorgwhitepagesuri()
        - .ifSamlEdupersonaffiliation()
        - .ifSamlEdupersonassurance()
        - .ifSamlEdupersonentitlement()
        - .ifSamlEdupersonnickname()
        - .ifSamlEdupersonorgdn()
        - .ifSamlEdupersonorgunitdn()
        - .ifSamlEdupersonprimaryaffiliation()
        - .ifSamlEdupersonprimaryorgunitdn()
        - .ifSamlEdupersonprincipalname()
        - .ifSamlEdupersonscopedaffiliation()
        - .ifSamlEdupersontargetedid()
        - .ifSamlGivenName()
        - .ifSamlMail()
        - .ifSamlName()
        - .ifSamlOrganizationStatus()
        - .ifSamlPrimaryGroupSID()
        - .ifSamlSurname()
        - .ifSamlUid()
        - .ifSamlX500UniqueIdentifier()
        - .ifAwsTagKeys()
        - .ifAwsPrincipalTag()
        - .ifAwsRequestTag()
        - .ifTransitiveTagKeys()

        https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithSAML.html

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "toAssumeRoleWithSAML", []))

    @jsii.member(jsii_name="toAssumeRoleWithWebIdentity")
    def to_assume_role_with_web_identity(self) -> "Sts":
        '''(experimental) Returns a set of temporary security credentials for users who have been authenticated in a mobile or web application with a web identity provider.

        Access Level: Write

        Possible conditions:

        - .ifCognitoAmr()
        - .ifCognitoAud()
        - .ifCognitoSub()
        - .ifAmazonAppId()
        - .ifAmazonUserId()
        - .ifFacebookAppId()
        - .ifFacebookId()
        - .ifGoogleAud()
        - .ifGoogleOaud()
        - .ifGoogleSub()
        - .ifAwsTagKeys()
        - .ifAwsPrincipalTag()
        - .ifAwsRequestTag()
        - .ifTransitiveTagKeys()

        https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "toAssumeRoleWithWebIdentity", []))

    @jsii.member(jsii_name="toDecodeAuthorizationMessage")
    def to_decode_authorization_message(self) -> "Sts":
        '''(experimental) Decodes additional information about the authorization status of a request from an encoded message returned in response to an AWS request.

        Access Level: Write

        https://docs.aws.amazon.com/STS/latest/APIReference/API_DecodeAuthorizationMessage.html

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "toDecodeAuthorizationMessage", []))

    @jsii.member(jsii_name="toGetAccessKeyInfo")
    def to_get_access_key_info(self) -> "Sts":
        '''(experimental) Returns details about the access key id passed as a parameter to the request.

        Access Level: Read

        https://docs.aws.amazon.com/STS/latest/APIReference/API_GetAccessKeyInfo.html

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "toGetAccessKeyInfo", []))

    @jsii.member(jsii_name="toGetCallerIdentity")
    def to_get_caller_identity(self) -> "Sts":
        '''(experimental) Returns details about the IAM identity whose credentials are used to call the API.

        Access Level: Read

        https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "toGetCallerIdentity", []))

    @jsii.member(jsii_name="toGetFederationToken")
    def to_get_federation_token(self) -> "Sts":
        '''(experimental) Returns a set of temporary security credentials (consisting of an access key ID, a secret access key, and a security token) for a federated user.

        Access Level: Read

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsPrincipalTag()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/STS/latest/APIReference/API_GetFederationToken.html

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "toGetFederationToken", []))

    @jsii.member(jsii_name="toGetServiceBearerToken")
    def to_get_service_bearer_token(self) -> "Sts":
        '''(experimental) Returns a STS bearer token for an AWS root user, IAM role, or an IAM user.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_bearer.html

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "toGetServiceBearerToken", []))

    @jsii.member(jsii_name="toGetSessionToken")
    def to_get_session_token(self) -> "Sts":
        '''(experimental) Returns a set of temporary security credentials (consisting of an access key ID, a secret access key, and a security token) for an AWS account or IAM user.

        Access Level: Read

        https://docs.aws.amazon.com/STS/latest/APIReference/API_GetSessionToken.html

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "toGetSessionToken", []))

    @jsii.member(jsii_name="toTagSession")
    def to_tag_session(self) -> "Sts":
        '''(experimental) Grants permission to add tags to a STS session.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsPrincipalTag()
        - .ifAwsRequestTag()
        - .ifTransitiveTagKeys()

        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "toTagSession", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Sumerian(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Sumerian",
):
    '''(experimental) Statement provider for service `sumerian <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsumerian.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `sumerian <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsumerian.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Sumerian, self, [sid])

    @jsii.member(jsii_name="onProject")
    def on_project(
        self,
        project_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sumerian":
        '''(experimental) Adds a resource of type project to the statement.

        :param project_name: - Identifier for the projectName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Sumerian", jsii.invoke(self, "onProject", [project_name, account, region, partition]))

    @jsii.member(jsii_name="toLogin")
    def to_login(self) -> "Sumerian":
        '''(experimental) Grant login access to the Sumerian console.

        Access Level: Write

        https://docs.aws.amazon.com/sumerian/latest/userguide/sumerian-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sumerian", jsii.invoke(self, "toLogin", []))

    @jsii.member(jsii_name="toViewRelease")
    def to_view_release(self) -> "Sumerian":
        '''(experimental) Grant access to view a project release.

        Access Level: Read

        https://docs.aws.amazon.com/sumerian/latest/userguide/sumerian-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sumerian", jsii.invoke(self, "toViewRelease", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Support(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Support"):
    '''(experimental) Statement provider for service `support <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssupport.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `support <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssupport.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Support, self, [sid])

    @jsii.member(jsii_name="toAddAttachmentsToSet")
    def to_add_attachments_to_set(self) -> "Support":
        '''(experimental) Adds one or more attachments to an AWS Support case.

        Access Level: Write

        https://docs.aws.amazon.com/awssupport/latest/APIReference/API_AddAttachmentsToSet.html

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toAddAttachmentsToSet", []))

    @jsii.member(jsii_name="toAddCommunicationToCase")
    def to_add_communication_to_case(self) -> "Support":
        '''(experimental) Adds a customer communication to an AWS Support case.

        Access Level: Write

        https://docs.aws.amazon.com/awssupport/latest/APIReference/API_AddCommunicationToCase.html

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toAddCommunicationToCase", []))

    @jsii.member(jsii_name="toCreateCase")
    def to_create_case(self) -> "Support":
        '''(experimental) Creates a new AWS Support case.

        Access Level: Write

        https://docs.aws.amazon.com/awssupport/latest/APIReference/API_CreateCase.html

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toCreateCase", []))

    @jsii.member(jsii_name="toDescribeAttachment")
    def to_describe_attachment(self) -> "Support":
        '''(experimental) Returns the description for an attachment.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/APIReference/API_DescribeAttachment.html

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toDescribeAttachment", []))

    @jsii.member(jsii_name="toDescribeCaseAttributes")
    def to_describe_case_attributes(self) -> "Support":
        '''(experimental) This is an internally managed function which allows secondary services to read AWS Support case attributes.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toDescribeCaseAttributes", []))

    @jsii.member(jsii_name="toDescribeCases")
    def to_describe_cases(self) -> "Support":
        '''(experimental) Returns a list of AWS Support cases that matches the given inputs.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/APIReference/API_DescribeCases.html

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toDescribeCases", []))

    @jsii.member(jsii_name="toDescribeCommunications")
    def to_describe_communications(self) -> "Support":
        '''(experimental) Returns the communications and attachments for one or more AWS Support cases.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/APIReference/API_DescribeCommunications.html

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toDescribeCommunications", []))

    @jsii.member(jsii_name="toDescribeIssueTypes")
    def to_describe_issue_types(self) -> "Support":
        '''(experimental) Returns issue types for AWS Support cases.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toDescribeIssueTypes", []))

    @jsii.member(jsii_name="toDescribeServices")
    def to_describe_services(self) -> "Support":
        '''(experimental) Returns the current list of AWS services and categories that applies to each service.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/APIReference/API_DescribeServices.html

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toDescribeServices", []))

    @jsii.member(jsii_name="toDescribeSeverityLevels")
    def to_describe_severity_levels(self) -> "Support":
        '''(experimental) Returns the list of severity levels that can be assigned to an AWS Support case.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/APIReference/API_DescribeSeverityLevels.html

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toDescribeSeverityLevels", []))

    @jsii.member(jsii_name="toDescribeSupportLevel")
    def to_describe_support_level(self) -> "Support":
        '''(experimental) Returns the support level for an AWS Account identifier.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toDescribeSupportLevel", []))

    @jsii.member(jsii_name="toDescribeTrustedAdvisorCheckRefreshStatuses")
    def to_describe_trusted_advisor_check_refresh_statuses(self) -> "Support":
        '''(experimental) Returns the status of a Trusted Advisor refresh check based on a list of check identifiers.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/APIReference/API_DescribeTrustedAdvisorCheckRefreshStatuses.html

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toDescribeTrustedAdvisorCheckRefreshStatuses", []))

    @jsii.member(jsii_name="toDescribeTrustedAdvisorCheckResult")
    def to_describe_trusted_advisor_check_result(self) -> "Support":
        '''(experimental) Returns the results of the Trusted Advisor check that has the specified check identifier.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/APIReference/API_DescribeTrustedAdvisorCheckResult.html

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toDescribeTrustedAdvisorCheckResult", []))

    @jsii.member(jsii_name="toDescribeTrustedAdvisorChecks")
    def to_describe_trusted_advisor_checks(self) -> "Support":
        '''(experimental) Returns a list of all available Trusted Advisor checks, including name, identifier, category and description.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/APIReference/API_DescribeTrustedAdvisorChecks.html

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toDescribeTrustedAdvisorChecks", []))

    @jsii.member(jsii_name="toDescribeTrustedAdvisorCheckSummaries")
    def to_describe_trusted_advisor_check_summaries(self) -> "Support":
        '''(experimental) Returns the summaries of the results of the Trusted Advisor checks that have the specified check identifiers.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/APIReference/API_DescribeTrustedAdvisorCheckSummaries.html

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toDescribeTrustedAdvisorCheckSummaries", []))

    @jsii.member(jsii_name="toInitiateCallForCase")
    def to_initiate_call_for_case(self) -> "Support":
        '''(experimental) This is an internally managed function to initiate a call on AWS Support Center.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toInitiateCallForCase", []))

    @jsii.member(jsii_name="toInitiateChatForCase")
    def to_initiate_chat_for_case(self) -> "Support":
        '''(experimental) This is an internally managed function to initiate a chat on AWS Support Center.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toInitiateChatForCase", []))

    @jsii.member(jsii_name="toPutCaseAttributes")
    def to_put_case_attributes(self) -> "Support":
        '''(experimental) This is an internally managed function which allows secondary services to attach attributes to AWS Support cases.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toPutCaseAttributes", []))

    @jsii.member(jsii_name="toRateCaseCommunication")
    def to_rate_case_communication(self) -> "Support":
        '''(experimental) Rate an AWS Support case communication.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toRateCaseCommunication", []))

    @jsii.member(jsii_name="toRefreshTrustedAdvisorCheck")
    def to_refresh_trusted_advisor_check(self) -> "Support":
        '''(experimental) Requests a refresh of the Trusted Advisor check that has the specified check identifier.

        Access Level: Write

        https://docs.aws.amazon.com/awssupport/latest/APIReference/API_RefreshTrustedAdvisorCheck.html

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toRefreshTrustedAdvisorCheck", []))

    @jsii.member(jsii_name="toResolveCase")
    def to_resolve_case(self) -> "Support":
        '''(experimental) Resolves an AWS Support case.

        Access Level: Write

        https://docs.aws.amazon.com/awssupport/latest/APIReference/API_ResolveCase.html

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toResolveCase", []))

    @jsii.member(jsii_name="toSearchForCases")
    def to_search_for_cases(self) -> "Support":
        '''(experimental) Returns a list of AWS Support cases that matches the given inputs.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toSearchForCases", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Swf(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Swf"):
    '''(experimental) Statement provider for service `swf <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsimpleworkflowservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `swf <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsimpleworkflowservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Swf, self, [sid])

    @jsii.member(jsii_name="ifActivityTypeName")
    def if_activity_type_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Swf":
        '''(experimental) Constrains the policy statement to only an activity type of the specified name.

        https://docs.aws.amazon.com/amazonswf/latest/developerguide/swf-dev-iam.html##swf-dev-iam.api

        Applies to actions:

        - .toDeprecateActivityType()
        - .toDescribeActivityType()
        - .toRespondActivityTaskCompleted()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "ifActivityTypeName", [value, operator]))

    @jsii.member(jsii_name="ifActivityTypeVersion")
    def if_activity_type_version(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Swf":
        '''(experimental) Contstrains the policy statement to only an activity type of the specified version.

        https://docs.aws.amazon.com/amazonswf/latest/developerguide/swf-dev-iam.html##swf-dev-iam.api

        Applies to actions:

        - .toDeprecateActivityType()
        - .toDescribeActivityType()
        - .toRespondActivityTaskCompleted()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "ifActivityTypeVersion", [value, operator]))

    @jsii.member(jsii_name="ifDefaultTaskListName")
    def if_default_task_list_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Swf":
        '''(experimental) Constrains the policy statement to only requests that specify a matching defaultTaskList name.

        https://docs.aws.amazon.com/amazonswf/latest/developerguide/swf-dev-iam.html##swf-dev-iam.api

        Applies to actions:

        - .toRegisterActivityType()
        - .toRegisterWorkflowType()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "ifDefaultTaskListName", [value, operator]))

    @jsii.member(jsii_name="ifName")
    def if_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Swf":
        '''(experimental) Constrains the policy statement to only activities or workflows with the specified name.

        https://docs.aws.amazon.com/amazonswf/latest/developerguide/swf-dev-iam.html##swf-dev-iam.api

        Applies to actions:

        - .toRegisterActivityType()
        - .toRegisterWorkflowType()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "ifName", [value, operator]))

    @jsii.member(jsii_name="ifTagFilterTag")
    def if_tag_filter_tag(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Swf":
        '''(experimental) Constrains the policy statement to only requests that specify a matching tagFilter.tag value.

        https://docs.aws.amazon.com/amazonswf/latest/developerguide/swf-dev-iam.html##swf-dev-iam.api

        Applies to actions:

        - .toCountClosedWorkflowExecutions()
        - .toCountOpenWorkflowExecutions()
        - .toListClosedWorkflowExecutions()
        - .toListOpenWorkflowExecutions()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "ifTagFilterTag", [value, operator]))

    @jsii.member(jsii_name="ifTagListMember0")
    def if_tag_list_member0(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Swf":
        '''(experimental) Constrains the policy statement to only requests that contain the specified tag.

        https://docs.aws.amazon.com/amazonswf/latest/developerguide/swf-dev-iam.html##swf-dev-iam.api

        Applies to actions:

        - .toRespondActivityTaskCompleted()
        - .toStartWorkflowExecution()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "ifTagListMember0", [value, operator]))

    @jsii.member(jsii_name="ifTagListMember1")
    def if_tag_list_member1(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Swf":
        '''(experimental) Constrains the policy statement to only requests that contain the specified tag.

        https://docs.aws.amazon.com/amazonswf/latest/developerguide/swf-dev-iam.html##swf-dev-iam.api

        Applies to actions:

        - .toRespondActivityTaskCompleted()
        - .toStartWorkflowExecution()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "ifTagListMember1", [value, operator]))

    @jsii.member(jsii_name="ifTagListMember2")
    def if_tag_list_member2(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Swf":
        '''(experimental) Constrains the policy statement to only requests that contain the specified tag.

        https://docs.aws.amazon.com/amazonswf/latest/developerguide/swf-dev-iam.html##swf-dev-iam.api

        Applies to actions:

        - .toRespondActivityTaskCompleted()
        - .toStartWorkflowExecution()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "ifTagListMember2", [value, operator]))

    @jsii.member(jsii_name="ifTagListMember3")
    def if_tag_list_member3(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Swf":
        '''(experimental) Constrains the policy statement to only requests that contain the specified tag.

        https://docs.aws.amazon.com/amazonswf/latest/developerguide/swf-dev-iam.html##swf-dev-iam.api

        Applies to actions:

        - .toRespondActivityTaskCompleted()
        - .toStartWorkflowExecution()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "ifTagListMember3", [value, operator]))

    @jsii.member(jsii_name="ifTagListMember4")
    def if_tag_list_member4(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Swf":
        '''(experimental) Constrains the policy statement to only requests that contain the specified tag.

        https://docs.aws.amazon.com/amazonswf/latest/developerguide/swf-dev-iam.html##swf-dev-iam.api

        Applies to actions:

        - .toRespondActivityTaskCompleted()
        - .toStartWorkflowExecution()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "ifTagListMember4", [value, operator]))

    @jsii.member(jsii_name="ifTaskListName")
    def if_task_list_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Swf":
        '''(experimental) Constrains the policy statement to only requests that specify a tasklist with the specified name.

        https://docs.aws.amazon.com/amazonswf/latest/developerguide/swf-dev-iam.html##swf-dev-iam.api

        Applies to actions:

        - .toCountPendingActivityTasks()
        - .toCountPendingDecisionTasks()
        - .toPollForActivityTask()
        - .toPollForDecisionTask()
        - .toRespondActivityTaskCompleted()
        - .toStartWorkflowExecution()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "ifTaskListName", [value, operator]))

    @jsii.member(jsii_name="ifTypeFilterName")
    def if_type_filter_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Swf":
        '''(experimental) Constrains the policy statement to only requests that specify a type filter with the specified name.

        https://docs.aws.amazon.com/amazonswf/latest/developerguide/swf-dev-iam.html##swf-dev-iam.api

        Applies to actions:

        - .toCountClosedWorkflowExecutions()
        - .toCountOpenWorkflowExecutions()
        - .toListClosedWorkflowExecutions()
        - .toListOpenWorkflowExecutions()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "ifTypeFilterName", [value, operator]))

    @jsii.member(jsii_name="ifTypeFilterVersion")
    def if_type_filter_version(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Swf":
        '''(experimental) Constrains the policy statement to only requests that specify a type filter with the specified version.

        https://docs.aws.amazon.com/amazonswf/latest/developerguide/swf-dev-iam.html##swf-dev-iam.api

        Applies to actions:

        - .toCountClosedWorkflowExecutions()
        - .toCountOpenWorkflowExecutions()
        - .toListClosedWorkflowExecutions()
        - .toListOpenWorkflowExecutions()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "ifTypeFilterVersion", [value, operator]))

    @jsii.member(jsii_name="ifVersion")
    def if_version(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Swf":
        '''(experimental) Constrains the policy statement to only activities or workflows with the specified version.

        https://docs.aws.amazon.com/amazonswf/latest/developerguide/swf-dev-iam.html##swf-dev-iam.api

        Applies to actions:

        - .toRegisterActivityType()
        - .toRegisterWorkflowType()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "ifVersion", [value, operator]))

    @jsii.member(jsii_name="ifWorkflowTypeName")
    def if_workflow_type_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Swf":
        '''(experimental) Constrains the policy statement to only requests that specify a workflow type of the specified name.

        https://docs.aws.amazon.com/amazonswf/latest/developerguide/swf-dev-iam.html##swf-dev-iam.api

        Applies to actions:

        - .toDeprecateWorkflowType()
        - .toDescribeWorkflowType()
        - .toRespondActivityTaskCompleted()
        - .toStartWorkflowExecution()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "ifWorkflowTypeName", [value, operator]))

    @jsii.member(jsii_name="ifWorkflowTypeVersion")
    def if_workflow_type_version(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Swf":
        '''(experimental) Constrains the policy statement to only requests that specify a workflow type of the specified version.

        https://docs.aws.amazon.com/amazonswf/latest/developerguide/swf-dev-iam.html##swf-dev-iam.api

        Applies to actions:

        - .toDeprecateWorkflowType()
        - .toDescribeWorkflowType()
        - .toRespondActivityTaskCompleted()
        - .toStartWorkflowExecution()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "ifWorkflowTypeVersion", [value, operator]))

    @jsii.member(jsii_name="onDomain")
    def on_domain(
        self,
        domain_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Swf":
        '''(experimental) Adds a resource of type domain to the statement.

        https://docs.aws.amazon.com/swf/latest/developerguide/swf-dev-domains.html

        :param domain_name: - Identifier for the domainName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "onDomain", [domain_name, account, partition]))

    @jsii.member(jsii_name="toCancelTimer")
    def to_cancel_timer(self) -> "Swf":
        '''(experimental) Description for CancelTimer.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_CancelTimer.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toCancelTimer", []))

    @jsii.member(jsii_name="toCancelWorkflowExecution")
    def to_cancel_workflow_execution(self) -> "Swf":
        '''(experimental) Description for CancelWorkflowExecution.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_CancelWorkflowExecution.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toCancelWorkflowExecution", []))

    @jsii.member(jsii_name="toCompleteWorkflowExecution")
    def to_complete_workflow_execution(self) -> "Swf":
        '''(experimental) Description for CompleteWorkflowExecution.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_CompleteWorkflowExecution.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toCompleteWorkflowExecution", []))

    @jsii.member(jsii_name="toContinueAsNewWorkflowExecution")
    def to_continue_as_new_workflow_execution(self) -> "Swf":
        '''(experimental) Description for ContinueAsNewWorkflowExecution.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_ContinueAsNewWorkflowExecution.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toContinueAsNewWorkflowExecution", []))

    @jsii.member(jsii_name="toCountClosedWorkflowExecutions")
    def to_count_closed_workflow_executions(self) -> "Swf":
        '''(experimental) Returns the number of closed workflow executions within the given domain that meet the specified filtering criteria.

        Access Level: Read

        Possible conditions:

        - .ifTagFilterTag()
        - .ifTypeFilterName()
        - .ifTypeFilterVersion()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_CountClosedWorkflowExecutions.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toCountClosedWorkflowExecutions", []))

    @jsii.member(jsii_name="toCountOpenWorkflowExecutions")
    def to_count_open_workflow_executions(self) -> "Swf":
        '''(experimental) Returns the number of open workflow executions within the given domain that meet the specified filtering criteria.

        Access Level: Read

        Possible conditions:

        - .ifTagFilterTag()
        - .ifTypeFilterName()
        - .ifTypeFilterVersion()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_CountOpenWorkflowExecutions.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toCountOpenWorkflowExecutions", []))

    @jsii.member(jsii_name="toCountPendingActivityTasks")
    def to_count_pending_activity_tasks(self) -> "Swf":
        '''(experimental) Returns the estimated number of activity tasks in the specified task list.

        Access Level: Read

        Possible conditions:

        - .ifTaskListName()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_CountPendingActivityTasks.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toCountPendingActivityTasks", []))

    @jsii.member(jsii_name="toCountPendingDecisionTasks")
    def to_count_pending_decision_tasks(self) -> "Swf":
        '''(experimental) Returns the estimated number of decision tasks in the specified task list.

        Access Level: Read

        Possible conditions:

        - .ifTaskListName()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_CountPendingDecisionTasks.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toCountPendingDecisionTasks", []))

    @jsii.member(jsii_name="toDeprecateActivityType")
    def to_deprecate_activity_type(self) -> "Swf":
        '''(experimental) Deprecates the specified activity type.

        Access Level: Write

        Possible conditions:

        - .ifActivityTypeName()
        - .ifActivityTypeVersion()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_DeprecateActivityType.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toDeprecateActivityType", []))

    @jsii.member(jsii_name="toDeprecateDomain")
    def to_deprecate_domain(self) -> "Swf":
        '''(experimental) Deprecates the specified domain.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_DeprecateDomain.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toDeprecateDomain", []))

    @jsii.member(jsii_name="toDeprecateWorkflowType")
    def to_deprecate_workflow_type(self) -> "Swf":
        '''(experimental) Deprecates the specified workflow type.

        Access Level: Write

        Possible conditions:

        - .ifWorkflowTypeName()
        - .ifWorkflowTypeVersion()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_DeprecateWorkflowType.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toDeprecateWorkflowType", []))

    @jsii.member(jsii_name="toDescribeActivityType")
    def to_describe_activity_type(self) -> "Swf":
        '''(experimental) Returns information about the specified activity type.

        Access Level: Read

        Possible conditions:

        - .ifActivityTypeName()
        - .ifActivityTypeVersion()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_DescribeActivityType.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toDescribeActivityType", []))

    @jsii.member(jsii_name="toDescribeDomain")
    def to_describe_domain(self) -> "Swf":
        '''(experimental) Returns information about the specified domain, including description and status.

        Access Level: Read

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_DescribeDomain.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toDescribeDomain", []))

    @jsii.member(jsii_name="toDescribeWorkflowExecution")
    def to_describe_workflow_execution(self) -> "Swf":
        '''(experimental) Returns information about the specified workflow execution including its type and some statistics.

        Access Level: Read

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_DescribeWorkflowExecution.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toDescribeWorkflowExecution", []))

    @jsii.member(jsii_name="toDescribeWorkflowType")
    def to_describe_workflow_type(self) -> "Swf":
        '''(experimental) Returns information about the specified workflow type.

        Access Level: Read

        Possible conditions:

        - .ifWorkflowTypeName()
        - .ifWorkflowTypeVersion()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_DescribeWorkflowType.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toDescribeWorkflowType", []))

    @jsii.member(jsii_name="toFailWorkflowExecution")
    def to_fail_workflow_execution(self) -> "Swf":
        '''(experimental) Description for FailWorkflowExecution.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_FailWorkflowExecution.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toFailWorkflowExecution", []))

    @jsii.member(jsii_name="toGetWorkflowExecutionHistory")
    def to_get_workflow_execution_history(self) -> "Swf":
        '''(experimental) Returns the history of the specified workflow execution.

        Access Level: Read

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_GetWorkflowExecutionHistory.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toGetWorkflowExecutionHistory", []))

    @jsii.member(jsii_name="toListActivityTypes")
    def to_list_activity_types(self) -> "Swf":
        '''(experimental) Returns information about all activities registered in the specified domain that match the specified name and registration status.

        Access Level: List

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_ListActivityTypes.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toListActivityTypes", []))

    @jsii.member(jsii_name="toListClosedWorkflowExecutions")
    def to_list_closed_workflow_executions(self) -> "Swf":
        '''(experimental) Returns a list of closed workflow executions in the specified domain that meet the filtering criteria.

        Access Level: List

        Possible conditions:

        - .ifTagFilterTag()
        - .ifTypeFilterName()
        - .ifTypeFilterVersion()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_ListClosedWorkflowExecutions.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toListClosedWorkflowExecutions", []))

    @jsii.member(jsii_name="toListDomains")
    def to_list_domains(self) -> "Swf":
        '''(experimental) Returns the list of domains registered in the account.

        Access Level: List

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_ListDomains.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toListDomains", []))

    @jsii.member(jsii_name="toListOpenWorkflowExecutions")
    def to_list_open_workflow_executions(self) -> "Swf":
        '''(experimental) Returns a list of open workflow executions in the specified domain that meet the filtering criteria.

        Access Level: List

        Possible conditions:

        - .ifTagFilterTag()
        - .ifTypeFilterName()
        - .ifTypeFilterVersion()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_ListOpenWorkflowExecutions.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toListOpenWorkflowExecutions", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Swf":
        '''(experimental) This action lists tags for an AWS SWF resource.

        Access Level: List

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListWorkflowTypes")
    def to_list_workflow_types(self) -> "Swf":
        '''(experimental) Returns information about workflow types in the specified domain.

        Access Level: List

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_ListWorkflowTypes.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toListWorkflowTypes", []))

    @jsii.member(jsii_name="toPollForActivityTask")
    def to_poll_for_activity_task(self) -> "Swf":
        '''(experimental) Used by workers to get an ActivityTask from the specified activity taskList.

        Access Level: Write

        Possible conditions:

        - .ifTaskListName()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_PollForActivityTask.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toPollForActivityTask", []))

    @jsii.member(jsii_name="toPollForDecisionTask")
    def to_poll_for_decision_task(self) -> "Swf":
        '''(experimental) Used by deciders to get a DecisionTask from the specified decision taskList.

        Access Level: Write

        Possible conditions:

        - .ifTaskListName()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_PollForDecisionTask.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toPollForDecisionTask", []))

    @jsii.member(jsii_name="toRecordActivityTaskHeartbeat")
    def to_record_activity_task_heartbeat(self) -> "Swf":
        '''(experimental) Used by activity workers to report to the service that the ActivityTask represented by the specified taskToken is still making progress.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_RecordActivityTaskHeartbeat.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toRecordActivityTaskHeartbeat", []))

    @jsii.member(jsii_name="toRecordMarker")
    def to_record_marker(self) -> "Swf":
        '''(experimental) Description for RecordMarker.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_RecordMarker.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toRecordMarker", []))

    @jsii.member(jsii_name="toRegisterActivityType")
    def to_register_activity_type(self) -> "Swf":
        '''(experimental) Registers a new activity type along with its configuration settings in the specified domain.

        Access Level: Write

        Possible conditions:

        - .ifDefaultTaskListName()
        - .ifName()
        - .ifVersion()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_RegisterActivityType.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toRegisterActivityType", []))

    @jsii.member(jsii_name="toRegisterDomain")
    def to_register_domain(self) -> "Swf":
        '''(experimental) Registers a new domain.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_RegisterDomain.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toRegisterDomain", []))

    @jsii.member(jsii_name="toRegisterWorkflowType")
    def to_register_workflow_type(self) -> "Swf":
        '''(experimental) Registers a new workflow type and its configuration settings in the specified domain.

        Access Level: Write

        Possible conditions:

        - .ifDefaultTaskListName()
        - .ifName()
        - .ifVersion()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_RegisterWorkflowType.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toRegisterWorkflowType", []))

    @jsii.member(jsii_name="toRequestCancelActivityTask")
    def to_request_cancel_activity_task(self) -> "Swf":
        '''(experimental) Description for RequestCancelActivityTask.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_RequestCancelActivityTask.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toRequestCancelActivityTask", []))

    @jsii.member(jsii_name="toRequestCancelExternalWorkflowExecution")
    def to_request_cancel_external_workflow_execution(self) -> "Swf":
        '''(experimental) Description for RequestCancelExternalWorkflowExecution.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_RequestCancelExternalWorkflowExecution.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toRequestCancelExternalWorkflowExecution", []))

    @jsii.member(jsii_name="toRequestCancelWorkflowExecution")
    def to_request_cancel_workflow_execution(self) -> "Swf":
        '''(experimental) Records a WorkflowExecutionCancelRequested event in the currently running workflow execution identified by the given domain, workflowId, and runId.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_RequestCancelWorkflowExecution.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toRequestCancelWorkflowExecution", []))

    @jsii.member(jsii_name="toRespondActivityTaskCanceled")
    def to_respond_activity_task_canceled(self) -> "Swf":
        '''(experimental) Used by workers to tell the service that the ActivityTask identified by the taskToken was successfully canceled.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_RespondActivityTaskCanceled.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toRespondActivityTaskCanceled", []))

    @jsii.member(jsii_name="toRespondActivityTaskCompleted")
    def to_respond_activity_task_completed(self) -> "Swf":
        '''(experimental) Used by workers to tell the service that the ActivityTask identified by the taskToken completed successfully with a result (if provided).

        Access Level: Write

        Possible conditions:

        - .ifActivityTypeName()
        - .ifActivityTypeVersion()
        - .ifTagListMember0()
        - .ifTagListMember1()
        - .ifTagListMember2()
        - .ifTagListMember3()
        - .ifTagListMember4()
        - .ifTaskListName()
        - .ifWorkflowTypeName()
        - .ifWorkflowTypeVersion()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_RespondActivityTaskCompleted.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toRespondActivityTaskCompleted", []))

    @jsii.member(jsii_name="toRespondActivityTaskFailed")
    def to_respond_activity_task_failed(self) -> "Swf":
        '''(experimental) Used by workers to tell the service that the ActivityTask identified by the taskToken has failed with reason (if specified).

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_RespondActivityTaskFailed.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toRespondActivityTaskFailed", []))

    @jsii.member(jsii_name="toRespondDecisionTaskCompleted")
    def to_respond_decision_task_completed(self) -> "Swf":
        '''(experimental) Used by deciders to tell the service that the DecisionTask identified by the taskToken has successfully completed.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_RespondDecisionTaskCompleted.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toRespondDecisionTaskCompleted", []))

    @jsii.member(jsii_name="toScheduleActivityTask")
    def to_schedule_activity_task(self) -> "Swf":
        '''(experimental) Description for ScheduleActivityTask.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_ScheduleActivityTask.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toScheduleActivityTask", []))

    @jsii.member(jsii_name="toSignalExternalWorkflowExecution")
    def to_signal_external_workflow_execution(self) -> "Swf":
        '''(experimental) Description for SignalExternalWorkflowExecution.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_SignalExternalWorkflowExecution.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toSignalExternalWorkflowExecution", []))

    @jsii.member(jsii_name="toSignalWorkflowExecution")
    def to_signal_workflow_execution(self) -> "Swf":
        '''(experimental) Records a WorkflowExecutionSignaled event in the workflow execution history and creates a decision task for the workflow execution identified by the given domain, workflowId and runId.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_SignalWorkflowExecution.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toSignalWorkflowExecution", []))

    @jsii.member(jsii_name="toStartChildWorkflowExecution")
    def to_start_child_workflow_execution(self) -> "Swf":
        '''(experimental) Description for StartChildWorkflowExecution.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_StartChildWorkflowExecution.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toStartChildWorkflowExecution", []))

    @jsii.member(jsii_name="toStartTimer")
    def to_start_timer(self) -> "Swf":
        '''(experimental) Description for StartTimer.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_StartTimer.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toStartTimer", []))

    @jsii.member(jsii_name="toStartWorkflowExecution")
    def to_start_workflow_execution(self) -> "Swf":
        '''(experimental) Starts an execution of the workflow type in the specified domain using the provided workflowId and input data.

        Access Level: Write

        Possible conditions:

        - .ifTagListMember0()
        - .ifTagListMember1()
        - .ifTagListMember2()
        - .ifTagListMember3()
        - .ifTagListMember4()
        - .ifTaskListName()
        - .ifWorkflowTypeName()
        - .ifWorkflowTypeVersion()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_StartWorkflowExecution.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toStartWorkflowExecution", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Swf":
        '''(experimental) This action tags an AWS SWF resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTerminateWorkflowExecution")
    def to_terminate_workflow_execution(self) -> "Swf":
        '''(experimental) Records a WorkflowExecutionTerminated event and forces closure of the workflow execution identified by the given domain, runId, and workflowId.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_TerminateWorkflowExecution.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toTerminateWorkflowExecution", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Swf":
        '''(experimental) This action removes a tag from an AWS SWF resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toUntagResource", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Synthetics(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Synthetics",
):
    '''(experimental) Statement provider for service `synthetics <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudwatchsynthetics.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `synthetics <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudwatchsynthetics.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Synthetics, self, [sid])

    @jsii.member(jsii_name="onCanary")
    def on_canary(
        self,
        canary_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Synthetics":
        '''(experimental) Adds a resource of type canary to the statement.

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Canaries.html

        :param canary_name: - Identifier for the canaryName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Synthetics", jsii.invoke(self, "onCanary", [canary_name, account, region, partition]))

    @jsii.member(jsii_name="toCreateCanary")
    def to_create_canary(self) -> "Synthetics":
        '''(experimental) Grants permission to create a canary.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonSynthetics/latest/APIReference/API_CreateCanary.html

        :stability: experimental
        '''
        return typing.cast("Synthetics", jsii.invoke(self, "toCreateCanary", []))

    @jsii.member(jsii_name="toDeleteCanary")
    def to_delete_canary(self) -> "Synthetics":
        '''(experimental) Deletes a canary.

        Amazon Synthetics deletes all the resources except for the Lambda function and the CloudWatch Alarms if you created one

        Access Level: Write

        https://docs.aws.amazon.com/AmazonSynthetics/latest/APIReference/API_DeleteCanary.html

        :stability: experimental
        '''
        return typing.cast("Synthetics", jsii.invoke(self, "toDeleteCanary", []))

    @jsii.member(jsii_name="toDescribeCanaries")
    def to_describe_canaries(self) -> "Synthetics":
        '''(experimental) Grants permission to list information of all canaries.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonSynthetics/latest/APIReference/API_DescribeCanaries.html

        :stability: experimental
        '''
        return typing.cast("Synthetics", jsii.invoke(self, "toDescribeCanaries", []))

    @jsii.member(jsii_name="toDescribeCanariesLastRun")
    def to_describe_canaries_last_run(self) -> "Synthetics":
        '''(experimental) Grants permission to list information about the last test run associated with all canaries.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonSynthetics/latest/APIReference/API_DescribeCanariesLastRun.html

        :stability: experimental
        '''
        return typing.cast("Synthetics", jsii.invoke(self, "toDescribeCanariesLastRun", []))

    @jsii.member(jsii_name="toGetCanaryRuns")
    def to_get_canary_runs(self) -> "Synthetics":
        '''(experimental) Grants permission to list information about all the test runs associated with a canary.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonSynthetics/latest/APIReference/API_GetCanaryRuns.html

        :stability: experimental
        '''
        return typing.cast("Synthetics", jsii.invoke(self, "toGetCanaryRuns", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Synthetics":
        '''(experimental) Grants permission to list all tags and values associated with a canary.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonSynthetics/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Synthetics", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toStartCanary")
    def to_start_canary(self) -> "Synthetics":
        '''(experimental) Grants permission to start a canary, so that Amazon CloudWatch Synthetics starts monitoring a website.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonSynthetics/latest/APIReference/API_StartCanary.html

        :stability: experimental
        '''
        return typing.cast("Synthetics", jsii.invoke(self, "toStartCanary", []))

    @jsii.member(jsii_name="toStopCanary")
    def to_stop_canary(self) -> "Synthetics":
        '''(experimental) Grants permission to stop a canary.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonSynthetics/latest/APIReference/API_StopCanary.html

        :stability: experimental
        '''
        return typing.cast("Synthetics", jsii.invoke(self, "toStopCanary", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Synthetics":
        '''(experimental) Grants permission to add one or more tags to a canary.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonSynthetics/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Synthetics", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Synthetics":
        '''(experimental) Grants permission to remove one or more tags from a canary.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonSynthetics/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Synthetics", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateCanary")
    def to_update_canary(self) -> "Synthetics":
        '''(experimental) Grants permission to update a canary.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonSynthetics/latest/APIReference/API_UpdateCanary.html

        :stability: experimental
        '''
        return typing.cast("Synthetics", jsii.invoke(self, "toUpdateCanary", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Tag(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Tag"):
    '''(experimental) Statement provider for service `tag <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonresourcegrouptaggingapi.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `tag <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonresourcegrouptaggingapi.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Tag, self, [sid])

    @jsii.member(jsii_name="toDescribeReportCreation")
    def to_describe_report_creation(self) -> "Tag":
        '''(experimental) Describe the status of the StartReportCreation operation.

        Access Level: Read

        https://docs.aws.amazon.com/resourcegroupstagging/latest/APIReference/API_DescribeReportCreation.html

        :stability: experimental
        '''
        return typing.cast("Tag", jsii.invoke(self, "toDescribeReportCreation", []))

    @jsii.member(jsii_name="toGetComplianceSummary")
    def to_get_compliance_summary(self) -> "Tag":
        '''(experimental) Get a table that shows counts of resources that are noncompliant with their effective tag policies.

        Access Level: Read

        https://docs.aws.amazon.com/resourcegroupstagging/latest/APIReference/API_GetComplianceSummary.html

        :stability: experimental
        '''
        return typing.cast("Tag", jsii.invoke(self, "toGetComplianceSummary", []))

    @jsii.member(jsii_name="toGetResources")
    def to_get_resources(self) -> "Tag":
        '''(experimental) Get tagged AWS resources that match the given tag filters.

        Access Level: Read

        https://docs.aws.amazon.com/resourcegroupstagging/latest/APIReference/API_GetResources.html

        :stability: experimental
        '''
        return typing.cast("Tag", jsii.invoke(self, "toGetResources", []))

    @jsii.member(jsii_name="toGetTagKeys")
    def to_get_tag_keys(self) -> "Tag":
        '''(experimental) Get all tagKeys for the account in the specific region.

        Access Level: Read

        https://docs.aws.amazon.com/resourcegroupstagging/latest/APIReference/API_GetTagKeys.html

        :stability: experimental
        '''
        return typing.cast("Tag", jsii.invoke(self, "toGetTagKeys", []))

    @jsii.member(jsii_name="toGetTagValues")
    def to_get_tag_values(self) -> "Tag":
        '''(experimental) Get all tagValues for the account in the specific region.

        Access Level: Read

        https://docs.aws.amazon.com/resourcegroupstagging/latest/APIReference/API_GetTagValues.html

        :stability: experimental
        '''
        return typing.cast("Tag", jsii.invoke(self, "toGetTagValues", []))

    @jsii.member(jsii_name="toStartReportCreation")
    def to_start_report_creation(self) -> "Tag":
        '''(experimental) Generate a report that lists all tagged resources in accounts across your organization, and whether each resource is compliant with the effective tag policy.

        Access Level: Write

        https://docs.aws.amazon.com/resourcegroupstagging/latest/APIReference/API_StartReportCreation.html

        :stability: experimental
        '''
        return typing.cast("Tag", jsii.invoke(self, "toStartReportCreation", []))

    @jsii.member(jsii_name="toTagResources")
    def to_tag_resources(self) -> "Tag":
        '''(experimental) Add tags to AWS resources.

        Access Level: Tagging

        https://docs.aws.amazon.com/resourcegroupstagging/latest/APIReference/API_TagResources.html

        :stability: experimental
        '''
        return typing.cast("Tag", jsii.invoke(self, "toTagResources", []))

    @jsii.member(jsii_name="toUntagResources")
    def to_untag_resources(self) -> "Tag":
        '''(experimental) Remove tags from AWS resources.

        Access Level: Tagging

        https://docs.aws.amazon.com/resourcegroupstagging/latest/APIReference/API_UntagResources.html

        :stability: experimental
        '''
        return typing.cast("Tag", jsii.invoke(self, "toUntagResources", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Textract(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Textract",
):
    '''(experimental) Statement provider for service `textract <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazontextract.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `textract <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazontextract.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Textract, self, [sid])

    @jsii.member(jsii_name="toAnalyzeDocument")
    def to_analyze_document(self) -> "Textract":
        '''(experimental) Detects instances of real-world document entities within an image provided as input.

        Access Level: Read

        Dependent actions:

        - s3:GetObject

        https://docs.aws.amazon.com/textract/latest/dg/API_AnalyzeDocument.html

        :stability: experimental
        '''
        return typing.cast("Textract", jsii.invoke(self, "toAnalyzeDocument", []))

    @jsii.member(jsii_name="toDetectDocumentText")
    def to_detect_document_text(self) -> "Textract":
        '''(experimental) Detects text in document images.

        Access Level: Read

        Dependent actions:

        - s3:GetObject

        https://docs.aws.amazon.com/textract/latest/dg/API_DetectDocumentText.html

        :stability: experimental
        '''
        return typing.cast("Textract", jsii.invoke(self, "toDetectDocumentText", []))

    @jsii.member(jsii_name="toGetDocumentAnalysis")
    def to_get_document_analysis(self) -> "Textract":
        '''(experimental) Returns information about a document analysis job.

        Access Level: Read

        https://docs.aws.amazon.com/textract/latest/dg/API_GetDocumentAnalysis.html

        :stability: experimental
        '''
        return typing.cast("Textract", jsii.invoke(self, "toGetDocumentAnalysis", []))

    @jsii.member(jsii_name="toGetDocumentTextDetection")
    def to_get_document_text_detection(self) -> "Textract":
        '''(experimental) Returns information about a document text detection job.

        Access Level: Read

        https://docs.aws.amazon.com/textract/latest/dg/API_GetDocumentTextDetection.html

        :stability: experimental
        '''
        return typing.cast("Textract", jsii.invoke(self, "toGetDocumentTextDetection", []))

    @jsii.member(jsii_name="toStartDocumentAnalysis")
    def to_start_document_analysis(self) -> "Textract":
        '''(experimental) Starts an asynchronous job to detect instances of real-world document entities within an image or pdf provided as input.

        Access Level: Write

        Dependent actions:

        - s3:GetObject

        https://docs.aws.amazon.com/textract/latest/dg/API_StartDocumentAnalysis.html

        :stability: experimental
        '''
        return typing.cast("Textract", jsii.invoke(self, "toStartDocumentAnalysis", []))

    @jsii.member(jsii_name="toStartDocumentTextDetection")
    def to_start_document_text_detection(self) -> "Textract":
        '''(experimental) Starts an asynchronous job to detect text in document images or pdfs.

        Access Level: Write

        Dependent actions:

        - s3:GetObject

        https://docs.aws.amazon.com/textract/latest/dg/API_StartDocumentTextDetection.html

        :stability: experimental
        '''
        return typing.cast("Textract", jsii.invoke(self, "toStartDocumentTextDetection", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Timestream(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Timestream",
):
    '''(experimental) Statement provider for service `timestream <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazontimestream.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `timestream <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazontimestream.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Timestream, self, [sid])

    @jsii.member(jsii_name="onDatabase")
    def on_database(
        self,
        database_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Timestream":
        '''(experimental) Adds a resource of type database to the statement.

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_Database.html

        :param database_name: - Identifier for the databaseName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "onDatabase", [database_name, account, region, partition]))

    @jsii.member(jsii_name="onTable")
    def on_table(
        self,
        database_name: builtins.str,
        table_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Timestream":
        '''(experimental) Adds a resource of type table to the statement.

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_Table.html

        :param database_name: - Identifier for the databaseName.
        :param table_name: - Identifier for the tableName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "onTable", [database_name, table_name, account, region, partition]))

    @jsii.member(jsii_name="toCancelQuery")
    def to_cancel_query(self) -> "Timestream":
        '''(experimental) Grants Permission to cancel queries in your account.

        Access Level: Write

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_query_CancelQuery.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toCancelQuery", []))

    @jsii.member(jsii_name="toCreateDatabase")
    def to_create_database(self) -> "Timestream":
        '''(experimental) Grants permissions to create a database in your account.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_CreateDatabase.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toCreateDatabase", []))

    @jsii.member(jsii_name="toCreateTable")
    def to_create_table(self) -> "Timestream":
        '''(experimental) Grants permissions to create a table in your account.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_CreateTable.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toCreateTable", []))

    @jsii.member(jsii_name="toDeleteDatabase")
    def to_delete_database(self) -> "Timestream":
        '''(experimental) Grants permissions to delete a database in your account.

        Access Level: Write

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_DeleteDatabase.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toDeleteDatabase", []))

    @jsii.member(jsii_name="toDeleteTable")
    def to_delete_table(self) -> "Timestream":
        '''(experimental) Grants permissions to delete a table in your account.

        Access Level: Write

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_DeleteTable.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toDeleteTable", []))

    @jsii.member(jsii_name="toDescribeDatabase")
    def to_describe_database(self) -> "Timestream":
        '''(experimental) Grants permissions to describe a database in your account.

        Access Level: Read

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_DescribeDatabase.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toDescribeDatabase", []))

    @jsii.member(jsii_name="toDescribeEndpoints")
    def to_describe_endpoints(self) -> "Timestream":
        '''(experimental) Grants permissions to describe timestream endpoints.

        Access Level: List

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_DescribeEndpoints.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toDescribeEndpoints", []))

    @jsii.member(jsii_name="toDescribeTable")
    def to_describe_table(self) -> "Timestream":
        '''(experimental) Grants Permissions to describe a table in your account.

        Access Level: Read

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_DescribeTable.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toDescribeTable", []))

    @jsii.member(jsii_name="toListDatabases")
    def to_list_databases(self) -> "Timestream":
        '''(experimental) Grants Permission to list databases in your account.

        Access Level: List

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_ListDatabases.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toListDatabases", []))

    @jsii.member(jsii_name="toListMeasures")
    def to_list_measures(self) -> "Timestream":
        '''(experimental) Grants Permissions to list measures of a table in your account.

        Access Level: List

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_query_Query.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toListMeasures", []))

    @jsii.member(jsii_name="toListTables")
    def to_list_tables(self) -> "Timestream":
        '''(experimental) Grants Permission to list tables in your account.

        Access Level: List

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_ListTables.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toListTables", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Timestream":
        '''(experimental) Grants permissions to list tags of a resource in your account.

        Access Level: List

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toSelect")
    def to_select(self) -> "Timestream":
        '''(experimental) Grants Permission to issue 'select from table' queries.

        Access Level: Read

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_query_Query.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toSelect", []))

    @jsii.member(jsii_name="toSelectValues")
    def to_select_values(self) -> "Timestream":
        '''(experimental) Grants Permissions to issue 'select 1' queries.

        Access Level: Read

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_query_Query.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toSelectValues", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Timestream":
        '''(experimental) Grants permissions to add tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Timestream":
        '''(experimental) Grants permissions to remove a tag from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateDatabase")
    def to_update_database(self) -> "Timestream":
        '''(experimental) Grants permissions to update a database in your account.

        Access Level: Write

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_UpdateDatabase.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toUpdateDatabase", []))

    @jsii.member(jsii_name="toUpdateTable")
    def to_update_table(self) -> "Timestream":
        '''(experimental) Grants permissions to update a table in your account.

        Access Level: Write

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_UpdateTable.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toUpdateTable", []))

    @jsii.member(jsii_name="toWriteRecords")
    def to_write_records(self) -> "Timestream":
        '''(experimental) Grants permissions to ingest data to a table in your account.

        Access Level: Write

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_WriteRecords.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toWriteRecords", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Tiros(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Tiros"):
    '''(experimental) Statement provider for service `tiros <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awstiros.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `tiros <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awstiros.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Tiros, self, [sid])

    @jsii.member(jsii_name="toCreateQuery")
    def to_create_query(self) -> "Tiros":
        '''(experimental) Grants permission to create a VPC reachability query.

        Access Level: Write

        https://docs.aws.amazon.com/vpc/latest/reachability/security_iam_required-API-permissions.html

        :stability: experimental
        '''
        return typing.cast("Tiros", jsii.invoke(self, "toCreateQuery", []))

    @jsii.member(jsii_name="toGetQueryAnswer")
    def to_get_query_answer(self) -> "Tiros":
        '''(experimental) Grants permission to get VPC reachability query answers.

        Access Level: Read

        https://docs.aws.amazon.com/vpc/latest/reachability/security_iam_required-API-permissions.html

        :stability: experimental
        '''
        return typing.cast("Tiros", jsii.invoke(self, "toGetQueryAnswer", []))

    @jsii.member(jsii_name="toGetQueryExplanation")
    def to_get_query_explanation(self) -> "Tiros":
        '''(experimental) Grants permission to get VPC reachability query explanations.

        Access Level: Read

        https://docs.aws.amazon.com/vpc/latest/reachability/security_iam_required-API-permissions.html

        :stability: experimental
        '''
        return typing.cast("Tiros", jsii.invoke(self, "toGetQueryExplanation", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Transcribe(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Transcribe",
):
    '''(experimental) Statement provider for service `transcribe <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazontranscribe.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `transcribe <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazontranscribe.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Transcribe, self, [sid])

    @jsii.member(jsii_name="ifOutputBucketName")
    def if_output_bucket_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Transcribe":
        '''(experimental) Enables you to control access based on the output bucket name included in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazontranscribe.html#amazontranscribe-policy-keys

        Applies to actions:

        - .toStartTranscriptionJob()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "ifOutputBucketName", [value, operator]))

    @jsii.member(jsii_name="ifOutputEncryptionKMSKeyId")
    def if_output_encryption_kms_key_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Transcribe":
        '''(experimental) Enables you to control access based on the KMS key id included in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazontranscribe.html#amazontranscribe-policy-keys

        Applies to actions:

        - .toStartTranscriptionJob()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "ifOutputEncryptionKMSKeyId", [value, operator]))

    @jsii.member(jsii_name="ifOutputKey")
    def if_output_key(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Transcribe":
        '''(experimental) Enables you to control access based on the output key included in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazontranscribe.html#amazontranscribe-policy-keys

        Applies to actions:

        - .toStartTranscriptionJob()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "ifOutputKey", [value, operator]))

    @jsii.member(jsii_name="toCreateLanguageModel")
    def to_create_language_model(self) -> "Transcribe":
        '''(experimental) Grants permission to create a new custom language model.

        Access Level: Write

        Dependent actions:

        - s3:GetObject
        - s3:ListBucket

        https://docs.aws.amazon.com/transcribe/latest/dg/API_CreateLanguageModel.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toCreateLanguageModel", []))

    @jsii.member(jsii_name="toCreateMedicalVocabulary")
    def to_create_medical_vocabulary(self) -> "Transcribe":
        '''(experimental) Grants permission to create a new custom vocabulary that you can use to change the way Amazon Transcribe Medical handles transcription of an audio file.

        Access Level: Write

        Dependent actions:

        - s3:GetObject

        https://docs.aws.amazon.com/transcribe/latest/dg/API_CreateMedicalVocabulary.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toCreateMedicalVocabulary", []))

    @jsii.member(jsii_name="toCreateVocabulary")
    def to_create_vocabulary(self) -> "Transcribe":
        '''(experimental) Grants permission to create a new custom vocabulary that you can use to change the way Amazon Transcribe handles transcription of an audio file.

        Access Level: Write

        Dependent actions:

        - s3:GetObject

        https://docs.aws.amazon.com/transcribe/latest/dg/API_CreateVocabulary.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toCreateVocabulary", []))

    @jsii.member(jsii_name="toCreateVocabularyFilter")
    def to_create_vocabulary_filter(self) -> "Transcribe":
        '''(experimental) Grants permission to create a new vocabulary filter that you can use to filter out words from the transcription of an audio file generated by Amazon Transcribe.

        Access Level: Write

        Dependent actions:

        - s3:GetObject

        https://docs.aws.amazon.com/transcribe/latest/dg/API_CreateVocabularyFilter.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toCreateVocabularyFilter", []))

    @jsii.member(jsii_name="toDeleteLanguageModel")
    def to_delete_language_model(self) -> "Transcribe":
        '''(experimental) Grants permission to delete a previously created custom language model.

        Access Level: Write

        https://docs.aws.amazon.com/transcribe/latest/dg/API_DeleteLanguageModel.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toDeleteLanguageModel", []))

    @jsii.member(jsii_name="toDeleteMedicalTranscriptionJob")
    def to_delete_medical_transcription_job(self) -> "Transcribe":
        '''(experimental) Grants permission to delete a previously submitted medical transcription job.

        Access Level: Write

        https://docs.aws.amazon.com/transcribe/latest/dg/API_DeleteMedicalTranscriptionJob.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toDeleteMedicalTranscriptionJob", []))

    @jsii.member(jsii_name="toDeleteMedicalVocabulary")
    def to_delete_medical_vocabulary(self) -> "Transcribe":
        '''(experimental) Grants permission to delete a medical vocabulary from Amazon Transcribe.

        Access Level: Write

        https://docs.aws.amazon.com/transcribe/latest/dg/API_DeleteMedicalVocabulary.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toDeleteMedicalVocabulary", []))

    @jsii.member(jsii_name="toDeleteTranscriptionJob")
    def to_delete_transcription_job(self) -> "Transcribe":
        '''(experimental) Grants permission to delete a previously submitted transcription job along with any other generated results such as the transcription, models, and so on.

        Access Level: Write

        https://docs.aws.amazon.com/transcribe/latest/dg/API_DeleteTranscriptionJob.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toDeleteTranscriptionJob", []))

    @jsii.member(jsii_name="toDeleteVocabulary")
    def to_delete_vocabulary(self) -> "Transcribe":
        '''(experimental) Grants permission to delete a vocabulary from Amazon Transcribe.

        Access Level: Write

        https://docs.aws.amazon.com/transcribe/latest/dg/API_DeleteVocabulary.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toDeleteVocabulary", []))

    @jsii.member(jsii_name="toDeleteVocabularyFilter")
    def to_delete_vocabulary_filter(self) -> "Transcribe":
        '''(experimental) Grants permission to delete a vocabulary filter from Amazon Transcribe.

        Access Level: Write

        https://docs.aws.amazon.com/transcribe/latest/dg/API_DeleteVocabularyFilter.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toDeleteVocabularyFilter", []))

    @jsii.member(jsii_name="toDescribeLanguageModel")
    def to_describe_language_model(self) -> "Transcribe":
        '''(experimental) Grants permission to return information about a custom language model.

        Access Level: Read

        https://docs.aws.amazon.com/transcribe/latest/dg/API_DescribeLanguageModel.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toDescribeLanguageModel", []))

    @jsii.member(jsii_name="toGetMedicalTranscriptionJob")
    def to_get_medical_transcription_job(self) -> "Transcribe":
        '''(experimental) Grants permission to return information about a medical transcription job.

        Access Level: Read

        https://docs.aws.amazon.com/transcribe/latest/dg/API_GetMedicalTranscriptionJob.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toGetMedicalTranscriptionJob", []))

    @jsii.member(jsii_name="toGetMedicalVocabulary")
    def to_get_medical_vocabulary(self) -> "Transcribe":
        '''(experimental) Grants permission to get information about a medical vocabulary.

        Access Level: Read

        https://docs.aws.amazon.com/transcribe/latest/dg/API_GetMedicalVocabulary.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toGetMedicalVocabulary", []))

    @jsii.member(jsii_name="toGetTranscriptionJob")
    def to_get_transcription_job(self) -> "Transcribe":
        '''(experimental) Grants permission to return information about a transcription job.

        Access Level: Read

        https://docs.aws.amazon.com/transcribe/latest/dg/API_GetTranscriptionJob.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toGetTranscriptionJob", []))

    @jsii.member(jsii_name="toGetVocabulary")
    def to_get_vocabulary(self) -> "Transcribe":
        '''(experimental) Grants permission to to get information about a vocabulary.

        Access Level: Read

        https://docs.aws.amazon.com/transcribe/latest/dg/API_GetVocabulary.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toGetVocabulary", []))

    @jsii.member(jsii_name="toGetVocabularyFilter")
    def to_get_vocabulary_filter(self) -> "Transcribe":
        '''(experimental) Grants permission to get information about a vocabulary filter.

        Access Level: Read

        https://docs.aws.amazon.com/transcribe/latest/dg/API_GetVocabularyFilter.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toGetVocabularyFilter", []))

    @jsii.member(jsii_name="toListLanguageModels")
    def to_list_language_models(self) -> "Transcribe":
        '''(experimental) Grants permission to list custom language models.

        Access Level: List

        https://docs.aws.amazon.com/transcribe/latest/dg/API_ListLanguageModels.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toListLanguageModels", []))

    @jsii.member(jsii_name="toListMedicalTranscriptionJobs")
    def to_list_medical_transcription_jobs(self) -> "Transcribe":
        '''(experimental) Grants permission to list medical transcription jobs with the specified status.

        Access Level: List

        https://docs.aws.amazon.com/transcribe/latest/dg/API_ListMedicalTranscriptionJobs.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toListMedicalTranscriptionJobs", []))

    @jsii.member(jsii_name="toListMedicalVocabularies")
    def to_list_medical_vocabularies(self) -> "Transcribe":
        '''(experimental) Grants permission to return a list of medical vocabularies that match the specified criteria.

        If no criteria are specified, returns the entire list of vocabularies.

        Access Level: List

        https://docs.aws.amazon.com/transcribe/latest/dg/API_ListMedicalVocabularies.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toListMedicalVocabularies", []))

    @jsii.member(jsii_name="toListTranscriptionJobs")
    def to_list_transcription_jobs(self) -> "Transcribe":
        '''(experimental) Grants permission to list transcription jobs with the specified status.

        Access Level: List

        https://docs.aws.amazon.com/transcribe/latest/dg/API_ListTranscriptionJobs.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toListTranscriptionJobs", []))

    @jsii.member(jsii_name="toListVocabularies")
    def to_list_vocabularies(self) -> "Transcribe":
        '''(experimental) Grants permission to return a list of vocabularies that match the specified criteria.

        If no criteria are specified, returns the entire list of vocabularies.

        Access Level: List

        https://docs.aws.amazon.com/transcribe/latest/dg/API_ListVocabularies.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toListVocabularies", []))

    @jsii.member(jsii_name="toListVocabularyFilters")
    def to_list_vocabulary_filters(self) -> "Transcribe":
        '''(experimental) Grants permission to return a list of vocabulary filters that match the specified criteria.

        If no criteria are specified, returns the at most 5 vocabulary filters.

        Access Level: List

        https://docs.aws.amazon.com/transcribe/latest/dg/API_ListVocabularyFilters.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toListVocabularyFilters", []))

    @jsii.member(jsii_name="toStartMedicalStreamTranscription")
    def to_start_medical_stream_transcription(self) -> "Transcribe":
        '''(experimental) Grants permission to start a protocol where audio is streamed to Transcribe Medical and the transcription results are streamed to your application.

        Access Level: Write

        https://docs.aws.amazon.com/transcribe/latest/dg/API_streaming_StartMedicalStreamTranscription.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toStartMedicalStreamTranscription", []))

    @jsii.member(jsii_name="toStartMedicalStreamTranscriptionWebSocket")
    def to_start_medical_stream_transcription_web_socket(self) -> "Transcribe":
        '''(experimental) Grants permission to start a WebSocket where audio is streamed to Transcribe Medical and the transcription results are streamed to your application.

        Access Level: Write

        https://docs.aws.amazon.com/transcribe/latest/dg/API_streaming_StartMedicalStreamTranscriptionWebSocket.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toStartMedicalStreamTranscriptionWebSocket", []))

    @jsii.member(jsii_name="toStartMedicalTranscriptionJob")
    def to_start_medical_transcription_job(self) -> "Transcribe":
        '''(experimental) Grants permission to start an asynchronous job to transcribe medical speech to text.

        Access Level: Write

        Dependent actions:

        - s3:GetObject

        https://docs.aws.amazon.com/transcribe/latest/dg/API_StartMedicalTranscriptionJob.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toStartMedicalTranscriptionJob", []))

    @jsii.member(jsii_name="toStartStreamTranscription")
    def to_start_stream_transcription(self) -> "Transcribe":
        '''(experimental) Grants permission to start a bidirectional HTTP2 stream to transcribe speech to text in real time.

        Access Level: Write

        https://docs.aws.amazon.com/transcribe/latest/dg/API_streaming_StartStreamTranscription.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toStartStreamTranscription", []))

    @jsii.member(jsii_name="toStartStreamTranscriptionWebSocket")
    def to_start_stream_transcription_web_socket(self) -> "Transcribe":
        '''(experimental) Grants permission to start a websocket stream to transcribe speech to text in real time.

        Access Level: Write

        https://docs.aws.amazon.com/transcribe/latest/dg/API_streaming_StartStreamTranscriptionWebSocket.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toStartStreamTranscriptionWebSocket", []))

    @jsii.member(jsii_name="toStartTranscriptionJob")
    def to_start_transcription_job(self) -> "Transcribe":
        '''(experimental) Grants permission to start an asynchronous job to transcribe speech to text.

        Access Level: Write

        Possible conditions:

        - .ifOutputBucketName()
        - .ifOutputEncryptionKMSKeyId()
        - .ifOutputKey()

        Dependent actions:

        - s3:GetObject

        https://docs.aws.amazon.com/transcribe/latest/dg/API_StartTranscriptionJob.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toStartTranscriptionJob", []))

    @jsii.member(jsii_name="toUpdateMedicalVocabulary")
    def to_update_medical_vocabulary(self) -> "Transcribe":
        '''(experimental) Grants permission to update an existing medical vocabulary with new values.

        The UpdateMedicalVocabulary operation overwrites all of the existing information with the values that you provide in the request.

        Access Level: Write

        Dependent actions:

        - s3:GetObject

        https://docs.aws.amazon.com/transcribe/latest/dg/API_UpdateMedicalVocabulary.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toUpdateMedicalVocabulary", []))

    @jsii.member(jsii_name="toUpdateVocabulary")
    def to_update_vocabulary(self) -> "Transcribe":
        '''(experimental) Grants permission to update an existing vocabulary with new values.

        The UpdateVocabulary operation overwrites all of the existing information with the values that you provide in the request.

        Access Level: Write

        Dependent actions:

        - s3:GetObject

        https://docs.aws.amazon.com/transcribe/latest/dg/API_UpdateVocabulary.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toUpdateVocabulary", []))

    @jsii.member(jsii_name="toUpdateVocabularyFilter")
    def to_update_vocabulary_filter(self) -> "Transcribe":
        '''(experimental) Grants permission to update an existing vocabulary filter with new values.

        The UpdateVocabularyFilter operation overwrites all of the existing information with the values that you provide in the request.

        Access Level: Write

        Dependent actions:

        - s3:GetObject

        https://docs.aws.amazon.com/transcribe/latest/dg/API_UpdateVocabularyFilter.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toUpdateVocabularyFilter", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Transfer(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Transfer",
):
    '''(experimental) Statement provider for service `transfer <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awstransferforsftp.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `transfer <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awstransferforsftp.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Transfer, self, [sid])

    @jsii.member(jsii_name="onServer")
    def on_server(
        self,
        server_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Transfer":
        '''(experimental) Adds a resource of type server to the statement.

        https://docs.aws.amazon.com/transfer/latest/userguide/configuring-servers.html

        :param server_id: - Identifier for the serverId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "onServer", [server_id, account, region, partition]))

    @jsii.member(jsii_name="onUser")
    def on_user(
        self,
        server_id: builtins.str,
        username: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Transfer":
        '''(experimental) Adds a resource of type user to the statement.

        https://docs.aws.amazon.com/transfer/latest/userguide/users.html

        :param server_id: - Identifier for the serverId.
        :param username: - Identifier for the username.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "onUser", [server_id, username, account, region, partition]))

    @jsii.member(jsii_name="toCreateServer")
    def to_create_server(self) -> "Transfer":
        '''(experimental) Grants permission to create a server.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/transfer/latest/userguide/API_CreateServer.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toCreateServer", []))

    @jsii.member(jsii_name="toCreateUser")
    def to_create_user(self) -> "Transfer":
        '''(experimental) Grants permission to add a user associated with a server.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/transfer/latest/userguide/API_CreateUser.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toCreateUser", []))

    @jsii.member(jsii_name="toDeleteServer")
    def to_delete_server(self) -> "Transfer":
        '''(experimental) Grants permission to delete a server.

        Access Level: Write

        https://docs.aws.amazon.com/transfer/latest/userguide/API_DeleteServer.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toDeleteServer", []))

    @jsii.member(jsii_name="toDeleteSshPublicKey")
    def to_delete_ssh_public_key(self) -> "Transfer":
        '''(experimental) Grants permission to delete an SSH public key from a user.

        Access Level: Write

        https://docs.aws.amazon.com/transfer/latest/userguide/API_DeleteSshPublicKey.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toDeleteSshPublicKey", []))

    @jsii.member(jsii_name="toDeleteUser")
    def to_delete_user(self) -> "Transfer":
        '''(experimental) Grants permission to delete a user associated with a server.

        Access Level: Write

        https://docs.aws.amazon.com/transfer/latest/userguide/API_DeleteUser.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toDeleteUser", []))

    @jsii.member(jsii_name="toDescribeSecurityPolicy")
    def to_describe_security_policy(self) -> "Transfer":
        '''(experimental) Grants permission to describe a security policy.

        Access Level: Read

        https://docs.aws.amazon.com/transfer/latest/userguide/API_DescribeSecurityPolicy.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toDescribeSecurityPolicy", []))

    @jsii.member(jsii_name="toDescribeServer")
    def to_describe_server(self) -> "Transfer":
        '''(experimental) Grants permission to describe a server.

        Access Level: Read

        https://docs.aws.amazon.com/transfer/latest/userguide/API_DescribeServer.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toDescribeServer", []))

    @jsii.member(jsii_name="toDescribeUser")
    def to_describe_user(self) -> "Transfer":
        '''(experimental) Grants permission to describe a user associated with a server.

        Access Level: Read

        https://docs.aws.amazon.com/transfer/latest/userguide/API_DescribeUser.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toDescribeUser", []))

    @jsii.member(jsii_name="toImportSshPublicKey")
    def to_import_ssh_public_key(self) -> "Transfer":
        '''(experimental) Grants permission to add an SSH public key to a user.

        Access Level: Write

        https://docs.aws.amazon.com/transfer/latest/userguide/API_ImportSshPublicKey.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toImportSshPublicKey", []))

    @jsii.member(jsii_name="toListSecurityPolicies")
    def to_list_security_policies(self) -> "Transfer":
        '''(experimental) Grants permission to list security policies.

        Access Level: List

        https://docs.aws.amazon.com/transfer/latest/userguide/API_ListSecurityPolicies.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toListSecurityPolicies", []))

    @jsii.member(jsii_name="toListServers")
    def to_list_servers(self) -> "Transfer":
        '''(experimental) Grants permission to list servers.

        Access Level: List

        https://docs.aws.amazon.com/transfer/latest/userguide/API_ListServers.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toListServers", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Transfer":
        '''(experimental) Grants permission to list tags for a server or a user.

        Access Level: Read

        https://docs.aws.amazon.com/transfer/latest/userguide/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListUsers")
    def to_list_users(self) -> "Transfer":
        '''(experimental) Grants permission to list users associated with a server.

        Access Level: List

        https://docs.aws.amazon.com/transfer/latest/userguide/API_ListUsers.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toListUsers", []))

    @jsii.member(jsii_name="toStartServer")
    def to_start_server(self) -> "Transfer":
        '''(experimental) Grants permission to start a server.

        Access Level: Write

        https://docs.aws.amazon.com/transfer/latest/userguide/API_StartServer.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toStartServer", []))

    @jsii.member(jsii_name="toStopServer")
    def to_stop_server(self) -> "Transfer":
        '''(experimental) Grants permission to stop a server.

        Access Level: Write

        https://docs.aws.amazon.com/transfer/latest/userguide/API_StopServer.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toStopServer", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Transfer":
        '''(experimental) Grants permission to tag a server or a user.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/transfer/latest/userguide/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTestIdentityProvider")
    def to_test_identity_provider(self) -> "Transfer":
        '''(experimental) Grants permission to test a server's custom identity provider.

        Access Level: Read

        https://docs.aws.amazon.com/transfer/latest/userguide/API_TestIdentityProvider.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toTestIdentityProvider", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Transfer":
        '''(experimental) Grants permission to untag a server or a user.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/transfer/latest/userguide/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateServer")
    def to_update_server(self) -> "Transfer":
        '''(experimental) Grants permission to update the configuration of a server.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/transfer/latest/userguide/API_UpdateServer.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toUpdateServer", []))

    @jsii.member(jsii_name="toUpdateUser")
    def to_update_user(self) -> "Transfer":
        '''(experimental) Grants permission to update the configuration of a user.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/transfer/latest/userguide/API_UpdateUser.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toUpdateUser", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Translate(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Translate",
):
    '''(experimental) Statement provider for service `translate <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazontranslate.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `translate <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazontranslate.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Translate, self, [sid])

    @jsii.member(jsii_name="toCreateParallelData")
    def to_create_parallel_data(self) -> "Translate":
        '''(experimental) Grants permission to create a Parallel Data.

        Access Level: Write

        https://docs.aws.amazon.com/translate/latest/dg/API_CreateParallelData.html

        :stability: experimental
        '''
        return typing.cast("Translate", jsii.invoke(self, "toCreateParallelData", []))

    @jsii.member(jsii_name="toDeleteParallelData")
    def to_delete_parallel_data(self) -> "Translate":
        '''(experimental) Grants permission to delete a Parallel Data.

        Access Level: Write

        https://docs.aws.amazon.com/translate/latest/dg/API_DeleteParallelData.html

        :stability: experimental
        '''
        return typing.cast("Translate", jsii.invoke(self, "toDeleteParallelData", []))

    @jsii.member(jsii_name="toDeleteTerminology")
    def to_delete_terminology(self) -> "Translate":
        '''(experimental) Grants permission to delete a terminology.

        Access Level: Write

        https://docs.aws.amazon.com/translate/latest/dg/API_DeleteTerminology.html

        :stability: experimental
        '''
        return typing.cast("Translate", jsii.invoke(self, "toDeleteTerminology", []))

    @jsii.member(jsii_name="toDescribeTextTranslationJob")
    def to_describe_text_translation_job(self) -> "Translate":
        '''(experimental) Grants permission to get the properties associated with an asynchronous batch translation job.

        Access Level: Read

        https://docs.aws.amazon.com/translate/latest/dg/API_DescribeTextTranslationJob.html

        :stability: experimental
        '''
        return typing.cast("Translate", jsii.invoke(self, "toDescribeTextTranslationJob", []))

    @jsii.member(jsii_name="toGetParallelData")
    def to_get_parallel_data(self) -> "Translate":
        '''(experimental) Grants permission to get a Parallel Data.

        Access Level: Read

        https://docs.aws.amazon.com/translate/latest/dg/API_GetParallelData.html

        :stability: experimental
        '''
        return typing.cast("Translate", jsii.invoke(self, "toGetParallelData", []))

    @jsii.member(jsii_name="toGetTerminology")
    def to_get_terminology(self) -> "Translate":
        '''(experimental) Grants permission to retrieve a terminology.

        Access Level: Read

        https://docs.aws.amazon.com/translate/latest/dg/API_GetTerminology.html

        :stability: experimental
        '''
        return typing.cast("Translate", jsii.invoke(self, "toGetTerminology", []))

    @jsii.member(jsii_name="toImportTerminology")
    def to_import_terminology(self) -> "Translate":
        '''(experimental) Grants permission to create or update a terminology, depending on whether or not one already exists for the given terminology name.

        Access Level: Write

        https://docs.aws.amazon.com/translate/latest/dg/API_ImportTerminology.html

        :stability: experimental
        '''
        return typing.cast("Translate", jsii.invoke(self, "toImportTerminology", []))

    @jsii.member(jsii_name="toListParallelData")
    def to_list_parallel_data(self) -> "Translate":
        '''(experimental) Grants permission to list Parallel Data associated with your account.

        Access Level: List

        https://docs.aws.amazon.com/translate/latest/dg/API_ListParallelData.html

        :stability: experimental
        '''
        return typing.cast("Translate", jsii.invoke(self, "toListParallelData", []))

    @jsii.member(jsii_name="toListTerminologies")
    def to_list_terminologies(self) -> "Translate":
        '''(experimental) Grants permission to list terminologies associated with your account.

        Access Level: List

        https://docs.aws.amazon.com/translate/latest/dg/API_ListTerminologies.html

        :stability: experimental
        '''
        return typing.cast("Translate", jsii.invoke(self, "toListTerminologies", []))

    @jsii.member(jsii_name="toListTextTranslationJobs")
    def to_list_text_translation_jobs(self) -> "Translate":
        '''(experimental) Grants permission to list batch translation jobs that you have submitted.

        Access Level: List

        https://docs.aws.amazon.com/translate/latest/dg/API_ListTextTranslationJobs.html

        :stability: experimental
        '''
        return typing.cast("Translate", jsii.invoke(self, "toListTextTranslationJobs", []))

    @jsii.member(jsii_name="toStartTextTranslationJob")
    def to_start_text_translation_job(self) -> "Translate":
        '''(experimental) Grants permission to start an asynchronous batch translation job.

        Batch translation jobs can be used to translate large volumes of text across multiple documents at once

        Access Level: Write

        https://docs.aws.amazon.com/translate/latest/dg/API_StartTextTranslationJob.html

        :stability: experimental
        '''
        return typing.cast("Translate", jsii.invoke(self, "toStartTextTranslationJob", []))

    @jsii.member(jsii_name="toStopTextTranslationJob")
    def to_stop_text_translation_job(self) -> "Translate":
        '''(experimental) Grants permission to stop an asynchronous batch translation job that is in progress.

        Access Level: Write

        https://docs.aws.amazon.com/translate/latest/dg/API_StopTextTranslationJob.html

        :stability: experimental
        '''
        return typing.cast("Translate", jsii.invoke(self, "toStopTextTranslationJob", []))

    @jsii.member(jsii_name="toTranslateText")
    def to_translate_text(self) -> "Translate":
        '''(experimental) Grants permission to translate text from a source language to a target language.

        Access Level: Read

        https://docs.aws.amazon.com/translate/latest/dg/API_TranslateText.html

        :stability: experimental
        '''
        return typing.cast("Translate", jsii.invoke(self, "toTranslateText", []))

    @jsii.member(jsii_name="toUpdateParallelData")
    def to_update_parallel_data(self) -> "Translate":
        '''(experimental) Grants permission to update an existing Parallel Data.

        Access Level: Write

        https://docs.aws.amazon.com/translate/latest/dg/API_UpdateParallelData.html

        :stability: experimental
        '''
        return typing.cast("Translate", jsii.invoke(self, "toUpdateParallelData", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Trustedadvisor(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Trustedadvisor",
):
    '''(experimental) Statement provider for service `trustedadvisor <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awstrustedadvisor.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `trustedadvisor <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awstrustedadvisor.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Trustedadvisor, self, [sid])

    @jsii.member(jsii_name="onChecks")
    def on_checks(
        self,
        category_code: builtins.str,
        check_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Trustedadvisor":
        '''(experimental) Adds a resource of type checks to the statement.

        https://docs.aws.amazon.com/awssupport/latest/APIReference/API_TrustedAdvisorCheckDescription.html

        :param category_code: - Identifier for the categoryCode.
        :param check_id: - Identifier for the checkId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "onChecks", [category_code, check_id, account, region, partition]))

    @jsii.member(jsii_name="toDescribeAccount")
    def to_describe_account(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to view the AWS Support plan and various AWS Trusted Advisor preferences.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toDescribeAccount", []))

    @jsii.member(jsii_name="toDescribeAccountAccess")
    def to_describe_account_access(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to view if the AWS account has enabled or disabled AWS Trusted Advisor.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toDescribeAccountAccess", []))

    @jsii.member(jsii_name="toDescribeCheckItems")
    def to_describe_check_items(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to view details for the check items.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toDescribeCheckItems", []))

    @jsii.member(jsii_name="toDescribeCheckRefreshStatuses")
    def to_describe_check_refresh_statuses(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to view the refresh statuses for AWS Trusted Advisor checks.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toDescribeCheckRefreshStatuses", []))

    @jsii.member(jsii_name="toDescribeChecks")
    def to_describe_checks(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to view details for AWS Trusted Advisor checks.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toDescribeChecks", []))

    @jsii.member(jsii_name="toDescribeCheckSummaries")
    def to_describe_check_summaries(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to view AWS Trusted Advisor check summaries.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toDescribeCheckSummaries", []))

    @jsii.member(jsii_name="toDescribeNotificationPreferences")
    def to_describe_notification_preferences(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to view the notification preferences for the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toDescribeNotificationPreferences", []))

    @jsii.member(jsii_name="toDescribeOrganization")
    def to_describe_organization(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to view if the AWS account meets the requirements to enable the organizational view feature.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toDescribeOrganization", []))

    @jsii.member(jsii_name="toDescribeOrganizationAccounts")
    def to_describe_organization_accounts(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to view the linked AWS accounts that are in the organization.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toDescribeOrganizationAccounts", []))

    @jsii.member(jsii_name="toDescribeReports")
    def to_describe_reports(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to view details for organizational view reports, such as the report name, runtime, date created, status, and format.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toDescribeReports", []))

    @jsii.member(jsii_name="toDescribeServiceMetadata")
    def to_describe_service_metadata(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to view information about organizational view reports, such as the AWS Regions, check categories, check names, and resource statuses.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toDescribeServiceMetadata", []))

    @jsii.member(jsii_name="toExcludeCheckItems")
    def to_exclude_check_items(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to exclude recommendations for AWS Trusted Advisor checks.

        Access Level: Write

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toExcludeCheckItems", []))

    @jsii.member(jsii_name="toGenerateReport")
    def to_generate_report(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to create a report for AWS Trusted Advisor checks in your organization.

        Access Level: Write

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toGenerateReport", []))

    @jsii.member(jsii_name="toIncludeCheckItems")
    def to_include_check_items(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to include recommendations for AWS Trusted Advisor checks.

        Access Level: Write

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toIncludeCheckItems", []))

    @jsii.member(jsii_name="toListAccountsForParent")
    def to_list_accounts_for_parent(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to view, in the Trusted Advisor console, all of the accounts in an AWS organization that are contained by a root or organizational unit (OU).

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toListAccountsForParent", []))

    @jsii.member(jsii_name="toListOrganizationalUnitsForParent")
    def to_list_organizational_units_for_parent(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to view, in the Trusted Advisor console, all of the organizational units (OUs) in a parent organizational unit or root.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toListOrganizationalUnitsForParent", []))

    @jsii.member(jsii_name="toListRoots")
    def to_list_roots(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to view, in the Trusted Advisor console, all of the roots that are defined in an AWS organization.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toListRoots", []))

    @jsii.member(jsii_name="toRefreshCheck")
    def to_refresh_check(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to refresh an AWS Trusted Advisor check.

        Access Level: Write

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toRefreshCheck", []))

    @jsii.member(jsii_name="toSetAccountAccess")
    def to_set_account_access(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to enable or disable AWS Trusted Advisor for the account.

        Access Level: Write

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toSetAccountAccess", []))

    @jsii.member(jsii_name="toSetOrganizationAccess")
    def to_set_organization_access(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to enable the organizational view feature for AWS Trusted Advisor.

        Access Level: Write

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toSetOrganizationAccess", []))

    @jsii.member(jsii_name="toUpdateNotificationPreferences")
    def to_update_notification_preferences(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to update notification preferences for AWS Trusted Advisor.

        Access Level: Write

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toUpdateNotificationPreferences", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Waf(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Waf"):
    '''(experimental) Statement provider for service `waf <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awswaf.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `waf <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awswaf.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Waf, self, [sid])

    @jsii.member(jsii_name="onBytematchset")
    def on_bytematchset(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Waf":
        '''(experimental) Adds a resource of type bytematchset to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_ByteMatchSet.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "onBytematchset", [id, account, partition]))

    @jsii.member(jsii_name="onGeomatchset")
    def on_geomatchset(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Waf":
        '''(experimental) Adds a resource of type geomatchset to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GeoMatchSet.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "onGeomatchset", [id, account, partition]))

    @jsii.member(jsii_name="onIpset")
    def on_ipset(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Waf":
        '''(experimental) Adds a resource of type ipset to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_IPSet.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "onIpset", [id, account, partition]))

    @jsii.member(jsii_name="onRatebasedrule")
    def on_ratebasedrule(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Waf":
        '''(experimental) Adds a resource of type ratebasedrule to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_RateBasedRule.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "onRatebasedrule", [id, account, partition]))

    @jsii.member(jsii_name="onRegexmatchset")
    def on_regexmatchset(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Waf":
        '''(experimental) Adds a resource of type regexmatchset to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_RegexMatchSet.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "onRegexmatchset", [id, account, partition]))

    @jsii.member(jsii_name="onRegexpatternset")
    def on_regexpatternset(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Waf":
        '''(experimental) Adds a resource of type regexpatternset to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_RegexPatternSet.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "onRegexpatternset", [id, account, partition]))

    @jsii.member(jsii_name="onRule")
    def on_rule(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Waf":
        '''(experimental) Adds a resource of type rule to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_Rule.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "onRule", [id, account, partition]))

    @jsii.member(jsii_name="onRulegroup")
    def on_rulegroup(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Waf":
        '''(experimental) Adds a resource of type rulegroup to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_RuleGroup.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "onRulegroup", [id, account, partition]))

    @jsii.member(jsii_name="onSizeconstraintset")
    def on_sizeconstraintset(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Waf":
        '''(experimental) Adds a resource of type sizeconstraintset to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_SizeConstraintSet.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "onSizeconstraintset", [id, account, partition]))

    @jsii.member(jsii_name="onSqlinjectionmatchset")
    def on_sqlinjectionmatchset(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Waf":
        '''(experimental) Adds a resource of type sqlinjectionmatchset to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_SqlInjectionMatchSet.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "onSqlinjectionmatchset", [id, account, partition]))

    @jsii.member(jsii_name="onWebacl")
    def on_webacl(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Waf":
        '''(experimental) Adds a resource of type webacl to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_WebACL.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "onWebacl", [id, account, partition]))

    @jsii.member(jsii_name="onXssmatchset")
    def on_xssmatchset(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Waf":
        '''(experimental) Adds a resource of type xssmatchset to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_XssMatchSet.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "onXssmatchset", [id, account, partition]))

    @jsii.member(jsii_name="toCreateByteMatchSet")
    def to_create_byte_match_set(self) -> "Waf":
        '''(experimental) Creates a ByteMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_CreateByteMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toCreateByteMatchSet", []))

    @jsii.member(jsii_name="toCreateGeoMatchSet")
    def to_create_geo_match_set(self) -> "Waf":
        '''(experimental) Creates a GeoMatchSet, which you use to specify which web requests you want to allow or block based on the country that the requests originate from.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_CreateGeoMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toCreateGeoMatchSet", []))

    @jsii.member(jsii_name="toCreateIPSet")
    def to_create_ip_set(self) -> "Waf":
        '''(experimental) Creates an IPSet, which you use to specify which web requests you want to allow or block based on the IP addresses that the requests originate from.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_CreateIPSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toCreateIPSet", []))

    @jsii.member(jsii_name="toCreateRateBasedRule")
    def to_create_rate_based_rule(self) -> "Waf":
        '''(experimental) Creates a RateBasedRule, which contains a RateLimit specifying the maximum number of requests that AWS WAF allows from a specified IP address in a five-minute period.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_CreateRateBasedRule.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toCreateRateBasedRule", []))

    @jsii.member(jsii_name="toCreateRegexMatchSet")
    def to_create_regex_match_set(self) -> "Waf":
        '''(experimental) Creates a RegexMatchSet, which you use to specify which web requests you want to allow or block based on the regex patterns you specified in a RegexPatternSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_CreateRegexMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toCreateRegexMatchSet", []))

    @jsii.member(jsii_name="toCreateRegexPatternSet")
    def to_create_regex_pattern_set(self) -> "Waf":
        '''(experimental) Creates a RegexPatternSet, which you use to specify the regular expression (regex) pattern that you want AWS WAF to search for.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_CreateRegexPatternSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toCreateRegexPatternSet", []))

    @jsii.member(jsii_name="toCreateRule")
    def to_create_rule(self) -> "Waf":
        '''(experimental) Creates a Rule, which contains the IPSet objects, ByteMatchSet objects, and other predicates that identify the requests that you want to block.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_CreateRule.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toCreateRule", []))

    @jsii.member(jsii_name="toCreateRuleGroup")
    def to_create_rule_group(self) -> "Waf":
        '''(experimental) Creates a RuleGroup. A rule group is a collection of predefined rules that you add to a WebACL.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_CreateRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toCreateRuleGroup", []))

    @jsii.member(jsii_name="toCreateSizeConstraintSet")
    def to_create_size_constraint_set(self) -> "Waf":
        '''(experimental) Creates a SizeConstraintSet, which you use to identify the part of a web request that you want to check for length.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_CreateSizeConstraintSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toCreateSizeConstraintSet", []))

    @jsii.member(jsii_name="toCreateSqlInjectionMatchSet")
    def to_create_sql_injection_match_set(self) -> "Waf":
        '''(experimental) Creates a SqlInjectionMatchSet, which you use to allow, block, or count requests that contain snippets of SQL code in a specified part of web requests.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_CreateSqlInjectionMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toCreateSqlInjectionMatchSet", []))

    @jsii.member(jsii_name="toCreateWebACL")
    def to_create_web_acl(self) -> "Waf":
        '''(experimental) Creates a WebACL, which contains the Rules that identify the CloudFront web requests that you want to allow, block, or count.

        Access Level: Permissions management

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_CreateWebACL.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toCreateWebACL", []))

    @jsii.member(jsii_name="toCreateWebACLMigrationStack")
    def to_create_web_acl_migration_stack(self) -> "Waf":
        '''(experimental) Create and store a CloudFormation tempalte that creates an equivalent WAF v2 WebACL from the given WAF Classic WebACL in the given S3 bucket.

        Access Level: Write

        Dependent actions:

        - s3:PutObject

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_CreateWebACLMigrationStack.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toCreateWebACLMigrationStack", []))

    @jsii.member(jsii_name="toCreateXssMatchSet")
    def to_create_xss_match_set(self) -> "Waf":
        '''(experimental) Creates an XssMatchSet, which you use to allow, block, or count requests that contain cross-site scripting attacks in the specified part of web requests.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_CreateXssMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toCreateXssMatchSet", []))

    @jsii.member(jsii_name="toDeleteByteMatchSet")
    def to_delete_byte_match_set(self) -> "Waf":
        '''(experimental) Permanently deletes a ByteMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_DeleteByteMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toDeleteByteMatchSet", []))

    @jsii.member(jsii_name="toDeleteGeoMatchSet")
    def to_delete_geo_match_set(self) -> "Waf":
        '''(experimental) Permanently deletes an GeoMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_DeleteGeoMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toDeleteGeoMatchSet", []))

    @jsii.member(jsii_name="toDeleteIPSet")
    def to_delete_ip_set(self) -> "Waf":
        '''(experimental) Permanently deletes an IPSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_DeleteIPSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toDeleteIPSet", []))

    @jsii.member(jsii_name="toDeleteLoggingConfiguration")
    def to_delete_logging_configuration(self) -> "Waf":
        '''(experimental) Permanently deletes the LoggingConfiguration from the specified web ACL.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_DeleteLoggingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toDeleteLoggingConfiguration", []))

    @jsii.member(jsii_name="toDeletePermissionPolicy")
    def to_delete_permission_policy(self) -> "Waf":
        '''(experimental) Permanently deletes an IAM policy from the specified RuleGroup.

        Access Level: Permissions management

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_DeletePermissionPolicy.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toDeletePermissionPolicy", []))

    @jsii.member(jsii_name="toDeleteRateBasedRule")
    def to_delete_rate_based_rule(self) -> "Waf":
        '''(experimental) Permanently deletes a RateBasedRule.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_DeleteRateBasedRule.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toDeleteRateBasedRule", []))

    @jsii.member(jsii_name="toDeleteRegexMatchSet")
    def to_delete_regex_match_set(self) -> "Waf":
        '''(experimental) Permanently deletes an RegexMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_DeleteRegexMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toDeleteRegexMatchSet", []))

    @jsii.member(jsii_name="toDeleteRegexPatternSet")
    def to_delete_regex_pattern_set(self) -> "Waf":
        '''(experimental) Permanently deletes an RegexPatternSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_DeleteRegexPatternSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toDeleteRegexPatternSet", []))

    @jsii.member(jsii_name="toDeleteRule")
    def to_delete_rule(self) -> "Waf":
        '''(experimental) Permanently deletes a Rule.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_DeleteRule.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toDeleteRule", []))

    @jsii.member(jsii_name="toDeleteRuleGroup")
    def to_delete_rule_group(self) -> "Waf":
        '''(experimental) Permanently deletes a RuleGroup.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_DeleteRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toDeleteRuleGroup", []))

    @jsii.member(jsii_name="toDeleteSizeConstraintSet")
    def to_delete_size_constraint_set(self) -> "Waf":
        '''(experimental) Permanently deletes a SizeConstraintSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_DeleteSizeConstraintSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toDeleteSizeConstraintSet", []))

    @jsii.member(jsii_name="toDeleteSqlInjectionMatchSet")
    def to_delete_sql_injection_match_set(self) -> "Waf":
        '''(experimental) Permanently deletes a SqlInjectionMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_DeleteSqlInjectionMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toDeleteSqlInjectionMatchSet", []))

    @jsii.member(jsii_name="toDeleteWebACL")
    def to_delete_web_acl(self) -> "Waf":
        '''(experimental) Permanently deletes a WebACL.

        Access Level: Permissions management

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_DeleteWebACL.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toDeleteWebACL", []))

    @jsii.member(jsii_name="toDeleteXssMatchSet")
    def to_delete_xss_match_set(self) -> "Waf":
        '''(experimental) Permanently deletes an XssMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_DeleteXssMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toDeleteXssMatchSet", []))

    @jsii.member(jsii_name="toGetByteMatchSet")
    def to_get_byte_match_set(self) -> "Waf":
        '''(experimental) Returns the ByteMatchSet specified by ByteMatchSetId.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GetByteMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toGetByteMatchSet", []))

    @jsii.member(jsii_name="toGetChangeToken")
    def to_get_change_token(self) -> "Waf":
        '''(experimental) When you want to create, update, or delete AWS WAF objects, get a change token and include the change token in the create, update, or delete request.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GetChangeToken.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toGetChangeToken", []))

    @jsii.member(jsii_name="toGetChangeTokenStatus")
    def to_get_change_token_status(self) -> "Waf":
        '''(experimental) Returns the status of a ChangeToken that you got by calling GetChangeToken.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GetChangeTokenStatus.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toGetChangeTokenStatus", []))

    @jsii.member(jsii_name="toGetGeoMatchSet")
    def to_get_geo_match_set(self) -> "Waf":
        '''(experimental) Returns the GeoMatchSet specified by GeoMatchSetId.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GetGeoMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toGetGeoMatchSet", []))

    @jsii.member(jsii_name="toGetIPSet")
    def to_get_ip_set(self) -> "Waf":
        '''(experimental) Returns the IPSet that is specified by IPSetId.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GetIPSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toGetIPSet", []))

    @jsii.member(jsii_name="toGetLoggingConfiguration")
    def to_get_logging_configuration(self) -> "Waf":
        '''(experimental) Returns the LoggingConfiguration for the specified web ACL.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GetLoggingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toGetLoggingConfiguration", []))

    @jsii.member(jsii_name="toGetPermissionPolicy")
    def to_get_permission_policy(self) -> "Waf":
        '''(experimental) Returns the IAM policy attached to the RuleGroup.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GetPermissionPolicy.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toGetPermissionPolicy", []))

    @jsii.member(jsii_name="toGetRateBasedRule")
    def to_get_rate_based_rule(self) -> "Waf":
        '''(experimental) Returns the RateBasedRule that is specified by the RuleId that you included in the GetRateBasedRule request.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GetRateBasedRule.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toGetRateBasedRule", []))

    @jsii.member(jsii_name="toGetRateBasedRuleManagedKeys")
    def to_get_rate_based_rule_managed_keys(self) -> "Waf":
        '''(experimental) Returns an array of IP addresses currently being blocked by the RateBasedRule that is specified by the RuleId.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GetRateBasedRuleManagedKeys.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toGetRateBasedRuleManagedKeys", []))

    @jsii.member(jsii_name="toGetRegexMatchSet")
    def to_get_regex_match_set(self) -> "Waf":
        '''(experimental) Returns the RegexMatchSet specified by RegexMatchSetId.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GetRegexMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toGetRegexMatchSet", []))

    @jsii.member(jsii_name="toGetRegexPatternSet")
    def to_get_regex_pattern_set(self) -> "Waf":
        '''(experimental) Returns the RegexPatternSet specified by RegexPatternSetId.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GetRegexPatternSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toGetRegexPatternSet", []))

    @jsii.member(jsii_name="toGetRule")
    def to_get_rule(self) -> "Waf":
        '''(experimental) Returns the Rule that is specified by the RuleId that you included in the GetRule request.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GetRule.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toGetRule", []))

    @jsii.member(jsii_name="toGetRuleGroup")
    def to_get_rule_group(self) -> "Waf":
        '''(experimental) Returns the RuleGroup that is specified by the RuleGroupId that you included in the GetRuleGroup request.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GetRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toGetRuleGroup", []))

    @jsii.member(jsii_name="toGetSampledRequests")
    def to_get_sampled_requests(self) -> "Waf":
        '''(experimental) Gets detailed information about a specified number of requests--a sample--that AWS WAF randomly selects from among the first 5,000 requests that your AWS resource received during a time range that you choose.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GetSampledRequests.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toGetSampledRequests", []))

    @jsii.member(jsii_name="toGetSizeConstraintSet")
    def to_get_size_constraint_set(self) -> "Waf":
        '''(experimental) Returns the SizeConstraintSet specified by SizeConstraintSetId.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GetSizeConstraintSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toGetSizeConstraintSet", []))

    @jsii.member(jsii_name="toGetSqlInjectionMatchSet")
    def to_get_sql_injection_match_set(self) -> "Waf":
        '''(experimental) Returns the SqlInjectionMatchSet that is specified by SqlInjectionMatchSetId.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GetSqlInjectionMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toGetSqlInjectionMatchSet", []))

    @jsii.member(jsii_name="toGetWebACL")
    def to_get_web_acl(self) -> "Waf":
        '''(experimental) Returns the WebACL that is specified by WebACLId.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GetWebACL.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toGetWebACL", []))

    @jsii.member(jsii_name="toGetXssMatchSet")
    def to_get_xss_match_set(self) -> "Waf":
        '''(experimental) Returns the XssMatchSet that is specified by XssMatchSetId.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GetXssMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toGetXssMatchSet", []))

    @jsii.member(jsii_name="toListActivatedRulesInRuleGroup")
    def to_list_activated_rules_in_rule_group(self) -> "Waf":
        '''(experimental) Returns an array of ActivatedRule objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_ListActivatedRulesInRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toListActivatedRulesInRuleGroup", []))

    @jsii.member(jsii_name="toListByteMatchSets")
    def to_list_byte_match_sets(self) -> "Waf":
        '''(experimental) Returns an array of ByteMatchSetSummary objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_ListByteMatchSets.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toListByteMatchSets", []))

    @jsii.member(jsii_name="toListGeoMatchSets")
    def to_list_geo_match_sets(self) -> "Waf":
        '''(experimental) Returns an array of GeoMatchSetSummary objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_ListGeoMatchSets.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toListGeoMatchSets", []))

    @jsii.member(jsii_name="toListIPSets")
    def to_list_ip_sets(self) -> "Waf":
        '''(experimental) Returns an array of IPSetSummary objects in the response.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_ListIPSets.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toListIPSets", []))

    @jsii.member(jsii_name="toListLoggingConfigurations")
    def to_list_logging_configurations(self) -> "Waf":
        '''(experimental) Returns an array of LoggingConfiguration objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_ListLoggingConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toListLoggingConfigurations", []))

    @jsii.member(jsii_name="toListRateBasedRules")
    def to_list_rate_based_rules(self) -> "Waf":
        '''(experimental) Returns an array of RuleSummary objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_ListRateBasedRules.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toListRateBasedRules", []))

    @jsii.member(jsii_name="toListRegexMatchSets")
    def to_list_regex_match_sets(self) -> "Waf":
        '''(experimental) Returns an array of RegexMatchSetSummary objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_ListRegexMatchSets.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toListRegexMatchSets", []))

    @jsii.member(jsii_name="toListRegexPatternSets")
    def to_list_regex_pattern_sets(self) -> "Waf":
        '''(experimental) Returns an array of RegexPatternSetSummary objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_ListRegexPatternSets.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toListRegexPatternSets", []))

    @jsii.member(jsii_name="toListRuleGroups")
    def to_list_rule_groups(self) -> "Waf":
        '''(experimental) Returns an array of RuleGroup objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_ListRuleGroups.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toListRuleGroups", []))

    @jsii.member(jsii_name="toListRules")
    def to_list_rules(self) -> "Waf":
        '''(experimental) Returns an array of RuleSummary objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_ListRules.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toListRules", []))

    @jsii.member(jsii_name="toListSizeConstraintSets")
    def to_list_size_constraint_sets(self) -> "Waf":
        '''(experimental) Returns an array of SizeConstraintSetSummary objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_ListSizeConstraintSets.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toListSizeConstraintSets", []))

    @jsii.member(jsii_name="toListSqlInjectionMatchSets")
    def to_list_sql_injection_match_sets(self) -> "Waf":
        '''(experimental) Returns an array of SqlInjectionMatchSet objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_ListSqlInjectionMatchSets.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toListSqlInjectionMatchSets", []))

    @jsii.member(jsii_name="toListSubscribedRuleGroups")
    def to_list_subscribed_rule_groups(self) -> "Waf":
        '''(experimental) Returns an array of RuleGroup objects that you are subscribed to.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_ListSubscribedRuleGroups.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toListSubscribedRuleGroups", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Waf":
        '''(experimental) Lists the Tags for a given resource.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListWebACLs")
    def to_list_web_ac_ls(self) -> "Waf":
        '''(experimental) Returns an array of WebACLSummary objects in the response.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_ListWebACLs.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toListWebACLs", []))

    @jsii.member(jsii_name="toListXssMatchSets")
    def to_list_xss_match_sets(self) -> "Waf":
        '''(experimental) Returns an array of XssMatchSet objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_ListXssMatchSets.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toListXssMatchSets", []))

    @jsii.member(jsii_name="toPutLoggingConfiguration")
    def to_put_logging_configuration(self) -> "Waf":
        '''(experimental) Associates a LoggingConfiguration with a specified web ACL.

        Access Level: Write

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_PutLoggingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toPutLoggingConfiguration", []))

    @jsii.member(jsii_name="toPutPermissionPolicy")
    def to_put_permission_policy(self) -> "Waf":
        '''(experimental) Attaches a IAM policy to the specified resource.

        The only supported use for this action is to share a RuleGroup across accounts.

        Access Level: Permissions management

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_PutPermissionPolicy.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toPutPermissionPolicy", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Waf":
        '''(experimental) Adds a Tag to a given resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Waf":
        '''(experimental) Removes a Tag from a given resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateByteMatchSet")
    def to_update_byte_match_set(self) -> "Waf":
        '''(experimental) Inserts or deletes ByteMatchTuple objects (filters) in a ByteMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_UpdateByteMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toUpdateByteMatchSet", []))

    @jsii.member(jsii_name="toUpdateGeoMatchSet")
    def to_update_geo_match_set(self) -> "Waf":
        '''(experimental) Inserts or deletes GeoMatchConstraint objects in a GeoMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_UpdateGeoMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toUpdateGeoMatchSet", []))

    @jsii.member(jsii_name="toUpdateIPSet")
    def to_update_ip_set(self) -> "Waf":
        '''(experimental) Inserts or deletes IPSetDescriptor objects in an IPSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_UpdateIPSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toUpdateIPSet", []))

    @jsii.member(jsii_name="toUpdateRateBasedRule")
    def to_update_rate_based_rule(self) -> "Waf":
        '''(experimental) Inserts or deletes Predicate objects in a rule and updates the RateLimit in the rule.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_UpdateRateBasedRule.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toUpdateRateBasedRule", []))

    @jsii.member(jsii_name="toUpdateRegexMatchSet")
    def to_update_regex_match_set(self) -> "Waf":
        '''(experimental) Inserts or deletes RegexMatchTuple objects (filters) in a RegexMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_UpdateRegexMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toUpdateRegexMatchSet", []))

    @jsii.member(jsii_name="toUpdateRegexPatternSet")
    def to_update_regex_pattern_set(self) -> "Waf":
        '''(experimental) Inserts or deletes RegexPatternStrings in a RegexPatternSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_UpdateRegexPatternSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toUpdateRegexPatternSet", []))

    @jsii.member(jsii_name="toUpdateRule")
    def to_update_rule(self) -> "Waf":
        '''(experimental) Inserts or deletes Predicate objects in a Rule.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_UpdateRule.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toUpdateRule", []))

    @jsii.member(jsii_name="toUpdateRuleGroup")
    def to_update_rule_group(self) -> "Waf":
        '''(experimental) Inserts or deletes ActivatedRule objects in a RuleGroup.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_UpdateRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toUpdateRuleGroup", []))

    @jsii.member(jsii_name="toUpdateSizeConstraintSet")
    def to_update_size_constraint_set(self) -> "Waf":
        '''(experimental) Inserts or deletes SizeConstraint objects (filters) in a SizeConstraintSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_UpdateSizeConstraintSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toUpdateSizeConstraintSet", []))

    @jsii.member(jsii_name="toUpdateSqlInjectionMatchSet")
    def to_update_sql_injection_match_set(self) -> "Waf":
        '''(experimental) Inserts or deletes SqlInjectionMatchTuple objects (filters) in a SqlInjectionMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_UpdateSqlInjectionMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toUpdateSqlInjectionMatchSet", []))

    @jsii.member(jsii_name="toUpdateWebACL")
    def to_update_web_acl(self) -> "Waf":
        '''(experimental) Inserts or deletes ActivatedRule objects in a WebACL.

        Access Level: Permissions management

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_UpdateWebACL.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toUpdateWebACL", []))

    @jsii.member(jsii_name="toUpdateXssMatchSet")
    def to_update_xss_match_set(self) -> "Waf":
        '''(experimental) Inserts or deletes XssMatchTuple objects (filters) in an XssMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_UpdateXssMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toUpdateXssMatchSet", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class WafRegional(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.WafRegional",
):
    '''(experimental) Statement provider for service `waf-regional <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awswafregional.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `waf-regional <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awswafregional.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(WafRegional, self, [sid])

    @jsii.member(jsii_name="onBytematchset")
    def on_bytematchset(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "WafRegional":
        '''(experimental) Adds a resource of type bytematchset to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_ByteMatchSet.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "onBytematchset", [id, account, region, partition]))

    @jsii.member(jsii_name="onGeomatchset")
    def on_geomatchset(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "WafRegional":
        '''(experimental) Adds a resource of type geomatchset to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GeoMatchSet.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "onGeomatchset", [id, account, region, partition]))

    @jsii.member(jsii_name="onIpset")
    def on_ipset(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "WafRegional":
        '''(experimental) Adds a resource of type ipset to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_IPSet.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "onIpset", [id, account, region, partition]))

    @jsii.member(jsii_name="onLoadbalancerApp")
    def on_loadbalancer_app(
        self,
        load_balancer_name: builtins.str,
        load_balancer_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "WafRegional":
        '''(experimental) Adds a resource of type loadbalancer/app/ to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_WebACL.html

        :param load_balancer_name: - Identifier for the loadBalancerName.
        :param load_balancer_id: - Identifier for the loadBalancerId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "onLoadbalancerApp", [load_balancer_name, load_balancer_id, account, region, partition]))

    @jsii.member(jsii_name="onRatebasedrule")
    def on_ratebasedrule(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "WafRegional":
        '''(experimental) Adds a resource of type ratebasedrule to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_RateBasedRule.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "onRatebasedrule", [id, account, region, partition]))

    @jsii.member(jsii_name="onRegexmatchset")
    def on_regexmatchset(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "WafRegional":
        '''(experimental) Adds a resource of type regexmatchset to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_RegexMatchSet.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "onRegexmatchset", [id, account, region, partition]))

    @jsii.member(jsii_name="onRegexpatternset")
    def on_regexpatternset(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "WafRegional":
        '''(experimental) Adds a resource of type regexpatternset to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_RegexPatternSet.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "onRegexpatternset", [id, account, region, partition]))

    @jsii.member(jsii_name="onRule")
    def on_rule(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "WafRegional":
        '''(experimental) Adds a resource of type rule to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_Rule.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "onRule", [id, account, region, partition]))

    @jsii.member(jsii_name="onRulegroup")
    def on_rulegroup(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "WafRegional":
        '''(experimental) Adds a resource of type rulegroup to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_RuleGroup.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "onRulegroup", [id, account, region, partition]))

    @jsii.member(jsii_name="onSizeconstraintset")
    def on_sizeconstraintset(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "WafRegional":
        '''(experimental) Adds a resource of type sizeconstraintset to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_SizeConstraintSet.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "onSizeconstraintset", [id, account, region, partition]))

    @jsii.member(jsii_name="onSqlinjectionmatchset")
    def on_sqlinjectionmatchset(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "WafRegional":
        '''(experimental) Adds a resource of type sqlinjectionmatchset to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_SqlInjectionMatchSet.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "onSqlinjectionmatchset", [id, account, region, partition]))

    @jsii.member(jsii_name="onWebacl")
    def on_webacl(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "WafRegional":
        '''(experimental) Adds a resource of type webacl to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_WebACL.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "onWebacl", [id, account, region, partition]))

    @jsii.member(jsii_name="onXssmatchset")
    def on_xssmatchset(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "WafRegional":
        '''(experimental) Adds a resource of type xssmatchset to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_XssMatchSet.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "onXssmatchset", [id, account, region, partition]))

    @jsii.member(jsii_name="toAssociateWebACL")
    def to_associate_web_acl(self) -> "WafRegional":
        '''(experimental) Associates a WebACL with a resource.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_AssociateWebACL.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toAssociateWebACL", []))

    @jsii.member(jsii_name="toCreateByteMatchSet")
    def to_create_byte_match_set(self) -> "WafRegional":
        '''(experimental) Creates a ByteMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_CreateByteMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toCreateByteMatchSet", []))

    @jsii.member(jsii_name="toCreateGeoMatchSet")
    def to_create_geo_match_set(self) -> "WafRegional":
        '''(experimental) Creates a GeoMatchSet, which you use to specify which web requests you want to allow or block based on the country that the requests originate rom.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_CreateGeoMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toCreateGeoMatchSet", []))

    @jsii.member(jsii_name="toCreateIPSet")
    def to_create_ip_set(self) -> "WafRegional":
        '''(experimental) Creates an IPSet, which you use to specify which web requests you want to allow or block based on the IP addresses that the requests originate rom.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_CreateIPSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toCreateIPSet", []))

    @jsii.member(jsii_name="toCreateRateBasedRule")
    def to_create_rate_based_rule(self) -> "WafRegional":
        '''(experimental) Creates a RateBasedRule, which contains a RateLimit specifying the maximum number of requests that AWS WAF allows from a specified IP address n a five-minute period.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_CreateRateBasedRule.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toCreateRateBasedRule", []))

    @jsii.member(jsii_name="toCreateRegexMatchSet")
    def to_create_regex_match_set(self) -> "WafRegional":
        '''(experimental) Creates a RegexMatchSet, which you use to specify which web requests you want to allow or block based on the regex patterns you specified in a egexPatternSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_CreateRegexMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toCreateRegexMatchSet", []))

    @jsii.member(jsii_name="toCreateRegexPatternSet")
    def to_create_regex_pattern_set(self) -> "WafRegional":
        '''(experimental) Creates a RegexPatternSet, which you use to specify the regular expression (regex) pattern that you want AWS WAF to search for.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_CreateRegexPatternSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toCreateRegexPatternSet", []))

    @jsii.member(jsii_name="toCreateRule")
    def to_create_rule(self) -> "WafRegional":
        '''(experimental) Creates a Rule, which contains the IPSet objects, ByteMatchSet objects, and other predicates that identify the requests that you want to lock.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_CreateRule.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toCreateRule", []))

    @jsii.member(jsii_name="toCreateRuleGroup")
    def to_create_rule_group(self) -> "WafRegional":
        '''(experimental) Creates a RuleGroup. A rule group is a collection of predefined rules that you add to a WebACL.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_CreateRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toCreateRuleGroup", []))

    @jsii.member(jsii_name="toCreateSizeConstraintSet")
    def to_create_size_constraint_set(self) -> "WafRegional":
        '''(experimental) Creates a SizeConstraintSet, which you use to identify the part of a web request that you want to check for length.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_CreateSizeConstraintSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toCreateSizeConstraintSet", []))

    @jsii.member(jsii_name="toCreateSqlInjectionMatchSet")
    def to_create_sql_injection_match_set(self) -> "WafRegional":
        '''(experimental) Creates a SqlInjectionMatchSet, which you use to allow, block, or count requests that contain snippets of SQL code in a specified part of web equests.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_CreateSqlInjectionMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toCreateSqlInjectionMatchSet", []))

    @jsii.member(jsii_name="toCreateWebACL")
    def to_create_web_acl(self) -> "WafRegional":
        '''(experimental) Creates a WebACL, which contains the Rules that identify the CloudFront web requests that you want to allow, block, or count.

        Access Level: Permissions management

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_CreateWebACL.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toCreateWebACL", []))

    @jsii.member(jsii_name="toCreateWebACLMigrationStack")
    def to_create_web_acl_migration_stack(self) -> "WafRegional":
        '''(experimental) Create and store a CloudFormation tempalte that creates an equivalent WAF v2 WebACL from the given WAF Classic WebACL in the given S3 bucket.

        Access Level: Write

        Dependent actions:

        - s3:PutObject

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_CreateWebACLMigrationStack.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toCreateWebACLMigrationStack", []))

    @jsii.member(jsii_name="toCreateXssMatchSet")
    def to_create_xss_match_set(self) -> "WafRegional":
        '''(experimental) Creates an XssMatchSet, which you use to allow, block, or count requests that contain cross-site scripting attacks in the specified part of web equests.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_CreateXssMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toCreateXssMatchSet", []))

    @jsii.member(jsii_name="toDeleteByteMatchSet")
    def to_delete_byte_match_set(self) -> "WafRegional":
        '''(experimental) Permanently deletes a ByteMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_DeleteByteMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toDeleteByteMatchSet", []))

    @jsii.member(jsii_name="toDeleteGeoMatchSet")
    def to_delete_geo_match_set(self) -> "WafRegional":
        '''(experimental) Permanently deletes an GeoMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_DeleteGeoMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toDeleteGeoMatchSet", []))

    @jsii.member(jsii_name="toDeleteIPSet")
    def to_delete_ip_set(self) -> "WafRegional":
        '''(experimental) Permanently deletes an IPSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_DeleteIPSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toDeleteIPSet", []))

    @jsii.member(jsii_name="toDeleteLoggingConfiguration")
    def to_delete_logging_configuration(self) -> "WafRegional":
        '''(experimental) Permanently deletes the LoggingConfiguration from the specified web ACL.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_DeleteLoggingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toDeleteLoggingConfiguration", []))

    @jsii.member(jsii_name="toDeletePermissionPolicy")
    def to_delete_permission_policy(self) -> "WafRegional":
        '''(experimental) Permanently deletes an IAM policy from the specified RuleGroup.

        Access Level: Permissions management

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_DeletePermissionPolicy.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toDeletePermissionPolicy", []))

    @jsii.member(jsii_name="toDeleteRateBasedRule")
    def to_delete_rate_based_rule(self) -> "WafRegional":
        '''(experimental) Permanently deletes a RateBasedRule.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_DeleteRateBasedRule.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toDeleteRateBasedRule", []))

    @jsii.member(jsii_name="toDeleteRegexMatchSet")
    def to_delete_regex_match_set(self) -> "WafRegional":
        '''(experimental) Permanently deletes an RegexMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_DeleteRegexMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toDeleteRegexMatchSet", []))

    @jsii.member(jsii_name="toDeleteRegexPatternSet")
    def to_delete_regex_pattern_set(self) -> "WafRegional":
        '''(experimental) Permanently deletes an RegexPatternSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_DeleteRegexPatternSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toDeleteRegexPatternSet", []))

    @jsii.member(jsii_name="toDeleteRule")
    def to_delete_rule(self) -> "WafRegional":
        '''(experimental) Permanently deletes a Rule.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_DeleteRule.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toDeleteRule", []))

    @jsii.member(jsii_name="toDeleteRuleGroup")
    def to_delete_rule_group(self) -> "WafRegional":
        '''(experimental) Permanently deletes a RuleGroup.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_DeleteRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toDeleteRuleGroup", []))

    @jsii.member(jsii_name="toDeleteSizeConstraintSet")
    def to_delete_size_constraint_set(self) -> "WafRegional":
        '''(experimental) Permanently deletes a SizeConstraintSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_DeleteSizeConstraintSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toDeleteSizeConstraintSet", []))

    @jsii.member(jsii_name="toDeleteSqlInjectionMatchSet")
    def to_delete_sql_injection_match_set(self) -> "WafRegional":
        '''(experimental) Permanently deletes a SqlInjectionMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_DeleteSqlInjectionMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toDeleteSqlInjectionMatchSet", []))

    @jsii.member(jsii_name="toDeleteWebACL")
    def to_delete_web_acl(self) -> "WafRegional":
        '''(experimental) Permanently deletes a WebACL.

        Access Level: Permissions management

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_DeleteWebACL.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toDeleteWebACL", []))

    @jsii.member(jsii_name="toDeleteXssMatchSet")
    def to_delete_xss_match_set(self) -> "WafRegional":
        '''(experimental) Permanently deletes an XssMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_DeleteXssMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toDeleteXssMatchSet", []))

    @jsii.member(jsii_name="toDisassociateWebACL")
    def to_disassociate_web_acl(self) -> "WafRegional":
        '''(experimental) Removes a WebACL from the specified resource.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_DisassociateWebACL.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toDisassociateWebACL", []))

    @jsii.member(jsii_name="toGetByteMatchSet")
    def to_get_byte_match_set(self) -> "WafRegional":
        '''(experimental) Returns the ByteMatchSet specified by ByteMatchSetId.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetByteMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetByteMatchSet", []))

    @jsii.member(jsii_name="toGetChangeToken")
    def to_get_change_token(self) -> "WafRegional":
        '''(experimental) When you want to create, update, or delete AWS WAF objects, get a change token and include the change token in the create, update, or delete equest.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetChangeToken.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetChangeToken", []))

    @jsii.member(jsii_name="toGetChangeTokenStatus")
    def to_get_change_token_status(self) -> "WafRegional":
        '''(experimental) Returns the status of a ChangeToken that you got by calling GetChangeToken.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetChangeTokenStatus.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetChangeTokenStatus", []))

    @jsii.member(jsii_name="toGetGeoMatchSet")
    def to_get_geo_match_set(self) -> "WafRegional":
        '''(experimental) Returns the GeoMatchSet specified by GeoMatchSetId.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetGeoMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetGeoMatchSet", []))

    @jsii.member(jsii_name="toGetIPSet")
    def to_get_ip_set(self) -> "WafRegional":
        '''(experimental) Returns the IPSet that is specified by IPSetId.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetIPSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetIPSet", []))

    @jsii.member(jsii_name="toGetLoggingConfiguration")
    def to_get_logging_configuration(self) -> "WafRegional":
        '''(experimental) Returns the LoggingConfiguration for the specified web ACL.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetLoggingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetLoggingConfiguration", []))

    @jsii.member(jsii_name="toGetPermissionPolicy")
    def to_get_permission_policy(self) -> "WafRegional":
        '''(experimental) Returns the IAM policy attached to the RuleGroup.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetPermissionPolicy.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetPermissionPolicy", []))

    @jsii.member(jsii_name="toGetRateBasedRule")
    def to_get_rate_based_rule(self) -> "WafRegional":
        '''(experimental) Returns the RateBasedRule that is specified by the RuleId that you included in the GetRateBasedRule request.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetRateBasedRule.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetRateBasedRule", []))

    @jsii.member(jsii_name="toGetRateBasedRuleManagedKeys")
    def to_get_rate_based_rule_managed_keys(self) -> "WafRegional":
        '''(experimental) Returns an array of IP addresses currently being blocked by the RateBasedRule that is specified by the RuleId.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetRateBasedRuleManagedKeys.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetRateBasedRuleManagedKeys", []))

    @jsii.member(jsii_name="toGetRegexMatchSet")
    def to_get_regex_match_set(self) -> "WafRegional":
        '''(experimental) Returns the RegexMatchSet specified by RegexMatchSetId.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetRegexMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetRegexMatchSet", []))

    @jsii.member(jsii_name="toGetRegexPatternSet")
    def to_get_regex_pattern_set(self) -> "WafRegional":
        '''(experimental) Returns the RegexPatternSet specified by RegexPatternSetId.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetRegexPatternSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetRegexPatternSet", []))

    @jsii.member(jsii_name="toGetRule")
    def to_get_rule(self) -> "WafRegional":
        '''(experimental) Returns the Rule that is specified by the RuleId that you included in the GetRule request.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetRule.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetRule", []))

    @jsii.member(jsii_name="toGetRuleGroup")
    def to_get_rule_group(self) -> "WafRegional":
        '''(experimental) Returns the RuleGroup that is specified by the RuleGroupId that you included in the GetRuleGroup request.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetRuleGroup", []))

    @jsii.member(jsii_name="toGetSampledRequests")
    def to_get_sampled_requests(self) -> "WafRegional":
        '''(experimental) Gets detailed information about a specified number of requests--a sample--that AWS WAF randomly selects from among the first 5,000 requests hat your AWS resource received during a time range that you choose.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetSampledRequests.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetSampledRequests", []))

    @jsii.member(jsii_name="toGetSizeConstraintSet")
    def to_get_size_constraint_set(self) -> "WafRegional":
        '''(experimental) Returns the SizeConstraintSet specified by SizeConstraintSetId.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetSizeConstraintSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetSizeConstraintSet", []))

    @jsii.member(jsii_name="toGetSqlInjectionMatchSet")
    def to_get_sql_injection_match_set(self) -> "WafRegional":
        '''(experimental) Returns the SqlInjectionMatchSet that is specified by SqlInjectionMatchSetId.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetSqlInjectionMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetSqlInjectionMatchSet", []))

    @jsii.member(jsii_name="toGetWebACL")
    def to_get_web_acl(self) -> "WafRegional":
        '''(experimental) Returns the WebACL that is specified by WebACLId.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetWebACL.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetWebACL", []))

    @jsii.member(jsii_name="toGetWebACLForResource")
    def to_get_web_acl_for_resource(self) -> "WafRegional":
        '''(experimental) Returns the WebACL for the specified resource.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetWebACLForResource.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetWebACLForResource", []))

    @jsii.member(jsii_name="toGetXssMatchSet")
    def to_get_xss_match_set(self) -> "WafRegional":
        '''(experimental) Returns the XssMatchSet that is specified by XssMatchSetId.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetXssMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetXssMatchSet", []))

    @jsii.member(jsii_name="toListActivatedRulesInRuleGroup")
    def to_list_activated_rules_in_rule_group(self) -> "WafRegional":
        '''(experimental) Returns an array of ActivatedRule objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_ListActivatedRulesInRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toListActivatedRulesInRuleGroup", []))

    @jsii.member(jsii_name="toListByteMatchSets")
    def to_list_byte_match_sets(self) -> "WafRegional":
        '''(experimental) Returns an array of ByteMatchSetSummary objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_ListByteMatchSets.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toListByteMatchSets", []))

    @jsii.member(jsii_name="toListGeoMatchSets")
    def to_list_geo_match_sets(self) -> "WafRegional":
        '''(experimental) Returns an array of GeoMatchSetSummary objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_ListGeoMatchSets.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toListGeoMatchSets", []))

    @jsii.member(jsii_name="toListIPSets")
    def to_list_ip_sets(self) -> "WafRegional":
        '''(experimental) Returns an array of IPSetSummary objects in the response.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_ListIPSets.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toListIPSets", []))

    @jsii.member(jsii_name="toListLoggingConfigurations")
    def to_list_logging_configurations(self) -> "WafRegional":
        '''(experimental) Returns an array of LoggingConfiguration objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_ListLoggingConfigurations.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toListLoggingConfigurations", []))

    @jsii.member(jsii_name="toListRateBasedRules")
    def to_list_rate_based_rules(self) -> "WafRegional":
        '''(experimental) Returns an array of RuleSummary objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_ListRateBasedRules.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toListRateBasedRules", []))

    @jsii.member(jsii_name="toListRegexMatchSets")
    def to_list_regex_match_sets(self) -> "WafRegional":
        '''(experimental) Returns an array of RegexMatchSetSummary objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_ListRegexMatchSets.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toListRegexMatchSets", []))

    @jsii.member(jsii_name="toListRegexPatternSets")
    def to_list_regex_pattern_sets(self) -> "WafRegional":
        '''(experimental) Returns an array of RegexPatternSetSummary objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_ListRegexPatternSets.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toListRegexPatternSets", []))

    @jsii.member(jsii_name="toListResourcesForWebACL")
    def to_list_resources_for_web_acl(self) -> "WafRegional":
        '''(experimental) Returns an array of resources associated with the specified WebACL.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_ListResourcesForWebACL.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toListResourcesForWebACL", []))

    @jsii.member(jsii_name="toListRuleGroups")
    def to_list_rule_groups(self) -> "WafRegional":
        '''(experimental) Returns an array of RuleGroup objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_ListRuleGroups.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toListRuleGroups", []))

    @jsii.member(jsii_name="toListRules")
    def to_list_rules(self) -> "WafRegional":
        '''(experimental) Returns an array of RuleSummary objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_ListRules.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toListRules", []))

    @jsii.member(jsii_name="toListSizeConstraintSets")
    def to_list_size_constraint_sets(self) -> "WafRegional":
        '''(experimental) Returns an array of SizeConstraintSetSummary objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_ListSizeConstraintSets.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toListSizeConstraintSets", []))

    @jsii.member(jsii_name="toListSqlInjectionMatchSets")
    def to_list_sql_injection_match_sets(self) -> "WafRegional":
        '''(experimental) Returns an array of SqlInjectionMatchSet objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_ListSqlInjectionMatchSets.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toListSqlInjectionMatchSets", []))

    @jsii.member(jsii_name="toListSubscribedRuleGroups")
    def to_list_subscribed_rule_groups(self) -> "WafRegional":
        '''(experimental) Returns an array of RuleGroup objects that you are subscribed to.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_ListSubscribedRuleGroups.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toListSubscribedRuleGroups", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "WafRegional":
        '''(experimental) Lists the Tags for a given resource.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListWebACLs")
    def to_list_web_ac_ls(self) -> "WafRegional":
        '''(experimental) Returns an array of WebACLSummary objects in the response.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_ListWebACLs.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toListWebACLs", []))

    @jsii.member(jsii_name="toListXssMatchSets")
    def to_list_xss_match_sets(self) -> "WafRegional":
        '''(experimental) Returns an array of XssMatchSet objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_ListXssMatchSets.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toListXssMatchSets", []))

    @jsii.member(jsii_name="toPutLoggingConfiguration")
    def to_put_logging_configuration(self) -> "WafRegional":
        '''(experimental) Associates a LoggingConfiguration with a specified web ACL.

        Access Level: Write

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_PutLoggingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toPutLoggingConfiguration", []))

    @jsii.member(jsii_name="toPutPermissionPolicy")
    def to_put_permission_policy(self) -> "WafRegional":
        '''(experimental) Attaches a IAM policy to the specified resource.

        The only supported use for this action is to share a RuleGroup across accounts.

        Access Level: Permissions management

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_PutPermissionPolicy.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toPutPermissionPolicy", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "WafRegional":
        '''(experimental) Adds a Tag to a given resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_TagResource.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "WafRegional":
        '''(experimental) Removes a Tag from a given resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateByteMatchSet")
    def to_update_byte_match_set(self) -> "WafRegional":
        '''(experimental) Inserts or deletes ByteMatchTuple objects (filters) in a ByteMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_UpdateByteMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toUpdateByteMatchSet", []))

    @jsii.member(jsii_name="toUpdateGeoMatchSet")
    def to_update_geo_match_set(self) -> "WafRegional":
        '''(experimental) Inserts or deletes GeoMatchConstraint objects in a GeoMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_UpdateGeoMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toUpdateGeoMatchSet", []))

    @jsii.member(jsii_name="toUpdateIPSet")
    def to_update_ip_set(self) -> "WafRegional":
        '''(experimental) Inserts or deletes IPSetDescriptor objects in an IPSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_UpdateIPSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toUpdateIPSet", []))

    @jsii.member(jsii_name="toUpdateRateBasedRule")
    def to_update_rate_based_rule(self) -> "WafRegional":
        '''(experimental) Inserts or deletes Predicate objects in a rule and updates the RateLimit in the rule.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_UpdateRateBasedRule.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toUpdateRateBasedRule", []))

    @jsii.member(jsii_name="toUpdateRegexMatchSet")
    def to_update_regex_match_set(self) -> "WafRegional":
        '''(experimental) Inserts or deletes RegexMatchTuple objects (filters) in a RegexMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_UpdateRegexMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toUpdateRegexMatchSet", []))

    @jsii.member(jsii_name="toUpdateRegexPatternSet")
    def to_update_regex_pattern_set(self) -> "WafRegional":
        '''(experimental) Inserts or deletes RegexPatternStrings in a RegexPatternSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_UpdateRegexPatternSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toUpdateRegexPatternSet", []))

    @jsii.member(jsii_name="toUpdateRule")
    def to_update_rule(self) -> "WafRegional":
        '''(experimental) Inserts or deletes Predicate objects in a Rule.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_UpdateRule.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toUpdateRule", []))

    @jsii.member(jsii_name="toUpdateRuleGroup")
    def to_update_rule_group(self) -> "WafRegional":
        '''(experimental) Inserts or deletes ActivatedRule objects in a RuleGroup.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_UpdateRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toUpdateRuleGroup", []))

    @jsii.member(jsii_name="toUpdateSizeConstraintSet")
    def to_update_size_constraint_set(self) -> "WafRegional":
        '''(experimental) Inserts or deletes SizeConstraint objects (filters) in a SizeConstraintSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_UpdateSizeConstraintSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toUpdateSizeConstraintSet", []))

    @jsii.member(jsii_name="toUpdateSqlInjectionMatchSet")
    def to_update_sql_injection_match_set(self) -> "WafRegional":
        '''(experimental) Inserts or deletes SqlInjectionMatchTuple objects (filters) in a SqlInjectionMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_UpdateSqlInjectionMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toUpdateSqlInjectionMatchSet", []))

    @jsii.member(jsii_name="toUpdateWebACL")
    def to_update_web_acl(self) -> "WafRegional":
        '''(experimental) Inserts or deletes ActivatedRule objects in a WebACL.

        Access Level: Permissions management

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_UpdateWebACL.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toUpdateWebACL", []))

    @jsii.member(jsii_name="toUpdateXssMatchSet")
    def to_update_xss_match_set(self) -> "WafRegional":
        '''(experimental) Inserts or deletes XssMatchTuple objects (filters) in an XssMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_UpdateXssMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toUpdateXssMatchSet", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Wafv2(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Wafv2"):
    '''(experimental) Statement provider for service `wafv2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awswafv2.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `wafv2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awswafv2.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Wafv2, self, [sid])

    @jsii.member(jsii_name="onApigateway")
    def on_apigateway(
        self,
        api_id: builtins.str,
        stage_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Wafv2":
        '''(experimental) Adds a resource of type apigateway to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_WebACL.html

        :param api_id: - Identifier for the apiId.
        :param stage_name: - Identifier for the stageName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "onApigateway", [api_id, stage_name, account, region, partition]))

    @jsii.member(jsii_name="onAppsync")
    def on_appsync(
        self,
        graph_qlapi_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Wafv2":
        '''(experimental) Adds a resource of type appsync to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_WebACL.html

        :param graph_qlapi_id: - Identifier for the graphQLAPIId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "onAppsync", [graph_qlapi_id, account, region, partition]))

    @jsii.member(jsii_name="onIpset")
    def on_ipset(
        self,
        scope: builtins.str,
        name: builtins.str,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Wafv2":
        '''(experimental) Adds a resource of type ipset to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_IPSet.html

        :param scope: - Identifier for the scope.
        :param name: - Identifier for the name.
        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "onIpset", [scope, name, id, account, region, partition]))

    @jsii.member(jsii_name="onLoadbalancerApp")
    def on_loadbalancer_app(
        self,
        load_balancer_name: builtins.str,
        load_balancer_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Wafv2":
        '''(experimental) Adds a resource of type loadbalancer/app/ to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_WebACL.html

        :param load_balancer_name: - Identifier for the loadBalancerName.
        :param load_balancer_id: - Identifier for the loadBalancerId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "onLoadbalancerApp", [load_balancer_name, load_balancer_id, account, region, partition]))

    @jsii.member(jsii_name="onRegexpatternset")
    def on_regexpatternset(
        self,
        scope: builtins.str,
        name: builtins.str,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Wafv2":
        '''(experimental) Adds a resource of type regexpatternset to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_RegexPatternSet.html

        :param scope: - Identifier for the scope.
        :param name: - Identifier for the name.
        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "onRegexpatternset", [scope, name, id, account, region, partition]))

    @jsii.member(jsii_name="onRulegroup")
    def on_rulegroup(
        self,
        scope: builtins.str,
        name: builtins.str,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Wafv2":
        '''(experimental) Adds a resource of type rulegroup to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_RuleGroup.html

        :param scope: - Identifier for the scope.
        :param name: - Identifier for the name.
        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "onRulegroup", [scope, name, id, account, region, partition]))

    @jsii.member(jsii_name="onWebacl")
    def on_webacl(
        self,
        scope: builtins.str,
        name: builtins.str,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Wafv2":
        '''(experimental) Adds a resource of type webacl to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_WebACL.html

        :param scope: - Identifier for the scope.
        :param name: - Identifier for the name.
        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "onWebacl", [scope, name, id, account, region, partition]))

    @jsii.member(jsii_name="toAssociateWebACL")
    def to_associate_web_acl(self) -> "Wafv2":
        '''(experimental) Grants permission to associate a WebACL with a resource.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_AssociateWebACL.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toAssociateWebACL", []))

    @jsii.member(jsii_name="toCheckCapacity")
    def to_check_capacity(self) -> "Wafv2":
        '''(experimental) Grants permission to calculate web ACL capacity unit (WCU) requirements for a specified scope and set of rules.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_CheckCapacity.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toCheckCapacity", []))

    @jsii.member(jsii_name="toCreateIPSet")
    def to_create_ip_set(self) -> "Wafv2":
        '''(experimental) Grants permission to create an IPSet.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_CreateIPSet.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toCreateIPSet", []))

    @jsii.member(jsii_name="toCreateRegexPatternSet")
    def to_create_regex_pattern_set(self) -> "Wafv2":
        '''(experimental) Grants permission to create a RegexPatternSet.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_CreateRegexPatternSet.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toCreateRegexPatternSet", []))

    @jsii.member(jsii_name="toCreateRuleGroup")
    def to_create_rule_group(self) -> "Wafv2":
        '''(experimental) Grants permission to create a RuleGroup.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_CreateRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toCreateRuleGroup", []))

    @jsii.member(jsii_name="toCreateWebACL")
    def to_create_web_acl(self) -> "Wafv2":
        '''(experimental) Grants permission to create a WebACL.

        Access Level: Permissions management

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_CreateWebACL.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toCreateWebACL", []))

    @jsii.member(jsii_name="toDeleteFirewallManagerRuleGroups")
    def to_delete_firewall_manager_rule_groups(self) -> "Wafv2":
        '''(experimental) Grants permission to delete specified FirewallManagedRulesGroups from the specified WebACL if not managed by Firewall Manager anymore.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_DeleteFirewallManagerRuleGroups.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toDeleteFirewallManagerRuleGroups", []))

    @jsii.member(jsii_name="toDeleteIPSet")
    def to_delete_ip_set(self) -> "Wafv2":
        '''(experimental) Grants permission to delete the specified IPSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_DeleteIPSet.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toDeleteIPSet", []))

    @jsii.member(jsii_name="toDeleteLoggingConfiguration")
    def to_delete_logging_configuration(self) -> "Wafv2":
        '''(experimental) Grants permission to delete the LoggingConfiguration from the specified WebACL.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_DeleteLoggingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toDeleteLoggingConfiguration", []))

    @jsii.member(jsii_name="toDeletePermissionPolicy")
    def to_delete_permission_policy(self) -> "Wafv2":
        '''(experimental) Grants permission to delete the PermissionPolicy on the specified RuleGroup.

        Access Level: Permissions management

        https://docs.aws.amazon.com/waf/latest/APIReference/API_DeletePermissionPolicy.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toDeletePermissionPolicy", []))

    @jsii.member(jsii_name="toDeleteRegexPatternSet")
    def to_delete_regex_pattern_set(self) -> "Wafv2":
        '''(experimental) Grants permission to delete the specified RegexPatternSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_DeleteRegexPatternSet.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toDeleteRegexPatternSet", []))

    @jsii.member(jsii_name="toDeleteRuleGroup")
    def to_delete_rule_group(self) -> "Wafv2":
        '''(experimental) Grants permission to delete the specified RuleGroup.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_DeleteRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toDeleteRuleGroup", []))

    @jsii.member(jsii_name="toDeleteWebACL")
    def to_delete_web_acl(self) -> "Wafv2":
        '''(experimental) Grants permission to delete the specified WebACL.

        Access Level: Permissions management

        https://docs.aws.amazon.com/waf/latest/APIReference/API_DeleteWebACL.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toDeleteWebACL", []))

    @jsii.member(jsii_name="toDescribeManagedRuleGroup")
    def to_describe_managed_rule_group(self) -> "Wafv2":
        '''(experimental) Grants permission to view high-level information for a managed rule group.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_DescribeManagedRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toDescribeManagedRuleGroup", []))

    @jsii.member(jsii_name="toDisassociateFirewallManager")
    def to_disassociate_firewall_manager(self) -> "Wafv2":
        '''(experimental) Grants permission to disassociate Firewall Manager from the specified WebACL.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_DisassociateFirewallManager.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toDisassociateFirewallManager", []))

    @jsii.member(jsii_name="toDisassociateWebACL")
    def to_disassociate_web_acl(self) -> "Wafv2":
        '''(experimental) Grants permission disassociate a WebACL from an application resource.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_DisassociateWebACL.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toDisassociateWebACL", []))

    @jsii.member(jsii_name="toGetIPSet")
    def to_get_ip_set(self) -> "Wafv2":
        '''(experimental) Grants permission to view details about the specified IPSet.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_GetIPSet.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toGetIPSet", []))

    @jsii.member(jsii_name="toGetLoggingConfiguration")
    def to_get_logging_configuration(self) -> "Wafv2":
        '''(experimental) Grants permission to view LoggingConfiguration about the specified WebACL.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_GetLoggingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toGetLoggingConfiguration", []))

    @jsii.member(jsii_name="toGetPermissionPolicy")
    def to_get_permission_policy(self) -> "Wafv2":
        '''(experimental) Grants permission to view PermissionPolicy on the specified RuleGroup.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_GetPermissionPolicy.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toGetPermissionPolicy", []))

    @jsii.member(jsii_name="toGetRateBasedStatementManagedKeys")
    def to_get_rate_based_statement_managed_keys(self) -> "Wafv2":
        '''(experimental) Grants permission to view the keys that are currently blocked by a rate-based rule.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_GetRateBasedStatementManagedKeys.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toGetRateBasedStatementManagedKeys", []))

    @jsii.member(jsii_name="toGetRegexPatternSet")
    def to_get_regex_pattern_set(self) -> "Wafv2":
        '''(experimental) Grants permission to view details about the specified RegexPatternSet.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_GetRegexPatternSet.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toGetRegexPatternSet", []))

    @jsii.member(jsii_name="toGetRuleGroup")
    def to_get_rule_group(self) -> "Wafv2":
        '''(experimental) Grants permission to view details about the specified RuleGroup.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_GetRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toGetRuleGroup", []))

    @jsii.member(jsii_name="toGetSampledRequests")
    def to_get_sampled_requests(self) -> "Wafv2":
        '''(experimental) Grants permission to view detailed information about a specified number of requests--a sample--that AWS WAF randomly selects from among the first 5,000 requests that your AWS resource received during a time range that you choose.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_GetSampledRequests.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toGetSampledRequests", []))

    @jsii.member(jsii_name="toGetWebACL")
    def to_get_web_acl(self) -> "Wafv2":
        '''(experimental) Grants permission to view details about the specified GetWebACL.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_GetWebACL.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toGetWebACL", []))

    @jsii.member(jsii_name="toGetWebACLForResource")
    def to_get_web_acl_for_resource(self) -> "Wafv2":
        '''(experimental) Grants permission to view the WebACL for the specified resource.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_GetWebACLForResource.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toGetWebACLForResource", []))

    @jsii.member(jsii_name="toListAvailableManagedRuleGroups")
    def to_list_available_managed_rule_groups(self) -> "Wafv2":
        '''(experimental) Grants permission to view an array of managed rule groups that are available for you to use.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_ListAvailableManagedRuleGroups.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toListAvailableManagedRuleGroups", []))

    @jsii.member(jsii_name="toListIPSets")
    def to_list_ip_sets(self) -> "Wafv2":
        '''(experimental) Grants permission to view an array of IPSetSummary objects for the IP sets that you manage.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_ListIPSets.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toListIPSets", []))

    @jsii.member(jsii_name="toListLoggingConfigurations")
    def to_list_logging_configurations(self) -> "Wafv2":
        '''(experimental) Grants permission to view an array of your LoggingConfiguration objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_ListLoggingConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toListLoggingConfigurations", []))

    @jsii.member(jsii_name="toListRegexPatternSets")
    def to_list_regex_pattern_sets(self) -> "Wafv2":
        '''(experimental) Grants permission to view an array of RegexPatternSetSummary objects for the regex pattern sets that you manage.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_ListRegexPatternSets.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toListRegexPatternSets", []))

    @jsii.member(jsii_name="toListResourcesForWebACL")
    def to_list_resources_for_web_acl(self) -> "Wafv2":
        '''(experimental) Grants permission to view an array of the Amazon Resource Names (ARNs) for the resources that are associated with the specified web ACL.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_ListResourcesForWebACL.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toListResourcesForWebACL", []))

    @jsii.member(jsii_name="toListRuleGroups")
    def to_list_rule_groups(self) -> "Wafv2":
        '''(experimental) Grants permission to view an array of RuleGroupSummary objects for the rule groups that you manage.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_ListRuleGroups.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toListRuleGroups", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Wafv2":
        '''(experimental) Grants permission to lists tag for the specified resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListWebACLs")
    def to_list_web_ac_ls(self) -> "Wafv2":
        '''(experimental) Grants permission to view an array of WebACLSummary objects for the web ACLs that you manage.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_ListWebACLs.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toListWebACLs", []))

    @jsii.member(jsii_name="toPutFirewallManagerRuleGroups")
    def to_put_firewall_manager_rule_groups(self) -> "Wafv2":
        '''(experimental) Grants permission to create FirewallManagedRulesGroups in the specified WebACL.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_PutFirewallManagerRuleGroups.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toPutFirewallManagerRuleGroups", []))

    @jsii.member(jsii_name="toPutLoggingConfiguration")
    def to_put_logging_configuration(self) -> "Wafv2":
        '''(experimental) Grants permission to enables the specified LoggingConfiguration, to start logging from a web ACL.

        Access Level: Write

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/waf/latest/APIReference/API_PutLoggingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toPutLoggingConfiguration", []))

    @jsii.member(jsii_name="toPutPermissionPolicy")
    def to_put_permission_policy(self) -> "Wafv2":
        '''(experimental) Grants permission to attach the specified IAM policy to the specified resource.

        The only supported use for this action is to share a RuleGroup across accounts.

        Access Level: Permissions management

        https://docs.aws.amazon.com/waf/latest/APIReference/API_PutPermissionPolicy.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toPutPermissionPolicy", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Wafv2":
        '''(experimental) Grants permission to associates tags with the specified AWS resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Wafv2":
        '''(experimental) Grants permission to disassociates tags from an AWS resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateIPSet")
    def to_update_ip_set(self) -> "Wafv2":
        '''(experimental) Grants permission to update the specified IPSet.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_UpdateIPSet.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toUpdateIPSet", []))

    @jsii.member(jsii_name="toUpdateRegexPatternSet")
    def to_update_regex_pattern_set(self) -> "Wafv2":
        '''(experimental) Grants permission to update the specified RegexPatternSet.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_UpdateRegexPatternSet.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toUpdateRegexPatternSet", []))

    @jsii.member(jsii_name="toUpdateRuleGroup")
    def to_update_rule_group(self) -> "Wafv2":
        '''(experimental) Grants permission to update the specified RuleGroup.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_UpdateRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toUpdateRuleGroup", []))

    @jsii.member(jsii_name="toUpdateWebACL")
    def to_update_web_acl(self) -> "Wafv2":
        '''(experimental) Grants permission to update the specified WebACL.

        Access Level: Permissions management

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_UpdateWebACL.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toUpdateWebACL", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Wam(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Wam"):
    '''(experimental) Statement provider for service `wam <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonworkspacesapplicationmanager.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `wam <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonworkspacesapplicationmanager.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Wam, self, [sid])

    @jsii.member(jsii_name="toAuthenticatePackager")
    def to_authenticate_packager(self) -> "Wam":
        '''(experimental) Allows the Amazon WAM packaging instance to access your application package catalog.

        Access Level: Write

        https://docs.aws.amazon.com/wam/latest/adminguide/iam.html

        :stability: experimental
        '''
        return typing.cast("Wam", jsii.invoke(self, "toAuthenticatePackager", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Wellarchitected(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Wellarchitected",
):
    '''(experimental) Statement provider for service `wellarchitected <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awswell-architectedtool.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `wellarchitected <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awswell-architectedtool.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Wellarchitected, self, [sid])

    @jsii.member(jsii_name="onWorkload")
    def on_workload(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Wellarchitected":
        '''(experimental) Adds a resource of type workload to the statement.

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_Workload.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "onWorkload", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toAssociateLenses")
    def to_associate_lenses(self) -> "Wellarchitected":
        '''(experimental) Grants permission to associate a lens to the specified workload.

        Access Level: Write

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_AssociateLenses.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toAssociateLenses", []))

    @jsii.member(jsii_name="toCreateMilestone")
    def to_create_milestone(self) -> "Wellarchitected":
        '''(experimental) Grants permission to create a new milestone for the specified workload.

        Access Level: Write

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_CreateMilestone.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toCreateMilestone", []))

    @jsii.member(jsii_name="toCreateWorkload")
    def to_create_workload(self) -> "Wellarchitected":
        '''(experimental) Grants permission to create a new workload.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_CreateWorkload.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toCreateWorkload", []))

    @jsii.member(jsii_name="toCreateWorkloadShare")
    def to_create_workload_share(self) -> "Wellarchitected":
        '''(experimental) Grants permission to share a workload with another account.

        Access Level: Write

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_CreateWorkloadShare.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toCreateWorkloadShare", []))

    @jsii.member(jsii_name="toDeleteWorkload")
    def to_delete_workload(self) -> "Wellarchitected":
        '''(experimental) Grants permission to delete an existing workload.

        Access Level: Write

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_DeleteWorkload.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toDeleteWorkload", []))

    @jsii.member(jsii_name="toDeleteWorkloadShare")
    def to_delete_workload_share(self) -> "Wellarchitected":
        '''(experimental) Grants permission to delete an existing workload share.

        Access Level: Write

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_DeleteWorkloadShare.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toDeleteWorkloadShare", []))

    @jsii.member(jsii_name="toDisassociateLenses")
    def to_disassociate_lenses(self) -> "Wellarchitected":
        '''(experimental) Grants permission to disassociate a lens from the specified workload.

        Access Level: Write

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_DisassociateLenses.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toDisassociateLenses", []))

    @jsii.member(jsii_name="toGetAnswer")
    def to_get_answer(self) -> "Wellarchitected":
        '''(experimental) Grants permission to retrieve the specified answer from the specified lens review.

        Access Level: Read

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_GetAnswer.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toGetAnswer", []))

    @jsii.member(jsii_name="toGetLensReview")
    def to_get_lens_review(self) -> "Wellarchitected":
        '''(experimental) Grants permission to retrieve the specified lens review of the specified workload.

        Access Level: Read

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_GetLensReview.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toGetLensReview", []))

    @jsii.member(jsii_name="toGetLensReviewReport")
    def to_get_lens_review_report(self) -> "Wellarchitected":
        '''(experimental) Grants permission to retrieve the report for the specified lens review.

        Access Level: Read

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_GetLensReviewReport.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toGetLensReviewReport", []))

    @jsii.member(jsii_name="toGetLensVersionDifference")
    def to_get_lens_version_difference(self) -> "Wellarchitected":
        '''(experimental) Grants permission to get the difference between the specified lens version and latest available lens version.

        Access Level: Read

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_GetLensVersionDifference.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toGetLensVersionDifference", []))

    @jsii.member(jsii_name="toGetMilestone")
    def to_get_milestone(self) -> "Wellarchitected":
        '''(experimental) Grants permission to retrieve the specified milestone of the specified workload.

        Access Level: Read

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_GetMilestone.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toGetMilestone", []))

    @jsii.member(jsii_name="toGetWorkload")
    def to_get_workload(self) -> "Wellarchitected":
        '''(experimental) Grants permission to retrieve the specified workload.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_GetWorkload.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toGetWorkload", []))

    @jsii.member(jsii_name="toListAnswers")
    def to_list_answers(self) -> "Wellarchitected":
        '''(experimental) Grants permission to list the answers from the specified lens review.

        Access Level: List

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_ListAnswers.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toListAnswers", []))

    @jsii.member(jsii_name="toListLenses")
    def to_list_lenses(self) -> "Wellarchitected":
        '''(experimental) Grants permission to list the lenses available to this account.

        Access Level: List

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_ListLenses.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toListLenses", []))

    @jsii.member(jsii_name="toListLensReviewImprovements")
    def to_list_lens_review_improvements(self) -> "Wellarchitected":
        '''(experimental) Grants permission to list the improvements of the specified lens review.

        Access Level: List

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_ListLensReviewImprovements.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toListLensReviewImprovements", []))

    @jsii.member(jsii_name="toListLensReviews")
    def to_list_lens_reviews(self) -> "Wellarchitected":
        '''(experimental) Grants permission to list the lens reviews of the specified workload.

        Access Level: List

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_ListLensReviews.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toListLensReviews", []))

    @jsii.member(jsii_name="toListMilestones")
    def to_list_milestones(self) -> "Wellarchitected":
        '''(experimental) Grants permission to list the milestones of the specified workload.

        Access Level: List

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_ListMilestones.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toListMilestones", []))

    @jsii.member(jsii_name="toListNotifications")
    def to_list_notifications(self) -> "Wellarchitected":
        '''(experimental) Grants permission to list notifications related to the account or specified resource.

        Access Level: List

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_ListNotifications.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toListNotifications", []))

    @jsii.member(jsii_name="toListShareInvitations")
    def to_list_share_invitations(self) -> "Wellarchitected":
        '''(experimental) Grants permission to list the workload share invitations of the specified account or user.

        Access Level: List

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_ListShareInvitations.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toListShareInvitations", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Wellarchitected":
        '''(experimental) Grants permission to list tags for a Well-Architected resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListWorkloads")
    def to_list_workloads(self) -> "Wellarchitected":
        '''(experimental) Grants permission to list the workloads in this account.

        Access Level: List

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_ListWorkloads.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toListWorkloads", []))

    @jsii.member(jsii_name="toListWorkloadShares")
    def to_list_workload_shares(self) -> "Wellarchitected":
        '''(experimental) Grants permission to list the workload shares of the specified workload.

        Access Level: List

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_ListWorkloadShares.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toListWorkloadShares", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Wellarchitected":
        '''(experimental) Grants permission to tag a Well-Architected resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Wellarchitected":
        '''(experimental) Grants permission to untag a Well-Architected resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAnswer")
    def to_update_answer(self) -> "Wellarchitected":
        '''(experimental) Grants permission to update properties of the specified answer.

        Access Level: Write

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_UpdateAnswer.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toUpdateAnswer", []))

    @jsii.member(jsii_name="toUpdateLensReview")
    def to_update_lens_review(self) -> "Wellarchitected":
        '''(experimental) Grants permission to update properties of the specified lens review.

        Access Level: Write

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_UpdateLensReview.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toUpdateLensReview", []))

    @jsii.member(jsii_name="toUpdateShareInvitation")
    def to_update_share_invitation(self) -> "Wellarchitected":
        '''(experimental) Grants permission to update status of the specified workload share invitation.

        Access Level: Write

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_UpdateShareInvitation.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toUpdateShareInvitation", []))

    @jsii.member(jsii_name="toUpdateWorkload")
    def to_update_workload(self) -> "Wellarchitected":
        '''(experimental) Grants permission to update properties of the specified workload.

        Access Level: Write

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_UpdateWorkload.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toUpdateWorkload", []))

    @jsii.member(jsii_name="toUpdateWorkloadShare")
    def to_update_workload_share(self) -> "Wellarchitected":
        '''(experimental) Grants permission to update properties of the specified workload.

        Access Level: Write

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_UpdateWorkloadShare.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toUpdateWorkloadShare", []))

    @jsii.member(jsii_name="toUpgradeLensReview")
    def to_upgrade_lens_review(self) -> "Wellarchitected":
        '''(experimental) Grants permission to upgrade the specified lens review to use the latest version of the associated lens.

        Access Level: Write

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_UpgradeLensReview.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toUpgradeLensReview", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Workdocs(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Workdocs",
):
    '''(experimental) Statement provider for service `workdocs <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonworkdocs.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `workdocs <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonworkdocs.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Workdocs, self, [sid])

    @jsii.member(jsii_name="toAbortDocumentVersionUpload")
    def to_abort_document_version_upload(self) -> "Workdocs":
        '''(experimental) Grants permission to abort the upload of the specified document version that was previously initiated by InitiateDocumentVersionUpload.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_AbortDocumentVersionUpload.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toAbortDocumentVersionUpload", []))

    @jsii.member(jsii_name="toActivateUser")
    def to_activate_user(self) -> "Workdocs":
        '''(experimental) Grants permission to activate the specified user. Only active users can access Amazon WorkDocs.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_ActivateUser.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toActivateUser", []))

    @jsii.member(jsii_name="toAddResourcePermissions")
    def to_add_resource_permissions(self) -> "Workdocs":
        '''(experimental) Grants permission to create a set of permissions for the specified folder or document.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_AddResourcePermissions.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toAddResourcePermissions", []))

    @jsii.member(jsii_name="toAddUserToGroup")
    def to_add_user_to_group(self) -> "Workdocs":
        '''(experimental) Grants permission to add a user to a group.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/adminguide/manage_set_admin.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toAddUserToGroup", []))

    @jsii.member(jsii_name="toCheckAlias")
    def to_check_alias(self) -> "Workdocs":
        '''(experimental) Grants permission to check an alias.

        Access Level: Read

        https://docs.aws.amazon.com/workdocs/latest/adminguide/cloud_quick_start.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toCheckAlias", []))

    @jsii.member(jsii_name="toCreateComment")
    def to_create_comment(self) -> "Workdocs":
        '''(experimental) Grants permission to add a new comment to the specified document version.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_CreateComment.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toCreateComment", []))

    @jsii.member(jsii_name="toCreateCustomMetadata")
    def to_create_custom_metadata(self) -> "Workdocs":
        '''(experimental) Grants permission to add one or more custom properties to the specified resource.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_CreateCustomMetadata.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toCreateCustomMetadata", []))

    @jsii.member(jsii_name="toCreateFolder")
    def to_create_folder(self) -> "Workdocs":
        '''(experimental) Grants permission to create a folder with the specified name and parent folder.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_CreateFolder.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toCreateFolder", []))

    @jsii.member(jsii_name="toCreateInstance")
    def to_create_instance(self) -> "Workdocs":
        '''(experimental) Grants permission to create an instance.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/adminguide/getting_started.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toCreateInstance", []))

    @jsii.member(jsii_name="toCreateLabels")
    def to_create_labels(self) -> "Workdocs":
        '''(experimental) Grants permission to add labels to the given resource.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_CreateLabels.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toCreateLabels", []))

    @jsii.member(jsii_name="toCreateNotificationSubscription")
    def to_create_notification_subscription(self) -> "Workdocs":
        '''(experimental) Grants permission to configure WorkDocs to use Amazon SNS notifications.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_CreateNotificationSubscription.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toCreateNotificationSubscription", []))

    @jsii.member(jsii_name="toCreateUser")
    def to_create_user(self) -> "Workdocs":
        '''(experimental) Grants permission to create a user in a Simple AD or Microsoft AD directory.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_CreateUser.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toCreateUser", []))

    @jsii.member(jsii_name="toDeactivateUser")
    def to_deactivate_user(self) -> "Workdocs":
        '''(experimental) Grants permission to deactivate the specified user, which revokes the user's access to Amazon WorkDocs.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_DeactivateUser.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDeactivateUser", []))

    @jsii.member(jsii_name="toDeleteComment")
    def to_delete_comment(self) -> "Workdocs":
        '''(experimental) Grants permission to delete the specified comment from the document version.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_DeleteComment.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDeleteComment", []))

    @jsii.member(jsii_name="toDeleteCustomMetadata")
    def to_delete_custom_metadata(self) -> "Workdocs":
        '''(experimental) Grants permission to delete custom metadata from the specified resource.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_DeleteCustomMetadata.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDeleteCustomMetadata", []))

    @jsii.member(jsii_name="toDeleteDocument")
    def to_delete_document(self) -> "Workdocs":
        '''(experimental) Grants permission to permanently delete the specified document and its associated metadata.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_DeleteDocument.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDeleteDocument", []))

    @jsii.member(jsii_name="toDeleteFolder")
    def to_delete_folder(self) -> "Workdocs":
        '''(experimental) Grants permission to permanently delete the specified folder and its contents.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_DeleteFolder.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDeleteFolder", []))

    @jsii.member(jsii_name="toDeleteFolderContents")
    def to_delete_folder_contents(self) -> "Workdocs":
        '''(experimental) Grants permission to delete the contents of the specified folder.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_DeleteFolderContents.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDeleteFolderContents", []))

    @jsii.member(jsii_name="toDeleteInstance")
    def to_delete_instance(self) -> "Workdocs":
        '''(experimental) Grants permission to delete an instance.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/adminguide/manage-sites.html#delete_site

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDeleteInstance", []))

    @jsii.member(jsii_name="toDeleteLabels")
    def to_delete_labels(self) -> "Workdocs":
        '''(experimental) Grants permission to delete one or more labels from a resource.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_DeleteLabels.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDeleteLabels", []))

    @jsii.member(jsii_name="toDeleteNotificationSubscription")
    def to_delete_notification_subscription(self) -> "Workdocs":
        '''(experimental) Grants permission to delete the specified subscription from the specified organization.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_DeleteNotificationSubscription.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDeleteNotificationSubscription", []))

    @jsii.member(jsii_name="toDeleteUser")
    def to_delete_user(self) -> "Workdocs":
        '''(experimental) Grants permission to delete the specified user from a Simple AD or Microsoft AD directory.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_DeleteUser.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDeleteUser", []))

    @jsii.member(jsii_name="toDeregisterDirectory")
    def to_deregister_directory(self) -> "Workdocs":
        '''(experimental) Grants permission to deregister a directory.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/adminguide/manage-sites.html#delete_site

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDeregisterDirectory", []))

    @jsii.member(jsii_name="toDescribeActivities")
    def to_describe_activities(self) -> "Workdocs":
        '''(experimental) Grants permission to fetch user activities in a specified time period.

        Access Level: List

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_DescribeActivities.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDescribeActivities", []))

    @jsii.member(jsii_name="toDescribeAvailableDirectories")
    def to_describe_available_directories(self) -> "Workdocs":
        '''(experimental) Grants permission to describe available directories.

        Access Level: List

        https://docs.aws.amazon.com/workdocs/latest/adminguide/getting_started.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDescribeAvailableDirectories", []))

    @jsii.member(jsii_name="toDescribeComments")
    def to_describe_comments(self) -> "Workdocs":
        '''(experimental) Grants permission to list all the comments for the specified document version.

        Access Level: List

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_DescribeComments.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDescribeComments", []))

    @jsii.member(jsii_name="toDescribeDocumentVersions")
    def to_describe_document_versions(self) -> "Workdocs":
        '''(experimental) Grants permission to retrieve the document versions for the specified document.

        Access Level: List

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_DescribeDocumentVersions.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDescribeDocumentVersions", []))

    @jsii.member(jsii_name="toDescribeFolderContents")
    def to_describe_folder_contents(self) -> "Workdocs":
        '''(experimental) Grants permission to describe the contents of the specified folder, including its documents and sub-folders.

        Access Level: List

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_DescribeFolderContents.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDescribeFolderContents", []))

    @jsii.member(jsii_name="toDescribeGroups")
    def to_describe_groups(self) -> "Workdocs":
        '''(experimental) Grants permission to describe the user groups.

        Access Level: List

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_DescribeGroups.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDescribeGroups", []))

    @jsii.member(jsii_name="toDescribeInstances")
    def to_describe_instances(self) -> "Workdocs":
        '''(experimental) Grants permission to describe instances.

        Access Level: List

        https://docs.aws.amazon.com/workdocs/latest/adminguide/getting_started.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDescribeInstances", []))

    @jsii.member(jsii_name="toDescribeNotificationSubscriptions")
    def to_describe_notification_subscriptions(self) -> "Workdocs":
        '''(experimental) Grants permission to list the specified notification subscriptions.

        Access Level: List

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_DescribeNotificationSubscriptions.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDescribeNotificationSubscriptions", []))

    @jsii.member(jsii_name="toDescribeResourcePermissions")
    def to_describe_resource_permissions(self) -> "Workdocs":
        '''(experimental) Grants permission to view a description of a specified resource's permissions.

        Access Level: List

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_DescribeResourcePermissions.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDescribeResourcePermissions", []))

    @jsii.member(jsii_name="toDescribeRootFolders")
    def to_describe_root_folders(self) -> "Workdocs":
        '''(experimental) Grants permission to describe the root folders.

        Access Level: List

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_DescribeRootFolders.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDescribeRootFolders", []))

    @jsii.member(jsii_name="toDescribeUsers")
    def to_describe_users(self) -> "Workdocs":
        '''(experimental) Grants permission to view a description of the specified users.

        You can describe all users or filter the results (for example, by status or organization).

        Access Level: List

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_DescribeUsers.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDescribeUsers", []))

    @jsii.member(jsii_name="toDownloadDocumentVersion")
    def to_download_document_version(self) -> "Workdocs":
        '''(experimental) Grants permission to download a specified document version.

        Access Level: Read

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_GetDocumentVersion.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDownloadDocumentVersion", []))

    @jsii.member(jsii_name="toGetCurrentUser")
    def to_get_current_user(self) -> "Workdocs":
        '''(experimental) Grants permission to retrieve the details of the current user.

        Access Level: Read

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_GetCurrentUser.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toGetCurrentUser", []))

    @jsii.member(jsii_name="toGetDocument")
    def to_get_document(self) -> "Workdocs":
        '''(experimental) Grants permission to retrieve the specified document object.

        Access Level: Read

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_GetDocument.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toGetDocument", []))

    @jsii.member(jsii_name="toGetDocumentPath")
    def to_get_document_path(self) -> "Workdocs":
        '''(experimental) Grants permission to retrieve the path information (the hierarchy from the root folder) for the requested document.

        Access Level: Read

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_GetDocumentPath.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toGetDocumentPath", []))

    @jsii.member(jsii_name="toGetDocumentVersion")
    def to_get_document_version(self) -> "Workdocs":
        '''(experimental) Grants permission to retrieve version metadata for the specified document.

        Access Level: Read

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_GetDocumentVersion.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toGetDocumentVersion", []))

    @jsii.member(jsii_name="toGetFolder")
    def to_get_folder(self) -> "Workdocs":
        '''(experimental) Grants permission to retrieve the metadata of the specified folder.

        Access Level: Read

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_GetFolder.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toGetFolder", []))

    @jsii.member(jsii_name="toGetFolderPath")
    def to_get_folder_path(self) -> "Workdocs":
        '''(experimental) Grants permission to retrieve the path information (the hierarchy from the root folder) for the specified folder.

        Access Level: Read

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_GetFolderPath.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toGetFolderPath", []))

    @jsii.member(jsii_name="toGetResources")
    def to_get_resources(self) -> "Workdocs":
        '''(experimental) Grants permission to get a collection of resources.

        Access Level: Read

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_GetResources.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toGetResources", []))

    @jsii.member(jsii_name="toInitiateDocumentVersionUpload")
    def to_initiate_document_version_upload(self) -> "Workdocs":
        '''(experimental) Grants permission to create a new document object and version object.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_InitiateDocumentVersionUpload.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toInitiateDocumentVersionUpload", []))

    @jsii.member(jsii_name="toRegisterDirectory")
    def to_register_directory(self) -> "Workdocs":
        '''(experimental) Grants permission to register a directory.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/adminguide/existing-dir-setup.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toRegisterDirectory", []))

    @jsii.member(jsii_name="toRemoveAllResourcePermissions")
    def to_remove_all_resource_permissions(self) -> "Workdocs":
        '''(experimental) Grants permission to remove all the permissions from the specified resource.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_RemoveAllResourcePermissions.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toRemoveAllResourcePermissions", []))

    @jsii.member(jsii_name="toRemoveResourcePermission")
    def to_remove_resource_permission(self) -> "Workdocs":
        '''(experimental) Grants permission to remove the permission for the specified principal from the specified resource.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_RemoveResourcePermission.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toRemoveResourcePermission", []))

    @jsii.member(jsii_name="toUpdateDocument")
    def to_update_document(self) -> "Workdocs":
        '''(experimental) Grants permission to update the specified attributes of the specified document.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_UpdateDocument.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toUpdateDocument", []))

    @jsii.member(jsii_name="toUpdateDocumentVersion")
    def to_update_document_version(self) -> "Workdocs":
        '''(experimental) Grants permission to change the status of the document version to ACTIVE.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_UpdateDocumentVersion.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toUpdateDocumentVersion", []))

    @jsii.member(jsii_name="toUpdateFolder")
    def to_update_folder(self) -> "Workdocs":
        '''(experimental) Grants permission to update the specified attributes of the specified folder.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_UpdateFolder.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toUpdateFolder", []))

    @jsii.member(jsii_name="toUpdateInstanceAlias")
    def to_update_instance_alias(self) -> "Workdocs":
        '''(experimental) Grants permission to update an instance alias.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/adminguide/getting_started.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toUpdateInstanceAlias", []))

    @jsii.member(jsii_name="toUpdateUser")
    def to_update_user(self) -> "Workdocs":
        '''(experimental) Grants permission to update the specified attributes of the specified user, and grants or revokes administrative privileges to the Amazon WorkDocs site.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_UpdateUser.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toUpdateUser", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Worklink(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Worklink",
):
    '''(experimental) Statement provider for service `worklink <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonworklink.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `worklink <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonworklink.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Worklink, self, [sid])

    @jsii.member(jsii_name="onFleet")
    def on_fleet(
        self,
        fleet_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Worklink":
        '''(experimental) Adds a resource of type fleet to the statement.

        https://docs.aws.amazon.com/worklink/latest/api/API_CreateFleet.html

        :param fleet_name: - Identifier for the fleetName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "onFleet", [fleet_name, account, partition]))

    @jsii.member(jsii_name="toAssociateDomain")
    def to_associate_domain(self) -> "Worklink":
        '''(experimental) Grants permission to associate a domain with an Amazon WorkLink fleet.

        Access Level: Write

        https://docs.aws.amazon.com/worklink/latest/api/API_AssociateDomain.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toAssociateDomain", []))

    @jsii.member(jsii_name="toAssociateWebsiteAuthorizationProvider")
    def to_associate_website_authorization_provider(self) -> "Worklink":
        '''(experimental) Grants permission to associate a website authorization provider with an Amazon WorkLink fleet.

        Access Level: Write

        https://docs.aws.amazon.com/worklink/latest/api/API_AssociateWebsiteAuthorizationProvider.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toAssociateWebsiteAuthorizationProvider", []))

    @jsii.member(jsii_name="toAssociateWebsiteCertificateAuthority")
    def to_associate_website_certificate_authority(self) -> "Worklink":
        '''(experimental) Grants permission to associate a website certificate authority with an Amazon WorkLink fleet.

        Access Level: Write

        https://docs.aws.amazon.com/worklink/latest/api/API_AssociateWebsiteCertificateAuthority.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toAssociateWebsiteCertificateAuthority", []))

    @jsii.member(jsii_name="toCreateFleet")
    def to_create_fleet(self) -> "Worklink":
        '''(experimental) Grants permission to create an Amazon WorkLink fleet.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/worklink/latest/api/API_CreateFleet.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toCreateFleet", []))

    @jsii.member(jsii_name="toDeleteFleet")
    def to_delete_fleet(self) -> "Worklink":
        '''(experimental) Grants permission to delete an Amazon WorkLink fleet.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/worklink/latest/api/API_DeleteFleet.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toDeleteFleet", []))

    @jsii.member(jsii_name="toDescribeAuditStreamConfiguration")
    def to_describe_audit_stream_configuration(self) -> "Worklink":
        '''(experimental) Grants permission to describe the audit stream configuration for an Amazon WorkLink fleet.

        Access Level: Read

        https://docs.aws.amazon.com/worklink/latest/api/API_DescribeAuditStreamConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toDescribeAuditStreamConfiguration", []))

    @jsii.member(jsii_name="toDescribeCompanyNetworkConfiguration")
    def to_describe_company_network_configuration(self) -> "Worklink":
        '''(experimental) Grants permission to describe the company network configuration for an Amazon WorkLink fleet.

        Access Level: Read

        https://docs.aws.amazon.com/worklink/latest/api/API_DescribeCompanyNetworkConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toDescribeCompanyNetworkConfiguration", []))

    @jsii.member(jsii_name="toDescribeDevice")
    def to_describe_device(self) -> "Worklink":
        '''(experimental) Grants permission to describe details of a device associated with an Amazon WorkLink fleet.

        Access Level: Read

        https://docs.aws.amazon.com/worklink/latest/api/API_DescribeDevice.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toDescribeDevice", []))

    @jsii.member(jsii_name="toDescribeDevicePolicyConfiguration")
    def to_describe_device_policy_configuration(self) -> "Worklink":
        '''(experimental) Grants permission to describe the device policy configuration for an Amazon WorkLink fleet.

        Access Level: Read

        https://docs.aws.amazon.com/worklink/latest/api/API_DescribeDevicePolicyConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toDescribeDevicePolicyConfiguration", []))

    @jsii.member(jsii_name="toDescribeDomain")
    def to_describe_domain(self) -> "Worklink":
        '''(experimental) Grants permission to describe details about a domain associated with an Amazon WorkLink fleet.

        Access Level: Read

        https://docs.aws.amazon.com/worklink/latest/api/API_DescribeDomain.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toDescribeDomain", []))

    @jsii.member(jsii_name="toDescribeFleetMetadata")
    def to_describe_fleet_metadata(self) -> "Worklink":
        '''(experimental) Grants permission to describe metadata of an Amazon WorkLink fleet.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/worklink/latest/api/API_DescribeFleetMetadata.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toDescribeFleetMetadata", []))

    @jsii.member(jsii_name="toDescribeIdentityProviderConfiguration")
    def to_describe_identity_provider_configuration(self) -> "Worklink":
        '''(experimental) Grants permission to describe the identity provider configuration for an Amazon WorkLink fleet.

        Access Level: Read

        https://docs.aws.amazon.com/worklink/latest/api/API_DescribeIdentityProviderConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toDescribeIdentityProviderConfiguration", []))

    @jsii.member(jsii_name="toDescribeWebsiteCertificateAuthority")
    def to_describe_website_certificate_authority(self) -> "Worklink":
        '''(experimental) Grants permission to describe a website certificate authority associated with an Amazon WorkLink fleet.

        Access Level: Read

        https://docs.aws.amazon.com/worklink/latest/api/API_DescribeWebsiteCertificateAuthority.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toDescribeWebsiteCertificateAuthority", []))

    @jsii.member(jsii_name="toDisassociateDomain")
    def to_disassociate_domain(self) -> "Worklink":
        '''(experimental) Grants permission to disassociate a domain from an Amazon WorkLink fleet.

        Access Level: Write

        https://docs.aws.amazon.com/worklink/latest/api/API_DisassociateDomain.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toDisassociateDomain", []))

    @jsii.member(jsii_name="toDisassociateWebsiteAuthorizationProvider")
    def to_disassociate_website_authorization_provider(self) -> "Worklink":
        '''(experimental) Grants permission to disassociate a website authorization provider from an Amazon WorkLink fleet.

        Access Level: Write

        https://docs.aws.amazon.com/worklink/latest/api/API_DisassociateWebsiteAuthorizationProvider.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toDisassociateWebsiteAuthorizationProvider", []))

    @jsii.member(jsii_name="toDisassociateWebsiteCertificateAuthority")
    def to_disassociate_website_certificate_authority(self) -> "Worklink":
        '''(experimental) Grants permission to disassociate a website certificate authority from an Amazon WorkLink fleet.

        Access Level: Write

        https://docs.aws.amazon.com/worklink/latest/api/API_DisassociateWebsiteCertificateAuthority.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toDisassociateWebsiteCertificateAuthority", []))

    @jsii.member(jsii_name="toListDevices")
    def to_list_devices(self) -> "Worklink":
        '''(experimental) Grants permission to list the devices associated with an Amazon WorkLink fleet.

        Access Level: List

        https://docs.aws.amazon.com/worklink/latest/api/API_ListDevices.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toListDevices", []))

    @jsii.member(jsii_name="toListDomains")
    def to_list_domains(self) -> "Worklink":
        '''(experimental) Grants permission to list the associated domains for an Amazon WorkLink fleet.

        Access Level: List

        https://docs.aws.amazon.com/worklink/latest/api/API_ListDomains.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toListDomains", []))

    @jsii.member(jsii_name="toListFleets")
    def to_list_fleets(self) -> "Worklink":
        '''(experimental) Grants permission to list the Amazon WorkLink fleets associated with the account.

        Access Level: List

        https://docs.aws.amazon.com/worklink/latest/api/API_ListFleets.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toListFleets", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Worklink":
        '''(experimental) Grants permission to list tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/worklink/latest/api/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListWebsiteAuthorizationProviders")
    def to_list_website_authorization_providers(self) -> "Worklink":
        '''(experimental) Grants permission to list the website authorization providers for an Amazon WorkLink fleet.

        Access Level: List

        https://docs.aws.amazon.com/worklink/latest/api/API_ListWebsiteAuthorizationProviders.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toListWebsiteAuthorizationProviders", []))

    @jsii.member(jsii_name="toListWebsiteCertificateAuthorities")
    def to_list_website_certificate_authorities(self) -> "Worklink":
        '''(experimental) Grants permission to list the website certificate authorities associated with an Amazon WorkLink fleet.

        Access Level: List

        https://docs.aws.amazon.com/worklink/latest/api/API_ListWebsiteCertificateAuthorities.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toListWebsiteCertificateAuthorities", []))

    @jsii.member(jsii_name="toRestoreDomainAccess")
    def to_restore_domain_access(self) -> "Worklink":
        '''(experimental) Grants permission to restore access to a domain associated with an Amazon WorkLink fleet.

        Access Level: Write

        https://docs.aws.amazon.com/worklink/latest/api/API_RestoreDomainAccess.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toRestoreDomainAccess", []))

    @jsii.member(jsii_name="toRevokeDomainAccess")
    def to_revoke_domain_access(self) -> "Worklink":
        '''(experimental) Grants permission to revoke access to a domain associated with an Amazon WorkLink fleet.

        Access Level: Write

        https://docs.aws.amazon.com/worklink/latest/api/API_RevokeDomainAccess.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toRevokeDomainAccess", []))

    @jsii.member(jsii_name="toSearchEntity")
    def to_search_entity(self) -> "Worklink":
        '''(experimental) Grants permission to list devices for an Amazon WorkLink fleet.

        Access Level: List

        https://docs.aws.amazon.com/worklink/latest/ag/manage-devices.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toSearchEntity", []))

    @jsii.member(jsii_name="toSignOutUser")
    def to_sign_out_user(self) -> "Worklink":
        '''(experimental) Grants permission to sign out a user from an Amazon WorkLink fleet.

        Access Level: Write

        https://docs.aws.amazon.com/worklink/latest/api/API_SignOutUser.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toSignOutUser", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Worklink":
        '''(experimental) Grants permission to add one or more tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/worklink/latest/api/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Worklink":
        '''(experimental) Grants permission to remove one or more tags from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/worklink/latest/api/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAuditStreamConfiguration")
    def to_update_audit_stream_configuration(self) -> "Worklink":
        '''(experimental) Grants permission to update the audit stream configuration for an Amazon WorkLink fleet.

        Access Level: Write

        https://docs.aws.amazon.com/worklink/latest/api/API_UpdateAuditStreamConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toUpdateAuditStreamConfiguration", []))

    @jsii.member(jsii_name="toUpdateCompanyNetworkConfiguration")
    def to_update_company_network_configuration(self) -> "Worklink":
        '''(experimental) Grants permission to update the company network configuration for an Amazon WorkLink fleet.

        Access Level: Write

        https://docs.aws.amazon.com/worklink/latest/api/API_UpdateCompanyNetworkConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toUpdateCompanyNetworkConfiguration", []))

    @jsii.member(jsii_name="toUpdateDevicePolicyConfiguration")
    def to_update_device_policy_configuration(self) -> "Worklink":
        '''(experimental) Grants permission to update the device policy configuration for an Amazon WorkLink fleet.

        Access Level: Write

        https://docs.aws.amazon.com/worklink/latest/api/API_UpdateDevicePolicyConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toUpdateDevicePolicyConfiguration", []))

    @jsii.member(jsii_name="toUpdateDomainMetadata")
    def to_update_domain_metadata(self) -> "Worklink":
        '''(experimental) Grants permission to update the metadata for a domain associated with an Amazon WorkLink fleet.

        Access Level: Write

        https://docs.aws.amazon.com/worklink/latest/api/API_UpdateDomainMetadata.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toUpdateDomainMetadata", []))

    @jsii.member(jsii_name="toUpdateFleetMetadata")
    def to_update_fleet_metadata(self) -> "Worklink":
        '''(experimental) Grants permission to update the metadata of an Amazon WorkLink fleet.

        Access Level: Write

        https://docs.aws.amazon.com/worklink/latest/api/API_UpdateFleetMetadata.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toUpdateFleetMetadata", []))

    @jsii.member(jsii_name="toUpdateIdentityProviderConfiguration")
    def to_update_identity_provider_configuration(self) -> "Worklink":
        '''(experimental) Grants permission to update the identity provider configuration for an Amazon WorkLink fleet.

        Access Level: Write

        https://docs.aws.amazon.com/worklink/latest/api/API_UpdateIdentityProviderConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toUpdateIdentityProviderConfiguration", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Workmail(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Workmail",
):
    '''(experimental) Statement provider for service `workmail <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonworkmail.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `workmail <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonworkmail.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Workmail, self, [sid])

    @jsii.member(jsii_name="onOrganization")
    def on_organization(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Workmail":
        '''(experimental) Adds a resource of type organization to the statement.

        https://docs.aws.amazon.com/workmail/latest/adminguide/organizations_overview.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "onOrganization", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toAddMembersToGroup")
    def to_add_members_to_group(self) -> "Workmail":
        '''(experimental) Adds a list of members (users or groups) to a group.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/groups_overview.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toAddMembersToGroup", []))

    @jsii.member(jsii_name="toAssociateDelegateToResource")
    def to_associate_delegate_to_resource(self) -> "Workmail":
        '''(experimental) Adds a member (user or group) to the resource's set of delegates.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_AssociateDelegateToResource.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toAssociateDelegateToResource", []))

    @jsii.member(jsii_name="toAssociateMemberToGroup")
    def to_associate_member_to_group(self) -> "Workmail":
        '''(experimental) Adds a member (user or group) to the group's set.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_AssociateMemberToGroup.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toAssociateMemberToGroup", []))

    @jsii.member(jsii_name="toCancelMailboxExportJob")
    def to_cancel_mailbox_export_job(self) -> "Workmail":
        '''(experimental) Cancels a currently running mailbox export job.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_CancelMailboxExportJob.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toCancelMailboxExportJob", []))

    @jsii.member(jsii_name="toCreateAlias")
    def to_create_alias(self) -> "Workmail":
        '''(experimental) Adds an alias to the set of a given member (user or group) of WorkMail.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_CreateAlias.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toCreateAlias", []))

    @jsii.member(jsii_name="toCreateGroup")
    def to_create_group(self) -> "Workmail":
        '''(experimental) Creates a group that can be used in WorkMail by calling the RegisterToWorkMail operation.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_CreateGroup.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toCreateGroup", []))

    @jsii.member(jsii_name="toCreateInboundMailFlowRule")
    def to_create_inbound_mail_flow_rule(self) -> "Workmail":
        '''(experimental) Create an inbound email flow rule which will apply to all email sent to an organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/create-email-rules.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toCreateInboundMailFlowRule", []))

    @jsii.member(jsii_name="toCreateMailDomain")
    def to_create_mail_domain(self) -> "Workmail":
        '''(experimental) Creates a mail domain.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/add_domain.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toCreateMailDomain", []))

    @jsii.member(jsii_name="toCreateMailUser")
    def to_create_mail_user(self) -> "Workmail":
        '''(experimental) Creates a user in the directory and the WorkMail storage but does not enable the user for mail.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/manage-users.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toCreateMailUser", []))

    @jsii.member(jsii_name="toCreateOrganization")
    def to_create_organization(self) -> "Workmail":
        '''(experimental) Creates a new Amazon WorkMail organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_CreateOrganization.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toCreateOrganization", []))

    @jsii.member(jsii_name="toCreateOutboundMailFlowRule")
    def to_create_outbound_mail_flow_rule(self) -> "Workmail":
        '''(experimental) Create an outbound email flow rule which will apply to all email sent from an organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/create-email-rules.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toCreateOutboundMailFlowRule", []))

    @jsii.member(jsii_name="toCreateResource")
    def to_create_resource(self) -> "Workmail":
        '''(experimental) Creates a new WorkMail resource.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_CreateResource.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toCreateResource", []))

    @jsii.member(jsii_name="toCreateSmtpGateway")
    def to_create_smtp_gateway(self) -> "Workmail":
        '''(experimental) Register an SMTP device against a WorkMail organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/smtp-gateway.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toCreateSmtpGateway", []))

    @jsii.member(jsii_name="toCreateUser")
    def to_create_user(self) -> "Workmail":
        '''(experimental) Creates a user who can be used in WorkMail by calling the RegisterToWorkMail operation.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_CreateUser.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toCreateUser", []))

    @jsii.member(jsii_name="toDeleteAccessControlRule")
    def to_delete_access_control_rule(self) -> "Workmail":
        '''(experimental) Deletes an access control rule for the specified WorkMail organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeleteAccessControlRule.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDeleteAccessControlRule", []))

    @jsii.member(jsii_name="toDeleteAlias")
    def to_delete_alias(self) -> "Workmail":
        '''(experimental) Remove one or more specified aliases from a set of aliases for a given user.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeleteAlias.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDeleteAlias", []))

    @jsii.member(jsii_name="toDeleteGroup")
    def to_delete_group(self) -> "Workmail":
        '''(experimental) Deletes a group from WorkMail.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeleteGroup.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDeleteGroup", []))

    @jsii.member(jsii_name="toDeleteInboundMailFlowRule")
    def to_delete_inbound_mail_flow_rule(self) -> "Workmail":
        '''(experimental) Remove an inbound email flow rule to no longer apply to emails sent to an organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/remove-email-flow-rule.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDeleteInboundMailFlowRule", []))

    @jsii.member(jsii_name="toDeleteMailboxPermissions")
    def to_delete_mailbox_permissions(self) -> "Workmail":
        '''(experimental) Deletes permissions granted to a member (user or group).

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeleteMailboxPermissions.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDeleteMailboxPermissions", []))

    @jsii.member(jsii_name="toDeleteMailDomain")
    def to_delete_mail_domain(self) -> "Workmail":
        '''(experimental) Removes an unused mail domain from an organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/remove_domain.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDeleteMailDomain", []))

    @jsii.member(jsii_name="toDeleteMobileDevice")
    def to_delete_mobile_device(self) -> "Workmail":
        '''(experimental) Removes a mobile device from a user.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/manage-devices.html#remove_mobile_device

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDeleteMobileDevice", []))

    @jsii.member(jsii_name="toDeleteOrganization")
    def to_delete_organization(self) -> "Workmail":
        '''(experimental) Deletes an Amazon WorkMail organization and all underlying AWS resources managed by Amazon WorkMail as part of the organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeleteOrganization.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDeleteOrganization", []))

    @jsii.member(jsii_name="toDeleteOutboundMailFlowRule")
    def to_delete_outbound_mail_flow_rule(self) -> "Workmail":
        '''(experimental) Remove an outbound email flow rule to no longer apply to emails sent from an organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/remove-email-flow-rule.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDeleteOutboundMailFlowRule", []))

    @jsii.member(jsii_name="toDeleteResource")
    def to_delete_resource(self) -> "Workmail":
        '''(experimental) Deletes the specified resource.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeleteResource.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDeleteResource", []))

    @jsii.member(jsii_name="toDeleteRetentionPolicy")
    def to_delete_retention_policy(self) -> "Workmail":
        '''(experimental) Deletes the retention policy based on the supplied organization and policy identifiers.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeleteRetentionPolicy.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDeleteRetentionPolicy", []))

    @jsii.member(jsii_name="toDeleteSmtpGateway")
    def to_delete_smtp_gateway(self) -> "Workmail":
        '''(experimental) Remove an SMTP device from an organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/smtp-gateway.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDeleteSmtpGateway", []))

    @jsii.member(jsii_name="toDeleteUser")
    def to_delete_user(self) -> "Workmail":
        '''(experimental) Deletes a user from WorkMail and all subsequent systems. The action cannot be undone.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeleteUser.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDeleteUser", []))

    @jsii.member(jsii_name="toDeregisterFromWorkMail")
    def to_deregister_from_work_mail(self) -> "Workmail":
        '''(experimental) Mark a user, group, or resource as no longer used in WorkMail.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeregisterFromWorkMail.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDeregisterFromWorkMail", []))

    @jsii.member(jsii_name="toDescribeDirectories")
    def to_describe_directories(self) -> "Workmail":
        '''(experimental) Shows a list of directories available for use in creating an organization.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/adminguide/add_new_organization.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDescribeDirectories", []))

    @jsii.member(jsii_name="toDescribeGroup")
    def to_describe_group(self) -> "Workmail":
        '''(experimental) Returns the data available for the group.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DescribeGroup.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDescribeGroup", []))

    @jsii.member(jsii_name="toDescribeInboundMailFlowRule")
    def to_describe_inbound_mail_flow_rule(self) -> "Workmail":
        '''(experimental) Returns the details of an inbound mail flow rule configured for an organization.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/adminguide/email-flows.html#email-flows-rule-actions

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDescribeInboundMailFlowRule", []))

    @jsii.member(jsii_name="toDescribeKmsKeys")
    def to_describe_kms_keys(self) -> "Workmail":
        '''(experimental) Shows a list of KMS Keys available for use in creating an organization.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/adminguide/add_new_organization.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDescribeKmsKeys", []))

    @jsii.member(jsii_name="toDescribeMailboxExportJob")
    def to_describe_mailbox_export_job(self) -> "Workmail":
        '''(experimental) Retrieve details of a mailbox export job.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DescribeMailboxExportJob.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDescribeMailboxExportJob", []))

    @jsii.member(jsii_name="toDescribeMailDomains")
    def to_describe_mail_domains(self) -> "Workmail":
        '''(experimental) Shows the details of all mail domains associated with the organization.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/adminguide/domains_overview.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDescribeMailDomains", []))

    @jsii.member(jsii_name="toDescribeMailGroups")
    def to_describe_mail_groups(self) -> "Workmail":
        '''(experimental) Shows the details of all groups associated with the organization.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/adminguide/groups_overview.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDescribeMailGroups", []))

    @jsii.member(jsii_name="toDescribeMailUsers")
    def to_describe_mail_users(self) -> "Workmail":
        '''(experimental) Shows the details of all users associated with the orgaization.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/adminguide/users_overview.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDescribeMailUsers", []))

    @jsii.member(jsii_name="toDescribeOrganization")
    def to_describe_organization(self) -> "Workmail":
        '''(experimental) Provides more information regarding a given organization based on its identifier.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DescribeOrganization.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDescribeOrganization", []))

    @jsii.member(jsii_name="toDescribeOrganizations")
    def to_describe_organizations(self) -> "Workmail":
        '''(experimental) Shows a summary of all organizations associated with the account.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/adminguide/organizations_overview.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDescribeOrganizations", []))

    @jsii.member(jsii_name="toDescribeOutboundMailFlowRule")
    def to_describe_outbound_mail_flow_rule(self) -> "Workmail":
        '''(experimental) Returns the details of an outbound mail flow rule configured for an organization.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/adminguide/email-flows.html#email-flows-rule-outbound

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDescribeOutboundMailFlowRule", []))

    @jsii.member(jsii_name="toDescribeResource")
    def to_describe_resource(self) -> "Workmail":
        '''(experimental) Returns the data available for the resource.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DescribeResource.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDescribeResource", []))

    @jsii.member(jsii_name="toDescribeSmtpGateway")
    def to_describe_smtp_gateway(self) -> "Workmail":
        '''(experimental) Returns the details of an SMTP device registered against an organization.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/adminguide/smtp-gateway.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDescribeSmtpGateway", []))

    @jsii.member(jsii_name="toDescribeUser")
    def to_describe_user(self) -> "Workmail":
        '''(experimental) Provides information regarding the user.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DescribeUser.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDescribeUser", []))

    @jsii.member(jsii_name="toDisableMailGroups")
    def to_disable_mail_groups(self) -> "Workmail":
        '''(experimental) Disable a mail group when it is not being used and, to allow it to be deleted.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/remove_group.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDisableMailGroups", []))

    @jsii.member(jsii_name="toDisableMailUsers")
    def to_disable_mail_users(self) -> "Workmail":
        '''(experimental) Disable a user mailbox when it is no longer being used, and to allow it to be deleted.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/manage-mailboxes.html#delete_user_mailbox

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDisableMailUsers", []))

    @jsii.member(jsii_name="toDisassociateDelegateFromResource")
    def to_disassociate_delegate_from_resource(self) -> "Workmail":
        '''(experimental) Removes a member from the resource's set of delegates.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DisassociateDelegateFromResource.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDisassociateDelegateFromResource", []))

    @jsii.member(jsii_name="toDisassociateMemberFromGroup")
    def to_disassociate_member_from_group(self) -> "Workmail":
        '''(experimental) Removes a member from a group.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DisassociateMemberFromGroup.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDisassociateMemberFromGroup", []))

    @jsii.member(jsii_name="toEnableMailDomain")
    def to_enable_mail_domain(self) -> "Workmail":
        '''(experimental) Enable a mail domain in the organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/add_domain.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toEnableMailDomain", []))

    @jsii.member(jsii_name="toEnableMailGroups")
    def to_enable_mail_groups(self) -> "Workmail":
        '''(experimental) Enable a mail group after it has been created to allow it to receive mail.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/enable_existing_group.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toEnableMailGroups", []))

    @jsii.member(jsii_name="toEnableMailUsers")
    def to_enable_mail_users(self) -> "Workmail":
        '''(experimental) Enable a user's mailbox after it has been created to allow it to receive mail.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/manage-users.html#enable_existing_user

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toEnableMailUsers", []))

    @jsii.member(jsii_name="toGetAccessControlEffect")
    def to_get_access_control_effect(self) -> "Workmail":
        '''(experimental) Gets the effects of an organization's access control rules as they apply to a specified IPv4 address, access protocol action, or user ID.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_GetAccessControlEffect.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toGetAccessControlEffect", []))

    @jsii.member(jsii_name="toGetDefaultRetentionPolicy")
    def to_get_default_retention_policy(self) -> "Workmail":
        '''(experimental) Retrieves the retention policy associated at an organizational level.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_GetDefaultRetentionPolicy.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toGetDefaultRetentionPolicy", []))

    @jsii.member(jsii_name="toGetJournalingRules")
    def to_get_journaling_rules(self) -> "Workmail":
        '''(experimental) Returns journaling and fallback email addresses configured for email journaling.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/adminguide/journaling_overview.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toGetJournalingRules", []))

    @jsii.member(jsii_name="toGetMailboxDetails")
    def to_get_mailbox_details(self) -> "Workmail":
        '''(experimental) Returns the details of the user's mailbox.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_GetMailboxDetails.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toGetMailboxDetails", []))

    @jsii.member(jsii_name="toGetMailDomainDetails")
    def to_get_mail_domain_details(self) -> "Workmail":
        '''(experimental) Get the details of the mail domain.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/adminguide/domains_overview.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toGetMailDomainDetails", []))

    @jsii.member(jsii_name="toGetMailGroupDetails")
    def to_get_mail_group_details(self) -> "Workmail":
        '''(experimental) Get the details of the mail group.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/adminguide/groups_overview.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toGetMailGroupDetails", []))

    @jsii.member(jsii_name="toGetMailUserDetails")
    def to_get_mail_user_details(self) -> "Workmail":
        '''(experimental) Get the details of the user's mailbox and account.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/adminguide/users_overview.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toGetMailUserDetails", []))

    @jsii.member(jsii_name="toGetMobileDeviceDetails")
    def to_get_mobile_device_details(self) -> "Workmail":
        '''(experimental) Get the details of the mobile device.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/adminguide/manage-devices.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toGetMobileDeviceDetails", []))

    @jsii.member(jsii_name="toGetMobileDevicesForUser")
    def to_get_mobile_devices_for_user(self) -> "Workmail":
        '''(experimental) Get a list of the mobile devices associated with the user.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/adminguide/manage-devices.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toGetMobileDevicesForUser", []))

    @jsii.member(jsii_name="toGetMobilePolicyDetails")
    def to_get_mobile_policy_details(self) -> "Workmail":
        '''(experimental) Get the details of the mobile device policy associated with the organization.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/adminguide/edit_organization_mobile_policy.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toGetMobilePolicyDetails", []))

    @jsii.member(jsii_name="toListAccessControlRules")
    def to_list_access_control_rules(self) -> "Workmail":
        '''(experimental) Lists the access control rules for the specified organization.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListAccessControlRules.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toListAccessControlRules", []))

    @jsii.member(jsii_name="toListAliases")
    def to_list_aliases(self) -> "Workmail":
        '''(experimental) Creates a paginated call to list the aliases associated with a given entity.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListAliases.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toListAliases", []))

    @jsii.member(jsii_name="toListGroupMembers")
    def to_list_group_members(self) -> "Workmail":
        '''(experimental) Returns an overview of the members of a group. Users and groups can be members of a group.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListGroupMembers.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toListGroupMembers", []))

    @jsii.member(jsii_name="toListGroups")
    def to_list_groups(self) -> "Workmail":
        '''(experimental) Returns summaries of the organization's groups.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListGroups.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toListGroups", []))

    @jsii.member(jsii_name="toListInboundMailFlowRules")
    def to_list_inbound_mail_flow_rules(self) -> "Workmail":
        '''(experimental) Returns a list of inbound mail flow rules configured for an organization.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/adminguide/email-flows.html#email-flows-rule-actions

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toListInboundMailFlowRules", []))

    @jsii.member(jsii_name="toListMailboxExportJobs")
    def to_list_mailbox_export_jobs(self) -> "Workmail":
        '''(experimental) List mailbox export jobs.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListMailboxExportJobs.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toListMailboxExportJobs", []))

    @jsii.member(jsii_name="toListMailboxPermissions")
    def to_list_mailbox_permissions(self) -> "Workmail":
        '''(experimental) Lists the mailbox permissions associated with a user, group, or resource mailbox.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListMailboxPermissions.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toListMailboxPermissions", []))

    @jsii.member(jsii_name="toListMembersInMailGroup")
    def to_list_members_in_mail_group(self) -> "Workmail":
        '''(experimental) Get a list of all the members in a mail group.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/adminguide/groups_overview.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toListMembersInMailGroup", []))

    @jsii.member(jsii_name="toListOrganizations")
    def to_list_organizations(self) -> "Workmail":
        '''(experimental) Returns summaries of the customer's non-deleted organizations.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListOrganizations.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toListOrganizations", []))

    @jsii.member(jsii_name="toListOutboundMailFlowRules")
    def to_list_outbound_mail_flow_rules(self) -> "Workmail":
        '''(experimental) Returns a list of outbound mail flow rules configured for an organization.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/adminguide/email-flows.html#email-flows-rule-outbound

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toListOutboundMailFlowRules", []))

    @jsii.member(jsii_name="toListResourceDelegates")
    def to_list_resource_delegates(self) -> "Workmail":
        '''(experimental) Lists the delegates associated with a resource.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListResourceDelegates.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toListResourceDelegates", []))

    @jsii.member(jsii_name="toListResources")
    def to_list_resources(self) -> "Workmail":
        '''(experimental) Returns summaries of the organization's resources.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListResources.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toListResources", []))

    @jsii.member(jsii_name="toListSmtpGateways")
    def to_list_smtp_gateways(self) -> "Workmail":
        '''(experimental) Returns a list of SMTP devices registered against the organization.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/adminguide/smtp-gateway.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toListSmtpGateways", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Workmail":
        '''(experimental) Grants permission to list the tags applied to an Amazon WorkMail organization resource.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListUsers")
    def to_list_users(self) -> "Workmail":
        '''(experimental) Returns summaries of the organization's users.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListUsers.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toListUsers", []))

    @jsii.member(jsii_name="toPutAccessControlRule")
    def to_put_access_control_rule(self) -> "Workmail":
        '''(experimental) Adds a new access control rule for the specified organization.

        The rule allows or denies access to the organization for the specified IPv4 addresses, access protocol actions, and user IDs. Adding a new rule with the same name as an existing rule replaces the older rule.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_PutAccessControlRule.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toPutAccessControlRule", []))

    @jsii.member(jsii_name="toPutMailboxPermissions")
    def to_put_mailbox_permissions(self) -> "Workmail":
        '''(experimental) Sets permissions for a user, group, or resource. This replaces any pre-existing permissions.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_PutMailboxPermissions.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toPutMailboxPermissions", []))

    @jsii.member(jsii_name="toPutRetentionPolicy")
    def to_put_retention_policy(self) -> "Workmail":
        '''(experimental) Adds or updates the retention policy for the specified organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_PutRetentionPolicy.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toPutRetentionPolicy", []))

    @jsii.member(jsii_name="toRegisterToWorkMail")
    def to_register_to_work_mail(self) -> "Workmail":
        '''(experimental) Registers an existing and disabled user, group, or resource for use by associating a mailbox and calendaring capabilities.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_RegisterToWorkMail.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toRegisterToWorkMail", []))

    @jsii.member(jsii_name="toRemoveMembersFromGroup")
    def to_remove_members_from_group(self) -> "Workmail":
        '''(experimental) Remove members from a mail group.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/groups_overview.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toRemoveMembersFromGroup", []))

    @jsii.member(jsii_name="toResetPassword")
    def to_reset_password(self) -> "Workmail":
        '''(experimental) Allows the administrator to reset the password for a user.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_ResetPassword.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toResetPassword", []))

    @jsii.member(jsii_name="toResetUserPassword")
    def to_reset_user_password(self) -> "Workmail":
        '''(experimental) Reset the password for a user's account.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/manage-users.html#reset_user_password

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toResetUserPassword", []))

    @jsii.member(jsii_name="toSearchMembers")
    def to_search_members(self) -> "Workmail":
        '''(experimental) Prefix search to find a specific user in a mail group.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/adminguide/groups_overview.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toSearchMembers", []))

    @jsii.member(jsii_name="toSetAdmin")
    def to_set_admin(self) -> "Workmail":
        '''(experimental) Mark a user as being an administrator.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/users_overview.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toSetAdmin", []))

    @jsii.member(jsii_name="toSetDefaultMailDomain")
    def to_set_default_mail_domain(self) -> "Workmail":
        '''(experimental) Set the default mail domain for the organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/default_domain.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toSetDefaultMailDomain", []))

    @jsii.member(jsii_name="toSetJournalingRules")
    def to_set_journaling_rules(self) -> "Workmail":
        '''(experimental) Set journaling and fallback email addresses for email journaling.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/journaling_overview.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toSetJournalingRules", []))

    @jsii.member(jsii_name="toSetMailGroupDetails")
    def to_set_mail_group_details(self) -> "Workmail":
        '''(experimental) Set the details of the mail group which has just been created.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/add_new_group.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toSetMailGroupDetails", []))

    @jsii.member(jsii_name="toSetMailUserDetails")
    def to_set_mail_user_details(self) -> "Workmail":
        '''(experimental) Set the details for the user account which has just been created.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/manage-users.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toSetMailUserDetails", []))

    @jsii.member(jsii_name="toSetMobilePolicyDetails")
    def to_set_mobile_policy_details(self) -> "Workmail":
        '''(experimental) Set the details of a mobile policy associated with the organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/edit_organization_mobile_policy.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toSetMobilePolicyDetails", []))

    @jsii.member(jsii_name="toStartMailboxExportJob")
    def to_start_mailbox_export_job(self) -> "Workmail":
        '''(experimental) Start a new mailbox export job.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_StartMailboxExportJob.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toStartMailboxExportJob", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Workmail":
        '''(experimental) Grants permission to tag the specified Amazon WorkMail organization resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTestInboundMailFlowRules")
    def to_test_inbound_mail_flow_rules(self) -> "Workmail":
        '''(experimental) Test what inbound rules will apply to an email with a given sender and recipient.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/test-email-flow-rule.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toTestInboundMailFlowRules", []))

    @jsii.member(jsii_name="toTestOutboundMailFlowRules")
    def to_test_outbound_mail_flow_rules(self) -> "Workmail":
        '''(experimental) Test what outbound rules will apply to an email with a given sender and recipient.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/test-email-flow-rule.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toTestOutboundMailFlowRules", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Workmail":
        '''(experimental) Grants permission to untag the specified Amazon WorkMail organization resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateInboundMailFlowRule")
    def to_update_inbound_mail_flow_rule(self) -> "Workmail":
        '''(experimental) Update the details of an inbound email flow rule which will apply to all email sent to an organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/modify-email-flow-rule.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toUpdateInboundMailFlowRule", []))

    @jsii.member(jsii_name="toUpdateMailboxQuota")
    def to_update_mailbox_quota(self) -> "Workmail":
        '''(experimental) Updates the maximum size (in MB) of the user's mailbox.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_UpdateMailboxQuota.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toUpdateMailboxQuota", []))

    @jsii.member(jsii_name="toUpdateOutboundMailFlowRule")
    def to_update_outbound_mail_flow_rule(self) -> "Workmail":
        '''(experimental) Update the details of an outbound email flow rule which will apply to all email sent from an organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/modify-email-flow-rule.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toUpdateOutboundMailFlowRule", []))

    @jsii.member(jsii_name="toUpdatePrimaryEmailAddress")
    def to_update_primary_email_address(self) -> "Workmail":
        '''(experimental) Updates the primary email for a user, group, or resource.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_UpdatePrimaryEmailAddress.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toUpdatePrimaryEmailAddress", []))

    @jsii.member(jsii_name="toUpdateResource")
    def to_update_resource(self) -> "Workmail":
        '''(experimental) Updates data for the resource. To retrieve the latest information, it must be preceded by a DescribeResource call.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_UpdateResource.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toUpdateResource", []))

    @jsii.member(jsii_name="toUpdateSmtpGateway")
    def to_update_smtp_gateway(self) -> "Workmail":
        '''(experimental) Update the details of an existing SMTP device registered against an organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/smtp-gateway.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toUpdateSmtpGateway", []))

    @jsii.member(jsii_name="toWipeMobileDevice")
    def to_wipe_mobile_device(self) -> "Workmail":
        '''(experimental) Remotely wipe the mobile device associated with a user's account.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/manage-devices.html#remote_wipe_device

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toWipeMobileDevice", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Workmailmessageflow(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Workmailmessageflow",
):
    '''(experimental) Statement provider for service `workmailmessageflow <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonworkmailmessageflow.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `workmailmessageflow <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonworkmailmessageflow.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Workmailmessageflow, self, [sid])

    @jsii.member(jsii_name="onRawMessage")
    def on_raw_message(
        self,
        organization_id: builtins.str,
        context: builtins.str,
        message_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Workmailmessageflow":
        '''(experimental) Adds a resource of type RawMessage to the statement.

        https://docs.aws.amazon.com/workmail/latest/adminguide/lambda-content.html

        :param organization_id: - Identifier for the organizationId.
        :param context: - Identifier for the context.
        :param message_id: - Identifier for the messageId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Workmailmessageflow", jsii.invoke(self, "onRawMessage", [organization_id, context, message_id, account, region, partition]))

    @jsii.member(jsii_name="toGetRawMessageContent")
    def to_get_raw_message_content(self) -> "Workmailmessageflow":
        '''(experimental) Grants permission to read the content of email messages with the specified message ID.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_messageflow_GetRawMessageContent.html

        :stability: experimental
        '''
        return typing.cast("Workmailmessageflow", jsii.invoke(self, "toGetRawMessageContent", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Workspaces(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Workspaces",
):
    '''(experimental) Statement provider for service `workspaces <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonworkspaces.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `workspaces <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonworkspaces.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Workspaces, self, [sid])

    @jsii.member(jsii_name="onDirectoryid")
    def on_directoryid(
        self,
        directory_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Workspaces":
        '''(experimental) Adds a resource of type directoryid to the statement.

        https://docs.aws.amazon.com/workspaces/latest/adminguide/manage-workspaces-directory.html

        :param directory_id: - Identifier for the directoryId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "onDirectoryid", [directory_id, account, region, partition]))

    @jsii.member(jsii_name="onWorkspacebundle")
    def on_workspacebundle(
        self,
        bundle_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Workspaces":
        '''(experimental) Adds a resource of type workspacebundle to the statement.

        https://docs.aws.amazon.com/workspaces/latest/adminguide/bundles.html

        :param bundle_id: - Identifier for the bundleId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "onWorkspacebundle", [bundle_id, account, region, partition]))

    @jsii.member(jsii_name="onWorkspaceid")
    def on_workspaceid(
        self,
        workspace_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Workspaces":
        '''(experimental) Adds a resource of type workspaceid to the statement.

        https://docs.aws.amazon.com/workspaces/latest/adminguide/wsp_workspace_management.html

        :param workspace_id: - Identifier for the workspaceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "onWorkspaceid", [workspace_id, account, region, partition]))

    @jsii.member(jsii_name="onWorkspaceipgroup")
    def on_workspaceipgroup(
        self,
        group_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Workspaces":
        '''(experimental) Adds a resource of type workspaceipgroup to the statement.

        https://docs.aws.amazon.com/workspaces/latest/adminguide/amazon-workspaces-ip-access-control-groups.html

        :param group_id: - Identifier for the groupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "onWorkspaceipgroup", [group_id, account, region, partition]))

    @jsii.member(jsii_name="toAssociateIpGroups")
    def to_associate_ip_groups(self) -> "Workspaces":
        '''(experimental) Associates the specified IP access control group with the specified directory.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_AssociateIpGroups.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toAssociateIpGroups", []))

    @jsii.member(jsii_name="toAuthorizeIpRules")
    def to_authorize_ip_rules(self) -> "Workspaces":
        '''(experimental) Adds one or more rules to the specified IP access control group.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_AuthorizeIpRules.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toAuthorizeIpRules", []))

    @jsii.member(jsii_name="toCreateIpGroup")
    def to_create_ip_group(self) -> "Workspaces":
        '''(experimental) Creates an IP access control group.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_CreateIpGroup.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toCreateIpGroup", []))

    @jsii.member(jsii_name="toCreateTags")
    def to_create_tags(self) -> "Workspaces":
        '''(experimental) Creates tags for a WorkSpace.

        Access Level: Tagging

        https://docs.aws.amazon.com/workspaces/latest/api/API_CreateTags.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toCreateTags", []))

    @jsii.member(jsii_name="toCreateWorkspaces")
    def to_create_workspaces(self) -> "Workspaces":
        '''(experimental) Creates one or more WorkSpaces.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_CreateWorkspaces.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toCreateWorkspaces", []))

    @jsii.member(jsii_name="toDeleteIpGroup")
    def to_delete_ip_group(self) -> "Workspaces":
        '''(experimental) Deletes the specified IP access control group.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_DeleteIpGroup.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDeleteIpGroup", []))

    @jsii.member(jsii_name="toDeleteTags")
    def to_delete_tags(self) -> "Workspaces":
        '''(experimental) Deletes tags from a Workspace.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_DeleteTags.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDeleteTags", []))

    @jsii.member(jsii_name="toDeleteWorkspaceImage")
    def to_delete_workspace_image(self) -> "Workspaces":
        '''(experimental) Deletes the specified workspace image.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_DeleteWorkspaceImage.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDeleteWorkspaceImage", []))

    @jsii.member(jsii_name="toDescribeAccount")
    def to_describe_account(self) -> "Workspaces":
        '''(experimental) Retrieves a list that describes the configuration of bring your own license (BYOL) for the specified account.

        Access Level: List

        https://docs.aws.amazon.com/workspaces/latest/api/API_DescribeAccount.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDescribeAccount", []))

    @jsii.member(jsii_name="toDescribeAccountModifications")
    def to_describe_account_modifications(self) -> "Workspaces":
        '''(experimental) Retrieves a list that describes modifications to the configuration of bring your own license (BYOL) for the specified account.

        Access Level: List

        https://docs.aws.amazon.com/workspaces/latest/api/API_DescribeAccountModifications.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDescribeAccountModifications", []))

    @jsii.member(jsii_name="toDescribeClientProperties")
    def to_describe_client_properties(self) -> "Workspaces":
        '''(experimental) Describe client properties about the specified resources.

        Access Level: List

        https://docs.aws.amazon.com/workspaces/latest/api/API_DescribeClientProperties.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDescribeClientProperties", []))

    @jsii.member(jsii_name="toDescribeIpGroups")
    def to_describe_ip_groups(self) -> "Workspaces":
        '''(experimental) Retrieves information about the IP access control groups of your account in the region.

        Access Level: List

        https://docs.aws.amazon.com/workspaces/latest/api/API_DescribeIpGroups.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDescribeIpGroups", []))

    @jsii.member(jsii_name="toDescribeTags")
    def to_describe_tags(self) -> "Workspaces":
        '''(experimental) Describes tags for a WorkSpace.

        Access Level: List

        https://docs.aws.amazon.com/workspaces/latest/api/API_DescribeTags.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDescribeTags", []))

    @jsii.member(jsii_name="toDescribeWorkspaceBundles")
    def to_describe_workspace_bundles(self) -> "Workspaces":
        '''(experimental) Obtains information about the WorkSpace bundles that are available to your account in the specified region.

        Access Level: List

        https://docs.aws.amazon.com/workspaces/latest/api/API_DescribeWorkspaceBundles.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDescribeWorkspaceBundles", []))

    @jsii.member(jsii_name="toDescribeWorkspaceDirectories")
    def to_describe_workspace_directories(self) -> "Workspaces":
        '''(experimental) Retrieves information about the AWS Directory Service directories in the region that are registered with Amazon WorkSpaces and are available to your account.

        Access Level: List

        https://docs.aws.amazon.com/workspaces/latest/api/API_DescribeWorkspaceDirectories.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDescribeWorkspaceDirectories", []))

    @jsii.member(jsii_name="toDescribeWorkspaceImages")
    def to_describe_workspace_images(self) -> "Workspaces":
        '''(experimental) Retrieves a list that describes one or more specified images.

        Access Level: List

        https://docs.aws.amazon.com/workspaces/latest/api/API_DescribeWorkspaceImages.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDescribeWorkspaceImages", []))

    @jsii.member(jsii_name="toDescribeWorkspaces")
    def to_describe_workspaces(self) -> "Workspaces":
        '''(experimental) Obtains information about the specified WorkSpaces.

        Access Level: List

        https://docs.aws.amazon.com/workspaces/latest/api/API_DescribeWorkspaces.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDescribeWorkspaces", []))

    @jsii.member(jsii_name="toDescribeWorkspacesConnectionStatus")
    def to_describe_workspaces_connection_status(self) -> "Workspaces":
        '''(experimental) Describes the connection status of a specified WorkSpace.

        Access Level: Read

        https://docs.aws.amazon.com/workspaces/latest/api/API_DescribeWorkspacesConnectionStatus.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDescribeWorkspacesConnectionStatus", []))

    @jsii.member(jsii_name="toDisassociateIpGroups")
    def to_disassociate_ip_groups(self) -> "Workspaces":
        '''(experimental) Disassociates the specified IP access control group from the specified directory.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_DisassociateIpGroups.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDisassociateIpGroups", []))

    @jsii.member(jsii_name="toImportWorkspaceImage")
    def to_import_workspace_image(self) -> "Workspaces":
        '''(experimental) Import a licensed EC2 image to into Amazon WorkSpaces.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_ImportWorkspaceImage.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toImportWorkspaceImage", []))

    @jsii.member(jsii_name="toListAvailableManagementCidrRanges")
    def to_list_available_management_cidr_ranges(self) -> "Workspaces":
        '''(experimental) List available CIDR ranges for a CIDR range constraint.

        Access Level: List

        https://docs.aws.amazon.com/workspaces/latest/api/API_ListAvailableManagementCidrRanges.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toListAvailableManagementCidrRanges", []))

    @jsii.member(jsii_name="toModifyAccount")
    def to_modify_account(self) -> "Workspaces":
        '''(experimental) Modify the configuration of bring your own license (BYOL) for the specified account.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_ModifyAccount.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toModifyAccount", []))

    @jsii.member(jsii_name="toModifyClientProperties")
    def to_modify_client_properties(self) -> "Workspaces":
        '''(experimental) Modify the client properties of a specified resource.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_ModifyClientProperties.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toModifyClientProperties", []))

    @jsii.member(jsii_name="toModifyWorkspaceProperties")
    def to_modify_workspace_properties(self) -> "Workspaces":
        '''(experimental) Modifies the WorkSpace properties, including the running mode and AutoStop time.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_ModifyWorkspaceProperties.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toModifyWorkspaceProperties", []))

    @jsii.member(jsii_name="toModifyWorkspaceState")
    def to_modify_workspace_state(self) -> "Workspaces":
        '''(experimental) Modify the state of specified WorkSpaces.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_ModifyWorkspaceState.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toModifyWorkspaceState", []))

    @jsii.member(jsii_name="toRebootWorkspaces")
    def to_reboot_workspaces(self) -> "Workspaces":
        '''(experimental) Reboots the specified WorkSpaces.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_RebootWorkspaces.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toRebootWorkspaces", []))

    @jsii.member(jsii_name="toRebuildWorkspaces")
    def to_rebuild_workspaces(self) -> "Workspaces":
        '''(experimental) Rebuilds the specified WorkSpaces.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_RebuildWorkspaces.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toRebuildWorkspaces", []))

    @jsii.member(jsii_name="toRevokeIpRules")
    def to_revoke_ip_rules(self) -> "Workspaces":
        '''(experimental) Removes one or more rules from the specified IP access control group.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_RevokeIpRules.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toRevokeIpRules", []))

    @jsii.member(jsii_name="toStartWorkspaces")
    def to_start_workspaces(self) -> "Workspaces":
        '''(experimental) Starts the specified WorkSpaces.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_StartWorkspaces.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toStartWorkspaces", []))

    @jsii.member(jsii_name="toStopWorkspaces")
    def to_stop_workspaces(self) -> "Workspaces":
        '''(experimental) Stops the specified WorkSpaces.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_StopWorkspaces.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toStopWorkspaces", []))

    @jsii.member(jsii_name="toTerminateWorkspaces")
    def to_terminate_workspaces(self) -> "Workspaces":
        '''(experimental) Terminates the specified WorkSpaces.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_TerminateWorkspaces.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toTerminateWorkspaces", []))

    @jsii.member(jsii_name="toUpdateRulesOfIpGroup")
    def to_update_rules_of_ip_group(self) -> "Workspaces":
        '''(experimental) Replaces the current rules of the specified IP access control group with the specified rules.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_UpdateRulesOfIpGroup.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toUpdateRulesOfIpGroup", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Xray(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Xray"):
    '''(experimental) Statement provider for service `xray <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `xray <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Xray, self, [sid])

    @jsii.member(jsii_name="onGroup")
    def on_group(
        self,
        group_name: builtins.str,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Xray":
        '''(experimental) Adds a resource of type group to the statement.

        https://docs.aws.amazon.com/xray/latest/devguide/xray-concepts.html#xray-concepts-groups

        :param group_name: - Identifier for the groupName.
        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "onGroup", [group_name, id, account, region, partition]))

    @jsii.member(jsii_name="onSamplingRule")
    def on_sampling_rule(
        self,
        sampling_rule_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Xray":
        '''(experimental) Adds a resource of type sampling-rule to the statement.

        https://docs.aws.amazon.com/xray/latest/devguide/xray-concepts.html#xray-concepts-sampling

        :param sampling_rule_name: - Identifier for the samplingRuleName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "onSamplingRule", [sampling_rule_name, account, region, partition]))

    @jsii.member(jsii_name="toBatchGetTraces")
    def to_batch_get_traces(self) -> "Xray":
        '''(experimental) Grants permission to retrieve a list of traces specified by ID.

        Each trace is a collection of segment documents that originates from a single request. Use GetTraceSummaries to get a list of trace IDs

        Access Level: List

        https://docs.aws.amazon.com/xray/latest/api/API_BatchGetTraces.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toBatchGetTraces", []))

    @jsii.member(jsii_name="toCreateGroup")
    def to_create_group(self) -> "Xray":
        '''(experimental) Grants permission to create a group resource with a name and a filter expression.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/xray/latest/api/API_CreateGroup.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toCreateGroup", []))

    @jsii.member(jsii_name="toCreateSamplingRule")
    def to_create_sampling_rule(self) -> "Xray":
        '''(experimental) Grants permission to create a rule to control sampling behavior for instrumented applications.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/xray/latest/api/API_CreateSamplingRule.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toCreateSamplingRule", []))

    @jsii.member(jsii_name="toDeleteGroup")
    def to_delete_group(self) -> "Xray":
        '''(experimental) Grants permission to delete a group resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/xray/latest/api/API_DeleteGroup.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toDeleteGroup", []))

    @jsii.member(jsii_name="toDeleteSamplingRule")
    def to_delete_sampling_rule(self) -> "Xray":
        '''(experimental) Grants permission to delete a sampling rule.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/xray/latest/api/API_DeleteSamplingRule.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toDeleteSamplingRule", []))

    @jsii.member(jsii_name="toGetEncryptionConfig")
    def to_get_encryption_config(self) -> "Xray":
        '''(experimental) Grants permission to retrieve the current encryption configuration for X-Ray data.

        Access Level: Read

        https://docs.aws.amazon.com/xray/latest/api/API_GetEncryptionConfig.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toGetEncryptionConfig", []))

    @jsii.member(jsii_name="toGetGroup")
    def to_get_group(self) -> "Xray":
        '''(experimental) Grants permission to retrieve group resource details.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/xray/latest/api/API_GetGroup.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toGetGroup", []))

    @jsii.member(jsii_name="toGetGroups")
    def to_get_groups(self) -> "Xray":
        '''(experimental) Grants permission to retrieve all active group details.

        Access Level: Read

        https://docs.aws.amazon.com/xray/latest/api/API_GetGroups.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toGetGroups", []))

    @jsii.member(jsii_name="toGetInsight")
    def to_get_insight(self) -> "Xray":
        '''(experimental) Grants permission to retrieve the details of a specific insight.

        Access Level: Read

        https://docs.aws.amazon.com/xray/latest/api/API_GetInsight.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toGetInsight", []))

    @jsii.member(jsii_name="toGetInsightEvents")
    def to_get_insight_events(self) -> "Xray":
        '''(experimental) Grants permission to retrieve the events of a specific insight.

        Access Level: Read

        https://docs.aws.amazon.com/xray/latest/api/API_GetInsightEvents.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toGetInsightEvents", []))

    @jsii.member(jsii_name="toGetInsightImpactGraph")
    def to_get_insight_impact_graph(self) -> "Xray":
        '''(experimental) Grants permission to retrieve the part of the service graph which is impacted for a specific insight.

        Access Level: Read

        https://docs.aws.amazon.com/xray/latest/api/API_GetInsightImpactGraph.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toGetInsightImpactGraph", []))

    @jsii.member(jsii_name="toGetInsightSummaries")
    def to_get_insight_summaries(self) -> "Xray":
        '''(experimental) Grants permission to retrieve the summary of all insights for a group and time range with optional filters.

        Access Level: Read

        https://docs.aws.amazon.com/xray/latest/api/API_GetInsightSummaries.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toGetInsightSummaries", []))

    @jsii.member(jsii_name="toGetSamplingRules")
    def to_get_sampling_rules(self) -> "Xray":
        '''(experimental) Grants permission to retrieve all sampling rules.

        Access Level: Read

        https://docs.aws.amazon.com/xray/latest/api/API_GetSamplingRules.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toGetSamplingRules", []))

    @jsii.member(jsii_name="toGetSamplingStatisticSummaries")
    def to_get_sampling_statistic_summaries(self) -> "Xray":
        '''(experimental) Grants permission to retrieve information about recent sampling results for all sampling rules.

        Access Level: Read

        https://docs.aws.amazon.com/xray/latest/api/API_GetSamplingStatisticSummaries.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toGetSamplingStatisticSummaries", []))

    @jsii.member(jsii_name="toGetSamplingTargets")
    def to_get_sampling_targets(self) -> "Xray":
        '''(experimental) Grants permission to request a sampling quota for rules that the service is using to sample requests.

        Access Level: Read

        https://docs.aws.amazon.com/xray/latest/api/API_GetSamplingTargets.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toGetSamplingTargets", []))

    @jsii.member(jsii_name="toGetServiceGraph")
    def to_get_service_graph(self) -> "Xray":
        '''(experimental) Grants permission to retrieve a document that describes services that process incoming requests, and downstream services that they call as a result.

        Access Level: Read

        https://docs.aws.amazon.com/xray/latest/api/API_GetServiceGraph.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toGetServiceGraph", []))

    @jsii.member(jsii_name="toGetTimeSeriesServiceStatistics")
    def to_get_time_series_service_statistics(self) -> "Xray":
        '''(experimental) Grants permission to retrieve an aggregation of service statistics defined by a specific time range bucketed into time intervals.

        Access Level: Read

        https://docs.aws.amazon.com/xray/latest/api/API_GetTimeSeriesServiceStatistics.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toGetTimeSeriesServiceStatistics", []))

    @jsii.member(jsii_name="toGetTraceGraph")
    def to_get_trace_graph(self) -> "Xray":
        '''(experimental) Grants permission to retrieve a service graph for one or more specific trace IDs.

        Access Level: Read

        https://docs.aws.amazon.com/xray/latest/api/API_GetTraceGraph.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toGetTraceGraph", []))

    @jsii.member(jsii_name="toGetTraceSummaries")
    def to_get_trace_summaries(self) -> "Xray":
        '''(experimental) Grants permission to retrieve IDs and metadata for traces available for a specified time frame using an optional filter.

        To get the full traces, pass the trace IDs to BatchGetTraces

        Access Level: Read

        https://docs.aws.amazon.com/xray/latest/api/API_GetTraceSummaries.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toGetTraceSummaries", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Xray":
        '''(experimental) Grants permission to list tags for an X-Ray resource.

        Access Level: List

        https://docs.aws.amazon.com/xray/latest/api/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutEncryptionConfig")
    def to_put_encryption_config(self) -> "Xray":
        '''(experimental) Grants permission to update the encryption configuration for X-Ray data.

        Access Level: Permissions management

        https://docs.aws.amazon.com/xray/latest/api/API_PutEncryptionConfig.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toPutEncryptionConfig", []))

    @jsii.member(jsii_name="toPutTelemetryRecords")
    def to_put_telemetry_records(self) -> "Xray":
        '''(experimental) Grants permission to send AWS X-Ray daemon telemetry to the service.

        Access Level: Write

        https://docs.aws.amazon.com/xray/latest/api/API_PutTelemetryRecords.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toPutTelemetryRecords", []))

    @jsii.member(jsii_name="toPutTraceSegments")
    def to_put_trace_segments(self) -> "Xray":
        '''(experimental) Grants permission to upload segment documents to AWS X-Ray.

        The X-Ray SDK generates segment documents and sends them to the X-Ray daemon, which uploads them in batches

        Access Level: Write

        https://docs.aws.amazon.com/xray/latest/api/API_PutTraceSegments.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toPutTraceSegments", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Xray":
        '''(experimental) Grants permission to add tags to an X-Ray resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/xray/latest/api/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Xray":
        '''(experimental) Grants permission to remove tags from an X-Ray resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/xray/latest/api/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateGroup")
    def to_update_group(self) -> "Xray":
        '''(experimental) Grants permission to update a group resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/xray/latest/api/API_UpdateGroup.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toUpdateGroup", []))

    @jsii.member(jsii_name="toUpdateSamplingRule")
    def to_update_sampling_rule(self) -> "Xray":
        '''(experimental) Grants permission to modify a sampling rule's configuration.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/xray/latest/api/API_UpdateSamplingRule.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toUpdateSamplingRule", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class A4b(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.A4b"):
    '''(experimental) Statement provider for service `a4b <https://docs.aws.amazon.com/service-authorization/latest/reference/list_alexaforbusiness.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `a4b <https://docs.aws.amazon.com/service-authorization/latest/reference/list_alexaforbusiness.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(A4b, self, [sid])

    @jsii.member(jsii_name="ifAmazonId")
    def if_amazon_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "A4b":
        '''(experimental) Filters actions based on the Amazon Id in the request.

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_RegisterAVSDevice.html

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "ifAmazonId", [value, operator]))

    @jsii.member(jsii_name="ifFiltersDeviceType")
    def if_filters_device_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "A4b":
        '''(experimental) Filters actions based on the device type in the request.

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_SearchDevices.html

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "ifFiltersDeviceType", [value, operator]))

    @jsii.member(jsii_name="onAddressbook")
    def on_addressbook(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "A4b":
        '''(experimental) Adds a resource of type addressbook to the statement.

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_AddressBook.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "onAddressbook", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onConferenceprovider")
    def on_conferenceprovider(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "A4b":
        '''(experimental) Adds a resource of type conferenceprovider to the statement.

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_ConferenceProvider.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "onConferenceprovider", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onContact")
    def on_contact(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "A4b":
        '''(experimental) Adds a resource of type contact to the statement.

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_Contact.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "onContact", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onDevice")
    def on_device(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "A4b":
        '''(experimental) Adds a resource of type device to the statement.

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_Device.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "onDevice", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onNetworkprofile")
    def on_networkprofile(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "A4b":
        '''(experimental) Adds a resource of type networkprofile to the statement.

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_NetworkProfile.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "onNetworkprofile", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onProfile")
    def on_profile(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "A4b":
        '''(experimental) Adds a resource of type profile to the statement.

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_Profile.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "onProfile", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onRoom")
    def on_room(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "A4b":
        '''(experimental) Adds a resource of type room to the statement.

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_Room.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "onRoom", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onSchedule")
    def on_schedule(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "A4b":
        '''(experimental) Adds a resource of type schedule to the statement.

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_BusinessReportSchedule.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "onSchedule", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onSkillgroup")
    def on_skillgroup(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "A4b":
        '''(experimental) Adds a resource of type skillgroup to the statement.

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_SkillGroup.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "onSkillgroup", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onUser")
    def on_user(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "A4b":
        '''(experimental) Adds a resource of type user to the statement.

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_UserData.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "onUser", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toApproveSkill")
    def to_approve_skill(self) -> "A4b":
        '''(experimental) Associates a skill with the organization under the customer's AWS account.

        If a skill is private, the user implicitly accepts access to this skill during enablement.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_ApproveSkill.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toApproveSkill", []))

    @jsii.member(jsii_name="toAssociateContactWithAddressBook")
    def to_associate_contact_with_address_book(self) -> "A4b":
        '''(experimental) Associates a contact with a given address book.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_AssociateContactWithAddressBook.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toAssociateContactWithAddressBook", []))

    @jsii.member(jsii_name="toAssociateDeviceWithRoom")
    def to_associate_device_with_room(self) -> "A4b":
        '''(experimental) Associates device with given room.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_AssociateDeviceWithRoom.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toAssociateDeviceWithRoom", []))

    @jsii.member(jsii_name="toAssociateSkillGroupWithRoom")
    def to_associate_skill_group_with_room(self) -> "A4b":
        '''(experimental) Associates the skill group with given room. SkillGroup ARN and Room ARN must be specified.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_AssociateSkillGroupWithRoom.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toAssociateSkillGroupWithRoom", []))

    @jsii.member(jsii_name="toAssociateSkillWithSkillGroup")
    def to_associate_skill_with_skill_group(self) -> "A4b":
        '''(experimental) Associates a skill with a skill group.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_AssociateSkillWithSkillGroup.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toAssociateSkillWithSkillGroup", []))

    @jsii.member(jsii_name="toAssociateSkillWithUsers")
    def to_associate_skill_with_users(self) -> "A4b":
        '''(experimental) Makes a private skill available for enrolled users to enable on their devices.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_AssociateSkillWithUsers.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toAssociateSkillWithUsers", []))

    @jsii.member(jsii_name="toCompleteRegistration")
    def to_complete_registration(self) -> "A4b":
        '''(experimental) Completes the operation of registering an Alexa device.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/ag/manage-devices.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toCompleteRegistration", []))

    @jsii.member(jsii_name="toCreateAddressBook")
    def to_create_address_book(self) -> "A4b":
        '''(experimental) Creates an address book with the specified details.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_CreateAddressBook.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toCreateAddressBook", []))

    @jsii.member(jsii_name="toCreateBusinessReportSchedule")
    def to_create_business_report_schedule(self) -> "A4b":
        '''(experimental) Creates a recurring schedule for usage reports to deliver to the specified S3 location with a specified daily or weekly interval.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_CreateBusinessReportSchedule.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toCreateBusinessReportSchedule", []))

    @jsii.member(jsii_name="toCreateConferenceProvider")
    def to_create_conference_provider(self) -> "A4b":
        '''(experimental) Adds a new conference provider under the user's AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_CreateConferenceProvider.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toCreateConferenceProvider", []))

    @jsii.member(jsii_name="toCreateContact")
    def to_create_contact(self) -> "A4b":
        '''(experimental) Creates a contact with the specified details.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_CreateContact.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toCreateContact", []))

    @jsii.member(jsii_name="toCreateProfile")
    def to_create_profile(self) -> "A4b":
        '''(experimental) Creates a new profile.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_CreateProfile.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toCreateProfile", []))

    @jsii.member(jsii_name="toCreateRoom")
    def to_create_room(self) -> "A4b":
        '''(experimental) Create room with the specified details.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_CreateRoom.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toCreateRoom", []))

    @jsii.member(jsii_name="toCreateSkillGroup")
    def to_create_skill_group(self) -> "A4b":
        '''(experimental) Creates a skill group with given name and description.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_CreateSkillGroup.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toCreateSkillGroup", []))

    @jsii.member(jsii_name="toCreateUser")
    def to_create_user(self) -> "A4b":
        '''(experimental) Creates a user.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_CreateUser.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toCreateUser", []))

    @jsii.member(jsii_name="toDeleteAddressBook")
    def to_delete_address_book(self) -> "A4b":
        '''(experimental) Deletes an address book by the address book ARN.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_DeleteAddressBook.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toDeleteAddressBook", []))

    @jsii.member(jsii_name="toDeleteBusinessReportSchedule")
    def to_delete_business_report_schedule(self) -> "A4b":
        '''(experimental) Deletes the recurring report delivery schedule with the specified schedule ARN.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_DeleteBusinessReportSchedule.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toDeleteBusinessReportSchedule", []))

    @jsii.member(jsii_name="toDeleteConferenceProvider")
    def to_delete_conference_provider(self) -> "A4b":
        '''(experimental) Deletes a conference provider.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_DeleteConferenceProvider.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toDeleteConferenceProvider", []))

    @jsii.member(jsii_name="toDeleteContact")
    def to_delete_contact(self) -> "A4b":
        '''(experimental) Deletes a contact by the contact ARN.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_DeleteContact.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toDeleteContact", []))

    @jsii.member(jsii_name="toDeleteDevice")
    def to_delete_device(self) -> "A4b":
        '''(experimental) Removes a device from Alexa For Business.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_DeleteDevice.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toDeleteDevice", []))

    @jsii.member(jsii_name="toDeleteProfile")
    def to_delete_profile(self) -> "A4b":
        '''(experimental) Delete profile by profile ARN.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_DeleteProfile.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toDeleteProfile", []))

    @jsii.member(jsii_name="toDeleteRoom")
    def to_delete_room(self) -> "A4b":
        '''(experimental) Delete room.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_DeleteRoom.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toDeleteRoom", []))

    @jsii.member(jsii_name="toDeleteRoomSkillParameter")
    def to_delete_room_skill_parameter(self) -> "A4b":
        '''(experimental) Delete a parameter from a skill and room.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_DeleteRoomSkillParameter.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toDeleteRoomSkillParameter", []))

    @jsii.member(jsii_name="toDeleteSkillAuthorization")
    def to_delete_skill_authorization(self) -> "A4b":
        '''(experimental) Unlinks a third-party account from a skill.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_DeleteSkillAuthorization.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toDeleteSkillAuthorization", []))

    @jsii.member(jsii_name="toDeleteSkillGroup")
    def to_delete_skill_group(self) -> "A4b":
        '''(experimental) Deletes skill group with skill group ARN. Skillgroup ARN must be specified.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_DeleteSkillGroup.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toDeleteSkillGroup", []))

    @jsii.member(jsii_name="toDeleteUser")
    def to_delete_user(self) -> "A4b":
        '''(experimental) Delete a user.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_DeleteUser.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toDeleteUser", []))

    @jsii.member(jsii_name="toDisassociateContactFromAddressBook")
    def to_disassociate_contact_from_address_book(self) -> "A4b":
        '''(experimental) Disassociates a contact from a given address book.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_DisassociateContactFromAddressBook.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toDisassociateContactFromAddressBook", []))

    @jsii.member(jsii_name="toDisassociateDeviceFromRoom")
    def to_disassociate_device_from_room(self) -> "A4b":
        '''(experimental) Disassociates device from its current room.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_DisassociateDeviceFromRoom.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toDisassociateDeviceFromRoom", []))

    @jsii.member(jsii_name="toDisassociateSkillFromSkillGroup")
    def to_disassociate_skill_from_skill_group(self) -> "A4b":
        '''(experimental) Disassociates a skill from a skill group.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_DisassociateSkillFromSkillGroup.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toDisassociateSkillFromSkillGroup", []))

    @jsii.member(jsii_name="toDisassociateSkillFromUsers")
    def to_disassociate_skill_from_users(self) -> "A4b":
        '''(experimental) Makes a private skill unavailable for enrolled users and prevents them from enabling it on their devices.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_DisassociateSkillFromUsers.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toDisassociateSkillFromUsers", []))

    @jsii.member(jsii_name="toDisassociateSkillGroupFromRoom")
    def to_disassociate_skill_group_from_room(self) -> "A4b":
        '''(experimental) Disassociates the skill group from given room. SkillGroup ARN and Room ARN must be specified.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_DisassociateSkillGroupFromRoom.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toDisassociateSkillGroupFromRoom", []))

    @jsii.member(jsii_name="toForgetSmartHomeAppliances")
    def to_forget_smart_home_appliances(self) -> "A4b":
        '''(experimental) Forgets smart home appliances associated to a room.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_ForgetSmartHomeAppliances.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toForgetSmartHomeAppliances", []))

    @jsii.member(jsii_name="toGetAddressBook")
    def to_get_address_book(self) -> "A4b":
        '''(experimental) Gets the address book details by the address book ARN.

        Access Level: Read

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_GetAddressBook.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toGetAddressBook", []))

    @jsii.member(jsii_name="toGetConferencePreference")
    def to_get_conference_preference(self) -> "A4b":
        '''(experimental) Retrieves the existing conference preferences.

        Access Level: Read

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_GetConferencePreference.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toGetConferencePreference", []))

    @jsii.member(jsii_name="toGetConferenceProvider")
    def to_get_conference_provider(self) -> "A4b":
        '''(experimental) Gets details about a specific conference provider.

        Access Level: Read

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_GetConferenceProvider.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toGetConferenceProvider", []))

    @jsii.member(jsii_name="toGetContact")
    def to_get_contact(self) -> "A4b":
        '''(experimental) Gets the contact details by the contact ARN.

        Access Level: Read

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_GetContact.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toGetContact", []))

    @jsii.member(jsii_name="toGetDevice")
    def to_get_device(self) -> "A4b":
        '''(experimental) Get device details.

        Access Level: Read

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_GetDevice.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toGetDevice", []))

    @jsii.member(jsii_name="toGetNetworkProfile")
    def to_get_network_profile(self) -> "A4b":
        '''(experimental) Gets the network profile details by the network profile ARN.

        Access Level: Read

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_GetNetworkProfile.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toGetNetworkProfile", []))

    @jsii.member(jsii_name="toGetProfile")
    def to_get_profile(self) -> "A4b":
        '''(experimental) Gets profile when provided with Profile ARN.

        Access Level: Read

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_GetProfile.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toGetProfile", []))

    @jsii.member(jsii_name="toGetRoom")
    def to_get_room(self) -> "A4b":
        '''(experimental) Get room details.

        Access Level: Read

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_GetRoom.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toGetRoom", []))

    @jsii.member(jsii_name="toGetRoomSkillParameter")
    def to_get_room_skill_parameter(self) -> "A4b":
        '''(experimental) Get an existing parameter that has been set for a skill and room.

        Access Level: Read

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_GetRoomSkillParameter.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toGetRoomSkillParameter", []))

    @jsii.member(jsii_name="toGetSkillGroup")
    def to_get_skill_group(self) -> "A4b":
        '''(experimental) Gets skill group details with skill group ARN. Skillgroup ARN must be specified.

        Access Level: Read

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_GetSkillGroup.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toGetSkillGroup", []))

    @jsii.member(jsii_name="toListBusinessReportSchedules")
    def to_list_business_report_schedules(self) -> "A4b":
        '''(experimental) Lists the details of the schedules that a user configured.

        Access Level: List

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_ListBusinessReportSchedules.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toListBusinessReportSchedules", []))

    @jsii.member(jsii_name="toListConferenceProviders")
    def to_list_conference_providers(self) -> "A4b":
        '''(experimental) Lists conference providers under a specific AWS account.

        Access Level: List

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_ListConferenceProviders.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toListConferenceProviders", []))

    @jsii.member(jsii_name="toListDeviceEvents")
    def to_list_device_events(self) -> "A4b":
        '''(experimental) Lists the device event history, including device connection status, for up to 30 days.

        Access Level: List

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_ListDeviceEvents.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toListDeviceEvents", []))

    @jsii.member(jsii_name="toListSkills")
    def to_list_skills(self) -> "A4b":
        '''(experimental) Lists skills.

        Access Level: List

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_ListSkills.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toListSkills", []))

    @jsii.member(jsii_name="toListSkillsStoreCategories")
    def to_list_skills_store_categories(self) -> "A4b":
        '''(experimental) Lists all categories in the Alexa skill store.

        Access Level: List

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_ListSkillsStoreCategories.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toListSkillsStoreCategories", []))

    @jsii.member(jsii_name="toListSkillsStoreSkillsByCategory")
    def to_list_skills_store_skills_by_category(self) -> "A4b":
        '''(experimental) Lists all skills in the Alexa skill store by category.

        Access Level: List

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_ListSkillsStoreSkillsByCategory.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toListSkillsStoreSkillsByCategory", []))

    @jsii.member(jsii_name="toListSmartHomeAppliances")
    def to_list_smart_home_appliances(self) -> "A4b":
        '''(experimental) Lists all of the smart home appliances associated with a room.

        Access Level: List

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_ListSmartHomeAppliances.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toListSmartHomeAppliances", []))

    @jsii.member(jsii_name="toListTags")
    def to_list_tags(self) -> "A4b":
        '''(experimental) Lists all tags on a resource.

        Access Level: Read

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_ListTags.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toListTags", []))

    @jsii.member(jsii_name="toPutConferencePreference")
    def to_put_conference_preference(self) -> "A4b":
        '''(experimental) Sets the conference preferences on a specific conference provider at the account level.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_PutConferencePreference.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toPutConferencePreference", []))

    @jsii.member(jsii_name="toPutDeviceSetupEvents")
    def to_put_device_setup_events(self) -> "A4b":
        '''(experimental) Publishes Alexa device setup events.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/ag/manage-devices.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toPutDeviceSetupEvents", []))

    @jsii.member(jsii_name="toPutRoomSkillParameter")
    def to_put_room_skill_parameter(self) -> "A4b":
        '''(experimental) Put a room specific parameter for a skill.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_PutRoomSkillParameter.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toPutRoomSkillParameter", []))

    @jsii.member(jsii_name="toPutSkillAuthorization")
    def to_put_skill_authorization(self) -> "A4b":
        '''(experimental) Links a user's account to a third-party skill provider.

        If this API operation is called by an assumed IAM role, the skill being linked must be a private skill. Also, the skill must be owned by the AWS account that assumed the IAM role.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_PutSkillAuthorization.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toPutSkillAuthorization", []))

    @jsii.member(jsii_name="toRegisterAVSDevice")
    def to_register_avs_device(self) -> "A4b":
        '''(experimental) Registers an Alexa-enabled device built by an Original Equipment Manufacturer (OEM) using Alexa Voice Service (AVS).

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_RegisterAVSDevice.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toRegisterAVSDevice", []))

    @jsii.member(jsii_name="toRegisterDevice")
    def to_register_device(self) -> "A4b":
        '''(experimental) Registers an Alexa device.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/ag/manage-devices.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toRegisterDevice", []))

    @jsii.member(jsii_name="toRejectSkill")
    def to_reject_skill(self) -> "A4b":
        '''(experimental) Disassociates a skill from the organization under a user's AWS account.

        If the skill is a private skill, it moves to an AcceptStatus of PENDING.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_RejectSkill.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toRejectSkill", []))

    @jsii.member(jsii_name="toResolveRoom")
    def to_resolve_room(self) -> "A4b":
        '''(experimental) Returns resolved room information.

        Access Level: Read

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_ResolveRoom.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toResolveRoom", []))

    @jsii.member(jsii_name="toRevokeInvitation")
    def to_revoke_invitation(self) -> "A4b":
        '''(experimental) Revoke an invitation.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_RevokeInvitation.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toRevokeInvitation", []))

    @jsii.member(jsii_name="toSearchAddressBooks")
    def to_search_address_books(self) -> "A4b":
        '''(experimental) Searches address books and lists the ones that meet a set of filter and sort criteria.

        Access Level: List

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_SearchAddressBooks.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toSearchAddressBooks", []))

    @jsii.member(jsii_name="toSearchContacts")
    def to_search_contacts(self) -> "A4b":
        '''(experimental) Searches contacts and lists the ones that meet a set of filter and sort criteria.

        Access Level: List

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_SearchContacts.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toSearchContacts", []))

    @jsii.member(jsii_name="toSearchDevices")
    def to_search_devices(self) -> "A4b":
        '''(experimental) Search for devices.

        Access Level: List

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_SearchDevices.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toSearchDevices", []))

    @jsii.member(jsii_name="toSearchNetworkProfiles")
    def to_search_network_profiles(self) -> "A4b":
        '''(experimental) Searches network profiles and lists the ones that meet a set of filter and sort criteria.

        Access Level: List

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_SearchNetworkProfiles.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toSearchNetworkProfiles", []))

    @jsii.member(jsii_name="toSearchProfiles")
    def to_search_profiles(self) -> "A4b":
        '''(experimental) Search for profiles.

        Access Level: List

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_SearchProfiles.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toSearchProfiles", []))

    @jsii.member(jsii_name="toSearchRooms")
    def to_search_rooms(self) -> "A4b":
        '''(experimental) Search for rooms.

        Access Level: List

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_SearchRooms.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toSearchRooms", []))

    @jsii.member(jsii_name="toSearchSkillGroups")
    def to_search_skill_groups(self) -> "A4b":
        '''(experimental) Search for skill groups.

        Access Level: List

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_SearchSkillGroups.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toSearchSkillGroups", []))

    @jsii.member(jsii_name="toSearchUsers")
    def to_search_users(self) -> "A4b":
        '''(experimental) Search for users.

        Access Level: List

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_SearchUsers.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toSearchUsers", []))

    @jsii.member(jsii_name="toSendInvitation")
    def to_send_invitation(self) -> "A4b":
        '''(experimental) Send an invitation to a user.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_SendInvitation.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toSendInvitation", []))

    @jsii.member(jsii_name="toStartDeviceSync")
    def to_start_device_sync(self) -> "A4b":
        '''(experimental) Restore the device and its account to its known, default settings by clearing all information and settings set by its previous users.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_StartDeviceSync.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toStartDeviceSync", []))

    @jsii.member(jsii_name="toStartSmartHomeApplianceDiscovery")
    def to_start_smart_home_appliance_discovery(self) -> "A4b":
        '''(experimental) Initiates the discovery of any smart home appliances associated with the room.

        Access Level: Read

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_StartSmartHomeApplianceDiscovery.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toStartSmartHomeApplianceDiscovery", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "A4b":
        '''(experimental) Adds metadata tags to a resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "A4b":
        '''(experimental) Removes metadata tags from a resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAddressBook")
    def to_update_address_book(self) -> "A4b":
        '''(experimental) Updates address book details by the address book ARN.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_UpdateAddressBook.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toUpdateAddressBook", []))

    @jsii.member(jsii_name="toUpdateBusinessReportSchedule")
    def to_update_business_report_schedule(self) -> "A4b":
        '''(experimental) Updates the configuration of the report delivery schedule with the specified schedule ARN.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_UpdateBusinessReportSchedule.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toUpdateBusinessReportSchedule", []))

    @jsii.member(jsii_name="toUpdateConferenceProvider")
    def to_update_conference_provider(self) -> "A4b":
        '''(experimental) Updates an existing conference provider's settings.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_UpdateConferenceProvider.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toUpdateConferenceProvider", []))

    @jsii.member(jsii_name="toUpdateContact")
    def to_update_contact(self) -> "A4b":
        '''(experimental) Updates the contact details by the contact ARN.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_UpdateContact.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toUpdateContact", []))

    @jsii.member(jsii_name="toUpdateDevice")
    def to_update_device(self) -> "A4b":
        '''(experimental) Updates device name.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_UpdateDevice.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toUpdateDevice", []))

    @jsii.member(jsii_name="toUpdateProfile")
    def to_update_profile(self) -> "A4b":
        '''(experimental) Updates an existing profile.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_UpdateProfile.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toUpdateProfile", []))

    @jsii.member(jsii_name="toUpdateRoom")
    def to_update_room(self) -> "A4b":
        '''(experimental) Update room details.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_UpdateRoom.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toUpdateRoom", []))

    @jsii.member(jsii_name="toUpdateSkillGroup")
    def to_update_skill_group(self) -> "A4b":
        '''(experimental) Updates skill group details with skill group ARN. Skillgroup ARN must be specified.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_UpdateSkillGroup.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toUpdateSkillGroup", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class AccessAnalyzer(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.AccessAnalyzer",
):
    '''(experimental) Statement provider for service `access-analyzer <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiamaccessanalyzer.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `access-analyzer <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiamaccessanalyzer.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(AccessAnalyzer, self, [sid])

    @jsii.member(jsii_name="onAnalyzer")
    def on_analyzer(
        self,
        analyzer_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "AccessAnalyzer":
        '''(experimental) Adds a resource of type Analyzer to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-getting-started.html#permission-resources

        :param analyzer_name: - Identifier for the analyzerName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "onAnalyzer", [analyzer_name, account, region, partition]))

    @jsii.member(jsii_name="onArchiveRule")
    def on_archive_rule(
        self,
        analyzer_name: builtins.str,
        rule_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "AccessAnalyzer":
        '''(experimental) Adds a resource of type ArchiveRule to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-getting-started.html#permission-resources

        :param analyzer_name: - Identifier for the analyzerName.
        :param rule_name: - Identifier for the ruleName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "onArchiveRule", [analyzer_name, rule_name, account, region, partition]))

    @jsii.member(jsii_name="toApplyArchiveRule")
    def to_apply_archive_rule(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to apply an archive rule.

        Access Level: Write

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ApplyArchiveRule.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toApplyArchiveRule", []))

    @jsii.member(jsii_name="toCancelPolicyGeneration")
    def to_cancel_policy_generation(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to cancel a policy generation.

        Access Level: Write

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_CancelPolicyGeneration.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toCancelPolicyGeneration", []))

    @jsii.member(jsii_name="toCreateAccessPreview")
    def to_create_access_preview(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to create an access preview for the specified analyzer.

        Access Level: Write

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_CreateAccessPreview.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toCreateAccessPreview", []))

    @jsii.member(jsii_name="toCreateAnalyzer")
    def to_create_analyzer(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to create an analyzer.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_CreateAnalyzer.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toCreateAnalyzer", []))

    @jsii.member(jsii_name="toCreateArchiveRule")
    def to_create_archive_rule(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to create an archive rule for the specified analyzer.

        Access Level: Write

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_CreateArchiveRule.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toCreateArchiveRule", []))

    @jsii.member(jsii_name="toDeleteAnalyzer")
    def to_delete_analyzer(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to delete the specified analyzer.

        Access Level: Write

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_DeleteAnalyzer.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toDeleteAnalyzer", []))

    @jsii.member(jsii_name="toDeleteArchiveRule")
    def to_delete_archive_rule(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to delete archive rules for the specified analyzer.

        Access Level: Write

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_DeleteArchiveRule.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toDeleteArchiveRule", []))

    @jsii.member(jsii_name="toGetAccessPreview")
    def to_get_access_preview(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to retrieve information about an access preview.

        Access Level: Read

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_GetAccessPreview.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toGetAccessPreview", []))

    @jsii.member(jsii_name="toGetAnalyzedResource")
    def to_get_analyzed_resource(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to retrieve information about an analyzed resource.

        Access Level: Read

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_GetAnalyzedResource.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toGetAnalyzedResource", []))

    @jsii.member(jsii_name="toGetAnalyzer")
    def to_get_analyzer(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to retrieve information about analyzers.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_GetAnalyzer.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toGetAnalyzer", []))

    @jsii.member(jsii_name="toGetArchiveRule")
    def to_get_archive_rule(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to retrieve information about archive rules for the specified analyzer.

        Access Level: Read

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_GetArchiveRule.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toGetArchiveRule", []))

    @jsii.member(jsii_name="toGetFinding")
    def to_get_finding(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to retrieve findings.

        Access Level: Read

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_GetFinding.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toGetFinding", []))

    @jsii.member(jsii_name="toGetGeneratedPolicy")
    def to_get_generated_policy(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to retrieve a policy that was generated using StartPolicyGeneration.

        Access Level: Read

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_GetGeneratedPolicy.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toGetGeneratedPolicy", []))

    @jsii.member(jsii_name="toListAccessPreviewFindings")
    def to_list_access_preview_findings(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to retrieve a list of findings from an access preview.

        Access Level: Read

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ListAccessPreviewFindings.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toListAccessPreviewFindings", []))

    @jsii.member(jsii_name="toListAccessPreviews")
    def to_list_access_previews(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to retrieve a list of access previews.

        Access Level: List

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ListAccessPreviews.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toListAccessPreviews", []))

    @jsii.member(jsii_name="toListAnalyzedResources")
    def to_list_analyzed_resources(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to retrieve a list of resources that have been analyzed.

        Access Level: Read

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ListAnalyzedResources.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toListAnalyzedResources", []))

    @jsii.member(jsii_name="toListAnalyzers")
    def to_list_analyzers(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to retrieves a list of analyzers.

        Access Level: List

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ListAnalyzers.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toListAnalyzers", []))

    @jsii.member(jsii_name="toListArchiveRules")
    def to_list_archive_rules(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to retrieve a list of archive rules from an analyzer.

        Access Level: List

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ListArchiveRules.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toListArchiveRules", []))

    @jsii.member(jsii_name="toListFindings")
    def to_list_findings(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to retrieve a list of findings from an analyzer.

        Access Level: Read

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ListFindings.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toListFindings", []))

    @jsii.member(jsii_name="toListPolicyGenerations")
    def to_list_policy_generations(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to list all the recently started policy generations.

        Access Level: Read

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ListPolicyGenerations.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toListPolicyGenerations", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to retrieve a list of tags applied to a resource.

        Access Level: Read

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toStartPolicyGeneration")
    def to_start_policy_generation(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to start a policy generation.

        Access Level: Write

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_StartPolicyGeneration.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toStartPolicyGeneration", []))

    @jsii.member(jsii_name="toStartResourceScan")
    def to_start_resource_scan(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to start a scan of the policies applied to a resource.

        Access Level: Write

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_StartResourceScan.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toStartResourceScan", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to add a tag to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to remove a tag from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateArchiveRule")
    def to_update_archive_rule(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to modify an archive rule.

        Access Level: Write

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_UpdateArchiveRule.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toUpdateArchiveRule", []))

    @jsii.member(jsii_name="toUpdateFindings")
    def to_update_findings(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to modify findings.

        Access Level: Write

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_UpdateFindings.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toUpdateFindings", []))

    @jsii.member(jsii_name="toValidatePolicy")
    def to_validate_policy(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to validate a policy.

        Access Level: Read

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ValidatePolicy.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toValidatePolicy", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Account(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Account"):
    '''(experimental) Statement provider for service `account <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsaccounts.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `account <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsaccounts.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Account, self, [sid])

    @jsii.member(jsii_name="ifTargetRegion")
    def if_target_region(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Account":
        '''(experimental) Filters access by a list of regions.

        Applies to actions:

        - .toDisableRegion()
        - .toEnableRegion()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Account", jsii.invoke(self, "ifTargetRegion", [value, operator]))

    @jsii.member(jsii_name="toDisableRegion")
    def to_disable_region(self) -> "Account":
        '''(experimental) Grants permission to disable a region.

        Access Level: Write

        Possible conditions:

        - .ifTargetRegion()

        :stability: experimental
        '''
        return typing.cast("Account", jsii.invoke(self, "toDisableRegion", []))

    @jsii.member(jsii_name="toEnableRegion")
    def to_enable_region(self) -> "Account":
        '''(experimental) Grants permission to enable a region.

        Access Level: Write

        Possible conditions:

        - .ifTargetRegion()

        :stability: experimental
        '''
        return typing.cast("Account", jsii.invoke(self, "toEnableRegion", []))

    @jsii.member(jsii_name="toListRegions")
    def to_list_regions(self) -> "Account":
        '''(experimental) Grants permission to list regions.

        Access Level: List

        :stability: experimental
        '''
        return typing.cast("Account", jsii.invoke(self, "toListRegions", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Acm(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Acm"):
    '''(experimental) Statement provider for service `acm <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscertificatemanager.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `acm <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscertificatemanager.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Acm, self, [sid])

    @jsii.member(jsii_name="onCertificate")
    def on_certificate(
        self,
        certificate_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Acm":
        '''(experimental) Adds a resource of type certificate to the statement.

        https://docs.aws.amazon.com/acm/latest/userguide/authen-overview.html#acm-resources-operations

        :param certificate_id: - Identifier for the certificateId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Acm", jsii.invoke(self, "onCertificate", [certificate_id, account, region, partition]))

    @jsii.member(jsii_name="toAddTagsToCertificate")
    def to_add_tags_to_certificate(self) -> "Acm":
        '''(experimental) Grants permission to add one or more tags to a certificate.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/acm/latest/APIReference/API_AddTagsToCertificate.html

        :stability: experimental
        '''
        return typing.cast("Acm", jsii.invoke(self, "toAddTagsToCertificate", []))

    @jsii.member(jsii_name="toDeleteCertificate")
    def to_delete_certificate(self) -> "Acm":
        '''(experimental) Grants permission to delete a certificate and its associated private key.

        Access Level: Write

        https://docs.aws.amazon.com/acm/latest/APIReference/API_DeleteCertificate.html

        :stability: experimental
        '''
        return typing.cast("Acm", jsii.invoke(self, "toDeleteCertificate", []))

    @jsii.member(jsii_name="toDescribeCertificate")
    def to_describe_certificate(self) -> "Acm":
        '''(experimental) Grants permission to retreive a certificates and its metadata.

        Access Level: Read

        https://docs.aws.amazon.com/acm/latest/APIReference/API_DescribeCertificate.html

        :stability: experimental
        '''
        return typing.cast("Acm", jsii.invoke(self, "toDescribeCertificate", []))

    @jsii.member(jsii_name="toExportCertificate")
    def to_export_certificate(self) -> "Acm":
        '''(experimental) Grants permission to Export a private certificate issued by a private certificate authority (CA) for use anywhere.

        Access Level: Read

        https://docs.aws.amazon.com/acm/latest/APIReference/API_ExportCertificate.html

        :stability: experimental
        '''
        return typing.cast("Acm", jsii.invoke(self, "toExportCertificate", []))

    @jsii.member(jsii_name="toGetAccountConfiguration")
    def to_get_account_configuration(self) -> "Acm":
        '''(experimental) Grants permission to retrieve account level configuration from AWS Certificate Manager.

        Access Level: Read

        https://docs.aws.amazon.com/acm/latest/APIReference/API_GetAccountConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Acm", jsii.invoke(self, "toGetAccountConfiguration", []))

    @jsii.member(jsii_name="toGetCertificate")
    def to_get_certificate(self) -> "Acm":
        '''(experimental) Grants permission to to etrieves a certificate and certificate chain for a certificate ARN.

        Access Level: Read

        https://docs.aws.amazon.com/acm/latest/APIReference/API_GetCertificate.html

        :stability: experimental
        '''
        return typing.cast("Acm", jsii.invoke(self, "toGetCertificate", []))

    @jsii.member(jsii_name="toImportCertificate")
    def to_import_certificate(self) -> "Acm":
        '''(experimental) Grants permission to imports a 3rd party certificate into AWS Certificate Manager (ACM).

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/acm/latest/APIReference/API_ImportCertificate.html

        :stability: experimental
        '''
        return typing.cast("Acm", jsii.invoke(self, "toImportCertificate", []))

    @jsii.member(jsii_name="toListCertificates")
    def to_list_certificates(self) -> "Acm":
        '''(experimental) Grants permission to retrieve a list of the certificate ARNs and the domain name for each ARN.

        Access Level: List

        https://docs.aws.amazon.com/acm/latest/APIReference/API_ListCertificates.html

        :stability: experimental
        '''
        return typing.cast("Acm", jsii.invoke(self, "toListCertificates", []))

    @jsii.member(jsii_name="toListTagsForCertificate")
    def to_list_tags_for_certificate(self) -> "Acm":
        '''(experimental) Grants permission to lists the tags that have been associated with a certificate.

        Access Level: Read

        https://docs.aws.amazon.com/acm/latest/APIReference/API_ListTagsForCertificate.html

        :stability: experimental
        '''
        return typing.cast("Acm", jsii.invoke(self, "toListTagsForCertificate", []))

    @jsii.member(jsii_name="toPutAccountConfiguration")
    def to_put_account_configuration(self) -> "Acm":
        '''(experimental) Grants permission to update account level configuration in AWS Certificate Manager.

        Access Level: Write

        https://docs.aws.amazon.com/acm/latest/APIReference/API_PutAccountConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Acm", jsii.invoke(self, "toPutAccountConfiguration", []))

    @jsii.member(jsii_name="toRemoveTagsFromCertificate")
    def to_remove_tags_from_certificate(self) -> "Acm":
        '''(experimental) Grants permission to remove one or more tags from a certificate.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/acm/latest/APIReference/API_RemoveTagsFromCertificate.html

        :stability: experimental
        '''
        return typing.cast("Acm", jsii.invoke(self, "toRemoveTagsFromCertificate", []))

    @jsii.member(jsii_name="toRenewCertificate")
    def to_renew_certificate(self) -> "Acm":
        '''(experimental) Grants permission to renew an eligible private certificate.

        Access Level: Write

        https://docs.aws.amazon.com/acm/latest/APIReference/API_RenewCertificate.html

        :stability: experimental
        '''
        return typing.cast("Acm", jsii.invoke(self, "toRenewCertificate", []))

    @jsii.member(jsii_name="toRequestCertificate")
    def to_request_certificate(self) -> "Acm":
        '''(experimental) Grants permission to requests a public or private certificate.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/acm/latest/APIReference/API_RequestCertificate.html

        :stability: experimental
        '''
        return typing.cast("Acm", jsii.invoke(self, "toRequestCertificate", []))

    @jsii.member(jsii_name="toResendValidationEmail")
    def to_resend_validation_email(self) -> "Acm":
        '''(experimental) Grants permission to resend an email to request domain ownership validation.

        Access Level: Write

        https://docs.aws.amazon.com/acm/latest/APIReference/API_ResendValidationEmail.html

        :stability: experimental
        '''
        return typing.cast("Acm", jsii.invoke(self, "toResendValidationEmail", []))

    @jsii.member(jsii_name="toUpdateCertificateOptions")
    def to_update_certificate_options(self) -> "Acm":
        '''(experimental) Grants permission to update a certificate configuration.

        Use this specify whether to opt in to or out of certificate transparency logging

        Access Level: Write

        https://docs.aws.amazon.com/acm/latest/APIReference/API_UpdateCertificateOptions.html

        :stability: experimental
        '''
        return typing.cast("Acm", jsii.invoke(self, "toUpdateCertificateOptions", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class AcmPca(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.AcmPca"):
    '''(experimental) Statement provider for service `acm-pca <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscertificatemanagerprivatecertificateauthority.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `acm-pca <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscertificatemanagerprivatecertificateauthority.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(AcmPca, self, [sid])

    @jsii.member(jsii_name="ifTemplateArn")
    def if_template_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "AcmPca":
        '''(experimental) Filters issue certificate requests based on the presence of TemplateArn in the request.

        Applies to actions:

        - .toIssueCertificate()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "ifTemplateArn", [value, operator]))

    @jsii.member(jsii_name="onCertificateAuthority")
    def on_certificate_authority(
        self,
        certificate_authority_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "AcmPca":
        '''(experimental) Adds a resource of type certificate-authority to the statement.

        https://docs.aws.amazon.com/acm-pca/latest/userguide/authen-overview.html#acm-pca-resources-operations

        :param certificate_authority_id: - Identifier for the certificateAuthorityId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "onCertificateAuthority", [certificate_authority_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateCertificateAuthority")
    def to_create_certificate_authority(self) -> "AcmPca":
        '''(experimental) Creates an ACM Private CA and its associated private key and configuration.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_CreateCertificateAuthority.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toCreateCertificateAuthority", []))

    @jsii.member(jsii_name="toCreateCertificateAuthorityAuditReport")
    def to_create_certificate_authority_audit_report(self) -> "AcmPca":
        '''(experimental) Creates an audit report for an ACM Private CA.

        Access Level: Write

        https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_CreateCertificateAuthorityAuditReport.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toCreateCertificateAuthorityAuditReport", []))

    @jsii.member(jsii_name="toCreatePermission")
    def to_create_permission(self) -> "AcmPca":
        '''(experimental) Creates a permission for an ACM Private CA.

        Access Level: Permissions management

        https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_CreatePermission.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toCreatePermission", []))

    @jsii.member(jsii_name="toDeleteCertificateAuthority")
    def to_delete_certificate_authority(self) -> "AcmPca":
        '''(experimental) Deletes an ACM Private CA and its associated private key and configuration.

        Access Level: Write

        https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_DeleteCertificateAuthority.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toDeleteCertificateAuthority", []))

    @jsii.member(jsii_name="toDeletePermission")
    def to_delete_permission(self) -> "AcmPca":
        '''(experimental) Deletes a permission for an ACM Private CA.

        Access Level: Permissions management

        https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_DeletePermission.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toDeletePermission", []))

    @jsii.member(jsii_name="toDeletePolicy")
    def to_delete_policy(self) -> "AcmPca":
        '''(experimental) Deletes the policy for an ACM Private CA.

        Access Level: Permissions management

        https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_DeletePolicy.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toDeletePolicy", []))

    @jsii.member(jsii_name="toDescribeCertificateAuthority")
    def to_describe_certificate_authority(self) -> "AcmPca":
        '''(experimental) Returns a list of the configuration and status fields contained in the specified ACM Private CA.

        Access Level: Read

        https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_DescribeCertificateAuthority.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toDescribeCertificateAuthority", []))

    @jsii.member(jsii_name="toDescribeCertificateAuthorityAuditReport")
    def to_describe_certificate_authority_audit_report(self) -> "AcmPca":
        '''(experimental) Returns the status and information about an ACM Private CA audit report.

        Access Level: Read

        https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_DescribeCertificateAuthorityAuditReport.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toDescribeCertificateAuthorityAuditReport", []))

    @jsii.member(jsii_name="toGetCertificate")
    def to_get_certificate(self) -> "AcmPca":
        '''(experimental) Retrieves an ACM Private CA certificate and certificate chain for the certificate authority specified by an ARN.

        Access Level: Read

        https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_GetCertificate.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toGetCertificate", []))

    @jsii.member(jsii_name="toGetCertificateAuthorityCertificate")
    def to_get_certificate_authority_certificate(self) -> "AcmPca":
        '''(experimental) Retrieves an ACM Private CA certificate and certificate chain for the certificate authority specified by an ARN.

        Access Level: Read

        https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_GetCertificateAuthorityCertificate.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toGetCertificateAuthorityCertificate", []))

    @jsii.member(jsii_name="toGetCertificateAuthorityCsr")
    def to_get_certificate_authority_csr(self) -> "AcmPca":
        '''(experimental) Retrieves an ACM Private CA certificate signing request (CSR) for the certificate-authority specified by an ARN.

        Access Level: Read

        https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_GetCertificateAuthorityCsr.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toGetCertificateAuthorityCsr", []))

    @jsii.member(jsii_name="toGetPolicy")
    def to_get_policy(self) -> "AcmPca":
        '''(experimental) Retrieves the policy on an ACM Private CA.

        Access Level: Read

        https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_GetPolicy.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toGetPolicy", []))

    @jsii.member(jsii_name="toImportCertificateAuthorityCertificate")
    def to_import_certificate_authority_certificate(self) -> "AcmPca":
        '''(experimental) Imports an SSL/TLS certificate into ACM Private CA for use as the CA certificate of an ACM Private CA.

        Access Level: Write

        https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_ImportCertificateAuthorityCertificate.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toImportCertificateAuthorityCertificate", []))

    @jsii.member(jsii_name="toIssueCertificate")
    def to_issue_certificate(self) -> "AcmPca":
        '''(experimental) Issues an ACM Private CA certificate.

        Access Level: Write

        Possible conditions:

        - .ifTemplateArn()

        https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_IssueCertificate.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toIssueCertificate", []))

    @jsii.member(jsii_name="toListCertificateAuthorities")
    def to_list_certificate_authorities(self) -> "AcmPca":
        '''(experimental) Retrieves a list of the ACM Private CA certificate authority ARNs, and a summary of the status of each CA in the calling account.

        Access Level: List

        https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_ListCertificateAuthorities.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toListCertificateAuthorities", []))

    @jsii.member(jsii_name="toListPermissions")
    def to_list_permissions(self) -> "AcmPca":
        '''(experimental) Lists the permissions that have been applied to the ACM Private CA certificate authority.

        Access Level: Read

        https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_ListPermissions.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toListPermissions", []))

    @jsii.member(jsii_name="toListTags")
    def to_list_tags(self) -> "AcmPca":
        '''(experimental) Lists the tags that have been applied to the ACM Private CA certificate authority.

        Access Level: Read

        https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_ListTags.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toListTags", []))

    @jsii.member(jsii_name="toPutPolicy")
    def to_put_policy(self) -> "AcmPca":
        '''(experimental) Puts a policy on an ACM Private CA.

        Access Level: Permissions management

        https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_PutPolicy.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toPutPolicy", []))

    @jsii.member(jsii_name="toRestoreCertificateAuthority")
    def to_restore_certificate_authority(self) -> "AcmPca":
        '''(experimental) Restores an ACM Private CA from the deleted state to the state it was in when deleted.

        Access Level: Write

        https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_RestoreCertificateAuthority.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toRestoreCertificateAuthority", []))

    @jsii.member(jsii_name="toRevokeCertificate")
    def to_revoke_certificate(self) -> "AcmPca":
        '''(experimental) Revokes a certificate issued by an ACM Private CA.

        Access Level: Write

        https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_RevokeCertificate.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toRevokeCertificate", []))

    @jsii.member(jsii_name="toTagCertificateAuthority")
    def to_tag_certificate_authority(self) -> "AcmPca":
        '''(experimental) Adds one or more tags to an ACM Private CA.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_TagCertificateAuthority.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toTagCertificateAuthority", []))

    @jsii.member(jsii_name="toUntagCertificateAuthority")
    def to_untag_certificate_authority(self) -> "AcmPca":
        '''(experimental) Remove one or more tags from an ACM Private CA.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_UntagCertificateAuthority.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toUntagCertificateAuthority", []))

    @jsii.member(jsii_name="toUpdateCertificateAuthority")
    def to_update_certificate_authority(self) -> "AcmPca":
        '''(experimental) Updates the configuration of an ACM Private CA.

        Access Level: Write

        https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_UpdateCertificateAuthority.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toUpdateCertificateAuthority", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Activate(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Activate",
):
    '''(experimental) Statement provider for service `activate <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsactivate.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `activate <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsactivate.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Activate, self, [sid])

    @jsii.member(jsii_name="toCreateForm")
    def to_create_form(self) -> "Activate":
        '''(experimental) Grants permission to submit an Activate application form.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Activate", jsii.invoke(self, "toCreateForm", []))

    @jsii.member(jsii_name="toGetAccountContact")
    def to_get_account_contact(self) -> "Activate":
        '''(experimental) Grants permission to get the AWS account contact information.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Activate", jsii.invoke(self, "toGetAccountContact", []))

    @jsii.member(jsii_name="toGetContentInfo")
    def to_get_content_info(self) -> "Activate":
        '''(experimental) Grants permission to get Activate tech posts and offer information.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Activate", jsii.invoke(self, "toGetContentInfo", []))

    @jsii.member(jsii_name="toGetCosts")
    def to_get_costs(self) -> "Activate":
        '''(experimental) Grants permission to get the AWS cost information.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Activate", jsii.invoke(self, "toGetCosts", []))

    @jsii.member(jsii_name="toGetCredits")
    def to_get_credits(self) -> "Activate":
        '''(experimental) Grants permission to get the AWS credit information.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Activate", jsii.invoke(self, "toGetCredits", []))

    @jsii.member(jsii_name="toGetMemberInfo")
    def to_get_member_info(self) -> "Activate":
        '''(experimental) Grants permission to get the Activate member information.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Activate", jsii.invoke(self, "toGetMemberInfo", []))

    @jsii.member(jsii_name="toGetProgram")
    def to_get_program(self) -> "Activate":
        '''(experimental) Grants permission to get an Activate program.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Activate", jsii.invoke(self, "toGetProgram", []))

    @jsii.member(jsii_name="toPutMemberInfo")
    def to_put_member_info(self) -> "Activate":
        '''(experimental) Grants permission to create or update the Activate member information.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Activate", jsii.invoke(self, "toPutMemberInfo", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Airflow(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Airflow"):
    '''(experimental) Statement provider for service `airflow <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmanagedworkflowsforapacheairflow.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `airflow <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmanagedworkflowsforapacheairflow.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Airflow, self, [sid])

    @jsii.member(jsii_name="onEnvironment")
    def on_environment(
        self,
        environment_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Airflow":
        '''(experimental) Adds a resource of type environment to the statement.

        https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-actions-resources.html#mwaa-resources

        :param environment_name: - Identifier for the environmentName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Airflow", jsii.invoke(self, "onEnvironment", [environment_name, account, region, partition]))

    @jsii.member(jsii_name="onRbacRole")
    def on_rbac_role(
        self,
        environment_name: builtins.str,
        role_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Airflow":
        '''(experimental) Adds a resource of type rbac-role to the statement.

        https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-actions-resources.html#mwaa-resources

        :param environment_name: - Identifier for the environmentName.
        :param role_name: - Identifier for the roleName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Airflow", jsii.invoke(self, "onRbacRole", [environment_name, role_name, account, region, partition]))

    @jsii.member(jsii_name="toCreateCliToken")
    def to_create_cli_token(self) -> "Airflow":
        '''(experimental) Grants permission to create a short-lived token that allows a user to invoke Airflow CLI via an endpoint on the Apache Airflow Webserver.

        Access Level: Write

        https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-actions-resources.html

        :stability: experimental
        '''
        return typing.cast("Airflow", jsii.invoke(self, "toCreateCliToken", []))

    @jsii.member(jsii_name="toCreateEnvironment")
    def to_create_environment(self) -> "Airflow":
        '''(experimental) Grants permission to create an Amazon MWAA environment.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-actions-resources.html

        :stability: experimental
        '''
        return typing.cast("Airflow", jsii.invoke(self, "toCreateEnvironment", []))

    @jsii.member(jsii_name="toCreateWebLoginToken")
    def to_create_web_login_token(self) -> "Airflow":
        '''(experimental) Grants permission to create a short-lived token that allows a user to log into Apache Airflow web UI.

        Access Level: Write

        https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-actions-resources.html

        :stability: experimental
        '''
        return typing.cast("Airflow", jsii.invoke(self, "toCreateWebLoginToken", []))

    @jsii.member(jsii_name="toDeleteEnvironment")
    def to_delete_environment(self) -> "Airflow":
        '''(experimental) Grants permission to delete an Amazon MWAA environment.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-actions-resources.html

        :stability: experimental
        '''
        return typing.cast("Airflow", jsii.invoke(self, "toDeleteEnvironment", []))

    @jsii.member(jsii_name="toGetEnvironment")
    def to_get_environment(self) -> "Airflow":
        '''(experimental) Grants permission to view details about an Amazon MWAA environment.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-actions-resources.html

        :stability: experimental
        '''
        return typing.cast("Airflow", jsii.invoke(self, "toGetEnvironment", []))

    @jsii.member(jsii_name="toListEnvironments")
    def to_list_environments(self) -> "Airflow":
        '''(experimental) Grants permission to list the Amazon MWAA environments in your account.

        Access Level: List

        https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-actions-resources.html

        :stability: experimental
        '''
        return typing.cast("Airflow", jsii.invoke(self, "toListEnvironments", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Airflow":
        '''(experimental) Grants permission to lists tag for an Amazon MWAA environment.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-actions-resources.html

        :stability: experimental
        '''
        return typing.cast("Airflow", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPublishMetrics")
    def to_publish_metrics(self) -> "Airflow":
        '''(experimental) Grants permission to publish metrics for an Amazon MWAA environment.

        Access Level: Write

        https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-actions-resources.html

        :stability: experimental
        '''
        return typing.cast("Airflow", jsii.invoke(self, "toPublishMetrics", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Airflow":
        '''(experimental) Grants permission to tag an Amazon MWAA environment.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-actions-resources.html

        :stability: experimental
        '''
        return typing.cast("Airflow", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Airflow":
        '''(experimental) Grants permission to untag an Amazon MWAA environment.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-actions-resources.html

        :stability: experimental
        '''
        return typing.cast("Airflow", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateEnvironment")
    def to_update_environment(self) -> "Airflow":
        '''(experimental) Grants permission to modify an Amazon MWAA environment.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-actions-resources.html

        :stability: experimental
        '''
        return typing.cast("Airflow", jsii.invoke(self, "toUpdateEnvironment", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class All(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.All"):
    '''(experimental) Action provider for all services.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Action provider for all services.

        Use this provider to globally allow/deny actions, based on global conditions.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(All, self, [sid])


class Amplify(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Amplify"):
    '''(experimental) Statement provider for service `amplify <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsamplify.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `amplify <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsamplify.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Amplify, self, [sid])

    @jsii.member(jsii_name="onApps")
    def on_apps(
        self,
        app_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Amplify":
        '''(experimental) Adds a resource of type apps to the statement.

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :param app_id: - Identifier for the appId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "onApps", [app_id, account, region, partition]))

    @jsii.member(jsii_name="onBranches")
    def on_branches(
        self,
        app_id: builtins.str,
        branch_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Amplify":
        '''(experimental) Adds a resource of type branches to the statement.

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :param app_id: - Identifier for the appId.
        :param branch_name: - Identifier for the branchName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "onBranches", [app_id, branch_name, account, region, partition]))

    @jsii.member(jsii_name="onDomains")
    def on_domains(
        self,
        app_id: builtins.str,
        domain_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Amplify":
        '''(experimental) Adds a resource of type domains to the statement.

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :param app_id: - Identifier for the appId.
        :param domain_name: - Identifier for the domainName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "onDomains", [app_id, domain_name, account, region, partition]))

    @jsii.member(jsii_name="onJobs")
    def on_jobs(
        self,
        app_id: builtins.str,
        branch_name: builtins.str,
        job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Amplify":
        '''(experimental) Adds a resource of type jobs to the statement.

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :param app_id: - Identifier for the appId.
        :param branch_name: - Identifier for the branchName.
        :param job_id: - Identifier for the jobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "onJobs", [app_id, branch_name, job_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateApp")
    def to_create_app(self) -> "Amplify":
        '''(experimental) Creates a new Amplify App.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toCreateApp", []))

    @jsii.member(jsii_name="toCreateBackendEnvironment")
    def to_create_backend_environment(self) -> "Amplify":
        '''(experimental) Creates a new backend environment for an Amplify App.

        Access Level: Write

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toCreateBackendEnvironment", []))

    @jsii.member(jsii_name="toCreateBranch")
    def to_create_branch(self) -> "Amplify":
        '''(experimental) Creates a new Branch for an Amplify App.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toCreateBranch", []))

    @jsii.member(jsii_name="toCreateDeployment")
    def to_create_deployment(self) -> "Amplify":
        '''(experimental) Create a deployment for manual deploy apps. (Apps are not connected to repository).

        Access Level: Write

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toCreateDeployment", []))

    @jsii.member(jsii_name="toCreateDomainAssociation")
    def to_create_domain_association(self) -> "Amplify":
        '''(experimental) Create a new DomainAssociation on an App.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toCreateDomainAssociation", []))

    @jsii.member(jsii_name="toCreateWebHook")
    def to_create_web_hook(self) -> "Amplify":
        '''(experimental) Create a new webhook on an App.

        Access Level: Write

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toCreateWebHook", []))

    @jsii.member(jsii_name="toDeleteApp")
    def to_delete_app(self) -> "Amplify":
        '''(experimental) Delete an existing Amplify App by appId.

        Access Level: Write

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toDeleteApp", []))

    @jsii.member(jsii_name="toDeleteBackendEnvironment")
    def to_delete_backend_environment(self) -> "Amplify":
        '''(experimental) Deletes a branch for an Amplify App.

        Access Level: Write

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toDeleteBackendEnvironment", []))

    @jsii.member(jsii_name="toDeleteBranch")
    def to_delete_branch(self) -> "Amplify":
        '''(experimental) Deletes a branch for an Amplify App.

        Access Level: Write

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toDeleteBranch", []))

    @jsii.member(jsii_name="toDeleteDomainAssociation")
    def to_delete_domain_association(self) -> "Amplify":
        '''(experimental) Deletes a DomainAssociation.

        Access Level: Write

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toDeleteDomainAssociation", []))

    @jsii.member(jsii_name="toDeleteJob")
    def to_delete_job(self) -> "Amplify":
        '''(experimental) Delete a job, for an Amplify branch, part of Amplify App.

        Access Level: Write

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toDeleteJob", []))

    @jsii.member(jsii_name="toDeleteWebHook")
    def to_delete_web_hook(self) -> "Amplify":
        '''(experimental) Delete a webhook by id.

        Access Level: Write

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toDeleteWebHook", []))

    @jsii.member(jsii_name="toGenerateAccessLogs")
    def to_generate_access_logs(self) -> "Amplify":
        '''(experimental) Generate website access logs for a specific time range via a pre-signed URL.

        Access Level: Write

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toGenerateAccessLogs", []))

    @jsii.member(jsii_name="toGetApp")
    def to_get_app(self) -> "Amplify":
        '''(experimental) Retrieves an existing Amplify App by appId.

        Access Level: Read

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toGetApp", []))

    @jsii.member(jsii_name="toGetArtifactUrl")
    def to_get_artifact_url(self) -> "Amplify":
        '''(experimental) Retrieves artifact info that corresponds to a artifactId.

        Access Level: Read

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toGetArtifactUrl", []))

    @jsii.member(jsii_name="toGetBackendEnvironment")
    def to_get_backend_environment(self) -> "Amplify":
        '''(experimental) Retrieves a backend environment for an Amplify App.

        Access Level: Read

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toGetBackendEnvironment", []))

    @jsii.member(jsii_name="toGetBranch")
    def to_get_branch(self) -> "Amplify":
        '''(experimental) Retrieves a branch for an Amplify App.

        Access Level: Read

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toGetBranch", []))

    @jsii.member(jsii_name="toGetDomainAssociation")
    def to_get_domain_association(self) -> "Amplify":
        '''(experimental) Retrieves domain info that corresponds to an appId and domainName.

        Access Level: Read

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toGetDomainAssociation", []))

    @jsii.member(jsii_name="toGetJob")
    def to_get_job(self) -> "Amplify":
        '''(experimental) Get a job for a branch, part of an Amplify App.

        Access Level: Read

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toGetJob", []))

    @jsii.member(jsii_name="toGetWebHook")
    def to_get_web_hook(self) -> "Amplify":
        '''(experimental) Retrieves webhook info that corresponds to a webhookId.

        Access Level: Read

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toGetWebHook", []))

    @jsii.member(jsii_name="toListApps")
    def to_list_apps(self) -> "Amplify":
        '''(experimental) Lists existing Amplify Apps.

        Access Level: List

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toListApps", []))

    @jsii.member(jsii_name="toListArtifacts")
    def to_list_artifacts(self) -> "Amplify":
        '''(experimental) List artifacts with an app, a branch, a job and an artifact type.

        Access Level: List

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toListArtifacts", []))

    @jsii.member(jsii_name="toListBackendEnvironments")
    def to_list_backend_environments(self) -> "Amplify":
        '''(experimental) Lists backend environments for an Amplify App.

        Access Level: List

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toListBackendEnvironments", []))

    @jsii.member(jsii_name="toListBranches")
    def to_list_branches(self) -> "Amplify":
        '''(experimental) Lists branches for an Amplify App.

        Access Level: List

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toListBranches", []))

    @jsii.member(jsii_name="toListDomainAssociations")
    def to_list_domain_associations(self) -> "Amplify":
        '''(experimental) List domains with an app.

        Access Level: List

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toListDomainAssociations", []))

    @jsii.member(jsii_name="toListJobs")
    def to_list_jobs(self) -> "Amplify":
        '''(experimental) List Jobs for a branch, part of an Amplify App.

        Access Level: List

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toListJobs", []))

    @jsii.member(jsii_name="toListWebHooks")
    def to_list_web_hooks(self) -> "Amplify":
        '''(experimental) List webhooks on an App.

        Access Level: List

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toListWebHooks", []))

    @jsii.member(jsii_name="toStartDeployment")
    def to_start_deployment(self) -> "Amplify":
        '''(experimental) Start a deployment for manual deploy apps. (Apps are not connected to repository).

        Access Level: Write

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toStartDeployment", []))

    @jsii.member(jsii_name="toStartJob")
    def to_start_job(self) -> "Amplify":
        '''(experimental) Starts a new job for a branch, part of an Amplify App.

        Access Level: Write

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toStartJob", []))

    @jsii.member(jsii_name="toStopJob")
    def to_stop_job(self) -> "Amplify":
        '''(experimental) Stop a job that is in progress, for an Amplify branch, part of Amplify App.

        Access Level: Write

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toStopJob", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Amplify":
        '''(experimental) This action tags an AWS Amplify Console resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Amplify":
        '''(experimental) This action removes a tag from an AWS Amplify Console resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateApp")
    def to_update_app(self) -> "Amplify":
        '''(experimental) Updates an existing Amplify App.

        Access Level: Write

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toUpdateApp", []))

    @jsii.member(jsii_name="toUpdateBranch")
    def to_update_branch(self) -> "Amplify":
        '''(experimental) Updates a branch for an Amplify App.

        Access Level: Write

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toUpdateBranch", []))

    @jsii.member(jsii_name="toUpdateDomainAssociation")
    def to_update_domain_association(self) -> "Amplify":
        '''(experimental) Update a DomainAssociation on an App.

        Access Level: Write

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toUpdateDomainAssociation", []))

    @jsii.member(jsii_name="toUpdateWebHook")
    def to_update_web_hook(self) -> "Amplify":
        '''(experimental) Update a webhook.

        Access Level: Write

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toUpdateWebHook", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Amplifybackend(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Amplifybackend",
):
    '''(experimental) Statement provider for service `amplifybackend <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsamplifyadmin.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `amplifybackend <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsamplifyadmin.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Amplifybackend, self, [sid])

    @jsii.member(jsii_name="onApi")
    def on_api(
        self,
        app_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Amplifybackend":
        '''(experimental) Adds a resource of type api to the statement.

        https://docs.aws.amazon.com/amplify-admin-ui/latest/UserGuide/backend-appid-api.html

        :param app_id: - Identifier for the appId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "onApi", [app_id, account, region, partition]))

    @jsii.member(jsii_name="onAuth")
    def on_auth(
        self,
        app_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Amplifybackend":
        '''(experimental) Adds a resource of type auth to the statement.

        https://docs.aws.amazon.com/amplify-admin-ui/latest/UserGuide/backend-appid-auth.html

        :param app_id: - Identifier for the appId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "onAuth", [app_id, account, region, partition]))

    @jsii.member(jsii_name="onBackend")
    def on_backend(
        self,
        app_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Amplifybackend":
        '''(experimental) Adds a resource of type backend to the statement.

        https://docs.aws.amazon.com/amplify-admin-ui/latest/UserGuide/backend.html

        :param app_id: - Identifier for the appId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "onBackend", [app_id, account, region, partition]))

    @jsii.member(jsii_name="onConfig")
    def on_config(
        self,
        app_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Amplifybackend":
        '''(experimental) Adds a resource of type config to the statement.

        https://docs.aws.amazon.com/amplify-admin-ui/latest/UserGuide/backend-appid-config.html

        :param app_id: - Identifier for the appId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "onConfig", [app_id, account, region, partition]))

    @jsii.member(jsii_name="onEnvironment")
    def on_environment(
        self,
        app_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Amplifybackend":
        '''(experimental) Adds a resource of type environment to the statement.

        https://docs.aws.amazon.com/amplify-admin-ui/latest/UserGuide/backend-appid-api-backendenvironmentname-details.html

        :param app_id: - Identifier for the appId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "onEnvironment", [app_id, account, region, partition]))

    @jsii.member(jsii_name="onJob")
    def on_job(
        self,
        app_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Amplifybackend":
        '''(experimental) Adds a resource of type job to the statement.

        https://docs.aws.amazon.com/amplify-admin-ui/latest/UserGuide/backend-appid-job-backendenvironmentname.html

        :param app_id: - Identifier for the appId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "onJob", [app_id, account, region, partition]))

    @jsii.member(jsii_name="onToken")
    def on_token(
        self,
        app_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Amplifybackend":
        '''(experimental) Adds a resource of type token to the statement.

        https://docs.aws.amazon.com/amplify-admin-ui/latest/UserGuide/backend-appid-token.html

        :param app_id: - Identifier for the appId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "onToken", [app_id, account, region, partition]))

    @jsii.member(jsii_name="toCloneBackend")
    def to_clone_backend(self) -> "Amplifybackend":
        '''(experimental) Grants permission to clone an existing Amplify Admin backend environment into a new Amplify Admin backend enviroment.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-environments-backendenvironmentname-clone.html#CloneBackend

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toCloneBackend", []))

    @jsii.member(jsii_name="toCreateBackend")
    def to_create_backend(self) -> "Amplifybackend":
        '''(experimental) Grants permission to create a new Amplify Admin backend environment by Amplify appId.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend.html#CreateBackend

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toCreateBackend", []))

    @jsii.member(jsii_name="toCreateBackendAPI")
    def to_create_backend_api(self) -> "Amplifybackend":
        '''(experimental) Grants permission to create an API for an existing Amplify Admin backend environment by appId and backendEnvironmentName.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-api.html#CreateBackendAPI

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toCreateBackendAPI", []))

    @jsii.member(jsii_name="toCreateBackendAuth")
    def to_create_backend_auth(self) -> "Amplifybackend":
        '''(experimental) Grants permission to create an auth resource for an existing Amplify Admin backend environment by appId and backendEnvironmentName.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-auth.html#CreateBackendAuth

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toCreateBackendAuth", []))

    @jsii.member(jsii_name="toCreateBackendConfig")
    def to_create_backend_config(self) -> "Amplifybackend":
        '''(experimental) Grants permission to create a new Amplify Admin backend config by Amplify appId.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-config.html#CreateBackendConfig

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toCreateBackendConfig", []))

    @jsii.member(jsii_name="toCreateToken")
    def to_create_token(self) -> "Amplifybackend":
        '''(experimental) Grants permission to create an Amplify Admin challenge token by appId.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-challenge.html#CreateToken

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toCreateToken", []))

    @jsii.member(jsii_name="toDeleteBackend")
    def to_delete_backend(self) -> "Amplifybackend":
        '''(experimental) Grants permission to delete an existing Amplify Admin backend environment by appId and backendEnvironmentName.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-environments-backendenvironmentname-remove.html#DeleteBackend

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toDeleteBackend", []))

    @jsii.member(jsii_name="toDeleteBackendAPI")
    def to_delete_backend_api(self) -> "Amplifybackend":
        '''(experimental) Grants permission to delete an API of an existing Amplify Admin backend environment by appId and backendEnvironmentName.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-api-backendenvironmentname-remove.html#DeleteBackendAPI

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toDeleteBackendAPI", []))

    @jsii.member(jsii_name="toDeleteBackendAuth")
    def to_delete_backend_auth(self) -> "Amplifybackend":
        '''(experimental) Grants permission to delete an auth resource of an existing Amplify Admin backend environment by appId and backendEnvironmentName.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-auth-backendenvironmentname-remove.html#DeleteBackendAuth

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toDeleteBackendAuth", []))

    @jsii.member(jsii_name="toDeleteToken")
    def to_delete_token(self) -> "Amplifybackend":
        '''(experimental) Grants permission to delete an Amplify Admin challenge token by appId.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-challenge-sessionid-remove.html#DeleteToken

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toDeleteToken", []))

    @jsii.member(jsii_name="toGenerateBackendAPIModels")
    def to_generate_backend_api_models(self) -> "Amplifybackend":
        '''(experimental) Grants permission to generate models for an API of an existing Amplify Admin backend environment by appId and backendEnvironmentName.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-api-backendenvironmentname-generatemodels.html#GenerateBackendAPIModels

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toGenerateBackendAPIModels", []))

    @jsii.member(jsii_name="toGetBackend")
    def to_get_backend(self) -> "Amplifybackend":
        '''(experimental) Grants permission to retrieve an existing Amplify Admin backend environment by appId and backendEnvironmentName.

        Access Level: Read

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-details.html#GetBackend

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toGetBackend", []))

    @jsii.member(jsii_name="toGetBackendAPI")
    def to_get_backend_api(self) -> "Amplifybackend":
        '''(experimental) Grants permission to retrieve an API of an existing Amplify Admin backend environment by appId and backendEnvironmentName.

        Access Level: Read

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-api-backendenvironmentname-details.html#GetBackendAPI

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toGetBackendAPI", []))

    @jsii.member(jsii_name="toGetBackendAPIModels")
    def to_get_backend_api_models(self) -> "Amplifybackend":
        '''(experimental) Grants permission to retrieve models for an API of an existing Amplify Admin backend environment by appId and backendEnvironmentName.

        Access Level: Read

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-api-backendenvironmentname-getmodels.html#GetBackendAPIModels

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toGetBackendAPIModels", []))

    @jsii.member(jsii_name="toGetBackendAuth")
    def to_get_backend_auth(self) -> "Amplifybackend":
        '''(experimental) Grants permission to retrieve an auth resource of an existing Amplify Admin backend environment by appId and backendEnvironmentName.

        Access Level: Read

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-auth-backendenvironmentname-details.html#GetBackendAuth

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toGetBackendAuth", []))

    @jsii.member(jsii_name="toGetBackendJob")
    def to_get_backend_job(self) -> "Amplifybackend":
        '''(experimental) Grants permission to retrieve a job of an existing Amplify Admin backend environment by appId and backendEnvironmentName.

        Access Level: Read

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-job-backendenvironmentname-jobid.html#GetBackendJob

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toGetBackendJob", []))

    @jsii.member(jsii_name="toGetToken")
    def to_get_token(self) -> "Amplifybackend":
        '''(experimental) Grants permission to retrieve an Amplify Admin challenge token by appId.

        Access Level: Read

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-challenge-sessionid.html#GetToken

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toGetToken", []))

    @jsii.member(jsii_name="toListBackendJobs")
    def to_list_backend_jobs(self) -> "Amplifybackend":
        '''(experimental) Grants permission to retrieve the jobs of an existing Amplify Admin backend environment by appId and backendEnvironmentName.

        Access Level: List

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-job-backendenvironmentname.html#ListBackendJobs

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toListBackendJobs", []))

    @jsii.member(jsii_name="toRemoveAllBackends")
    def to_remove_all_backends(self) -> "Amplifybackend":
        '''(experimental) Grants permission to delete all existing Amplify Admin backend environments by appId.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-remove.html#RemoveAllBackends

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toRemoveAllBackends", []))

    @jsii.member(jsii_name="toRemoveBackendConfig")
    def to_remove_backend_config(self) -> "Amplifybackend":
        '''(experimental) Grants permission to delete an Amplify Admin backend config by Amplify appId.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-config-remove.html#RemoveBackendConfig

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toRemoveBackendConfig", []))

    @jsii.member(jsii_name="toUpdateBackendAPI")
    def to_update_backend_api(self) -> "Amplifybackend":
        '''(experimental) Grants permission to update an API of an existing Amplify Admin backend environment by appId and backendEnvironmentName.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-api-backendenvironmentname.html#UpdateBackendAPI

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toUpdateBackendAPI", []))

    @jsii.member(jsii_name="toUpdateBackendAuth")
    def to_update_backend_auth(self) -> "Amplifybackend":
        '''(experimental) Grants permission to update an auth resource of an existing Amplify Admin backend environment by appId and backendEnvironmentName.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-auth-backendenvironmentname.html#UpdateBackendAuth

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toUpdateBackendAuth", []))

    @jsii.member(jsii_name="toUpdateBackendConfig")
    def to_update_backend_config(self) -> "Amplifybackend":
        '''(experimental) Grants permission to update an Amplify Admin backend config by Amplify appId.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-config-update.html#UpdateBackendConfig

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toUpdateBackendConfig", []))

    @jsii.member(jsii_name="toUpdateBackendJob")
    def to_update_backend_job(self) -> "Amplifybackend":
        '''(experimental) Grants permission to update a job of an existing Amplify Admin backend environment by appId and backendEnvironmentName.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-job-backendenvironmentname-jobid.html#UpdateBackendJob

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toUpdateBackendJob", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Apigateway(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Apigateway",
):
    '''(experimental) Statement provider for service `apigateway <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonapigatewaymanagement.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `apigateway <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonapigatewaymanagement.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Apigateway, self, [sid])

    @jsii.member(jsii_name="ifRequestAccessLoggingDestination")
    def if_request_access_logging_destination(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by access log destination. Available during the CreateStage and UpdateStage operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Stage
        - Stages

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "ifRequestAccessLoggingDestination", [value, operator]))

    @jsii.member(jsii_name="ifRequestAccessLoggingFormat")
    def if_request_access_logging_format(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by access log format. Available during the CreateStage and UpdateStage operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Stage
        - Stages

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "ifRequestAccessLoggingFormat", [value, operator]))

    @jsii.member(jsii_name="ifRequestApiKeyRequired")
    def if_request_api_key_required(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access based on whether an API key is required or not.

        Available during the CreateMethod and PutMethod operations. Also available as a collection during import and reimport

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Method
        - RestApi
        - RestApis

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "ifRequestApiKeyRequired", [value]))

    @jsii.member(jsii_name="ifRequestApiName")
    def if_request_api_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by API name. Available during the CreateRestApi and UpdateRestApi operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - RestApi
        - RestApis

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "ifRequestApiName", [value, operator]))

    @jsii.member(jsii_name="ifRequestAuthorizerType")
    def if_request_authorizer_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by type of authorizer in the request, for example TOKEN, REQUEST, JWT.

        Available during CreateAuthorizer and UpdateAuthorizer. Also available during import and reimport as an ArrayOfString

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Authorizer
        - Authorizers
        - RestApi
        - RestApis

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "ifRequestAuthorizerType", [value, operator]))

    @jsii.member(jsii_name="ifRequestAuthorizerUri")
    def if_request_authorizer_uri(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by URI of a Lambda authorizer function.

        Available during CreateAuthorizer and UpdateAuthorizer. Also available during import and reimport as an ArrayOfString

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Authorizer
        - Authorizers
        - RestApi
        - RestApis

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "ifRequestAuthorizerUri", [value, operator]))

    @jsii.member(jsii_name="ifRequestDisableExecuteApiEndpoint")
    def if_request_disable_execute_api_endpoint(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by status of the default execute-api endpoint. Available during the CreateRestApi and DeleteRestApi operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - RestApi
        - RestApis

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "ifRequestDisableExecuteApiEndpoint", [value]))

    @jsii.member(jsii_name="ifRequestEndpointType")
    def if_request_endpoint_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by endpoint type. Available during the CreateDomainName, UpdateDomainName, CreateRestApi, and UpdateRestApi operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - DomainName
        - DomainNames
        - RestApi
        - RestApis

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "ifRequestEndpointType", [value, operator]))

    @jsii.member(jsii_name="ifRequestMtlsTrustStoreUri")
    def if_request_mtls_trust_store_uri(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by URI of the truststore used for mutual TLS authentication. Available during the CreateDomainName and UpdateDomainName operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - DomainName
        - DomainNames

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "ifRequestMtlsTrustStoreUri", [value, operator]))

    @jsii.member(jsii_name="ifRequestMtlsTrustStoreVersion")
    def if_request_mtls_trust_store_version(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by version of the truststore used for mutual TLS authentication. Available during the CreateDomainName and UpdateDomainName operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - DomainName
        - DomainNames

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "ifRequestMtlsTrustStoreVersion", [value, operator]))

    @jsii.member(jsii_name="ifRequestRouteAuthorizationType")
    def if_request_route_authorization_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by authorization type, for example NONE, AWS_IAM, CUSTOM, JWT, COGNITO_USER_POOLS.

        Available during the CreateMethod and PutMethod operations Also available as a collection during import

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Method
        - RestApi
        - RestApis

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "ifRequestRouteAuthorizationType", [value, operator]))

    @jsii.member(jsii_name="ifRequestSecurityPolicy")
    def if_request_security_policy(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by TLS version. Available during the CreateDomain and UpdateDomain operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - DomainName
        - DomainNames

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "ifRequestSecurityPolicy", [value, operator]))

    @jsii.member(jsii_name="ifRequestStageName")
    def if_request_stage_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by stage name of the deployment that you attempt to create. Available during the CreateDeployment operation.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Deployments

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "ifRequestStageName", [value, operator]))

    @jsii.member(jsii_name="ifResourceAccessLoggingDestination")
    def if_resource_access_logging_destination(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by access log destination of the current Stage resource. Available during the UpdateStage and DeleteStage operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Stage

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "ifResourceAccessLoggingDestination", [value, operator]))

    @jsii.member(jsii_name="ifResourceAccessLoggingFormat")
    def if_resource_access_logging_format(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by access log format of the current Stage resource. Available during the UpdateStage and DeleteStage operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Stage

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "ifResourceAccessLoggingFormat", [value, operator]))

    @jsii.member(jsii_name="ifResourceApiKeyRequired")
    def if_resource_api_key_required(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access based on whether an API key is required or not for the existing Method resource.

        Available during the PutMethod and DeleteMethod operations. Also available as a collection during reimport

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Method
        - RestApi

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "ifResourceApiKeyRequired", [value]))

    @jsii.member(jsii_name="ifResourceApiName")
    def if_resource_api_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by API name of the existing RestApi resource. Available during UpdateRestApi and DeleteRestApi operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - RestApi

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "ifResourceApiName", [value, operator]))

    @jsii.member(jsii_name="ifResourceAuthorizerType")
    def if_resource_authorizer_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by the current type of authorizer, for example TOKEN, REQUEST, JWT.

        Available during UpdateAuthorizer and DeleteAuthorizer operations. Also available during reimport as an ArrayOfString

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Authorizer
        - RestApi

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "ifResourceAuthorizerType", [value, operator]))

    @jsii.member(jsii_name="ifResourceAuthorizerUri")
    def if_resource_authorizer_uri(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by URI of a Lambda authorizer function.

        Available during UpdateAuthorizer and DeleteAuthorizer operations. Also available during reimport as an ArrayOfString

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Authorizer
        - RestApi

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "ifResourceAuthorizerUri", [value, operator]))

    @jsii.member(jsii_name="ifResourceDisableExecuteApiEndpoint")
    def if_resource_disable_execute_api_endpoint(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by status of the default execute-api endpoint of the current RestApi resource.

        Available during UpdateRestApi and DeleteRestApi operations

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - RestApi

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "ifResourceDisableExecuteApiEndpoint", [value]))

    @jsii.member(jsii_name="ifResourceEndpointType")
    def if_resource_endpoint_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by endpoint type. Available during the UpdateDomainName, DeleteDomainName, UpdateRestApi, and DeleteRestApi operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - DomainName
        - RestApi

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "ifResourceEndpointType", [value, operator]))

    @jsii.member(jsii_name="ifResourceMtlsTrustStoreUri")
    def if_resource_mtls_trust_store_uri(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by URI of the truststore used for mutual TLS authentication. Available during UpdateDomainName and DeleteDomainName operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - DomainName

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "ifResourceMtlsTrustStoreUri", [value, operator]))

    @jsii.member(jsii_name="ifResourceMtlsTrustStoreVersion")
    def if_resource_mtls_trust_store_version(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by version of the truststore used for mutual TLS authentication. Available during UpdateDomainName and DeleteDomainName operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - DomainName

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "ifResourceMtlsTrustStoreVersion", [value, operator]))

    @jsii.member(jsii_name="ifResourceRouteAuthorizationType")
    def if_resource_route_authorization_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by authorization type of the existing Method resource, for example NONE, AWS_IAM, CUSTOM, JWT, COGNITO_USER_POOLS.

        Available during the PutMethod and DeleteMethod operations. Also available as a collection during reimport

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Method
        - RestApi

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "ifResourceRouteAuthorizationType", [value, operator]))

    @jsii.member(jsii_name="ifResourceSecurityPolicy")
    def if_resource_security_policy(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by TLS version. Available during UpdateDomain and DeleteDomain operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - DomainName

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "ifResourceSecurityPolicy", [value, operator]))

    @jsii.member(jsii_name="onAccount")
    def on_account(
        self,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type Account to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onAccount", [region, partition]))

    @jsii.member(jsii_name="onApiKey")
    def on_api_key(
        self,
        api_key_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type ApiKey to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_key_id: - Identifier for the apiKeyId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onApiKey", [api_key_id, region, partition]))

    @jsii.member(jsii_name="onApiKeys")
    def on_api_keys(
        self,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type ApiKeys to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onApiKeys", [region, partition]))

    @jsii.member(jsii_name="onAuthorizer")
    def on_authorizer(
        self,
        rest_api_id: builtins.str,
        authorizer_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type Authorizer to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param authorizer_id: - Identifier for the authorizerId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifRequestAuthorizerType() - .ifRequestAuthorizerUri() - .ifResourceAuthorizerType() - .ifResourceAuthorizerUri()

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onAuthorizer", [rest_api_id, authorizer_id, region, partition]))

    @jsii.member(jsii_name="onAuthorizers")
    def on_authorizers(
        self,
        rest_api_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type Authorizers to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifRequestAuthorizerType() - .ifRequestAuthorizerUri()

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onAuthorizers", [rest_api_id, region, partition]))

    @jsii.member(jsii_name="onBasePathMapping")
    def on_base_path_mapping(
        self,
        domain_name: builtins.str,
        base_path: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type BasePathMapping to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param domain_name: - Identifier for the domainName.
        :param base_path: - Identifier for the basePath.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onBasePathMapping", [domain_name, base_path, region, partition]))

    @jsii.member(jsii_name="onBasePathMappings")
    def on_base_path_mappings(
        self,
        domain_name: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type BasePathMappings to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param domain_name: - Identifier for the domainName.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onBasePathMappings", [domain_name, region, partition]))

    @jsii.member(jsii_name="onClientCertificate")
    def on_client_certificate(
        self,
        client_certificate_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type ClientCertificate to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param client_certificate_id: - Identifier for the clientCertificateId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onClientCertificate", [client_certificate_id, region, partition]))

    @jsii.member(jsii_name="onClientCertificates")
    def on_client_certificates(
        self,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type ClientCertificates to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onClientCertificates", [region, partition]))

    @jsii.member(jsii_name="onDeployment")
    def on_deployment(
        self,
        rest_api_id: builtins.str,
        deployment_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type Deployment to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param deployment_id: - Identifier for the deploymentId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onDeployment", [rest_api_id, deployment_id, region, partition]))

    @jsii.member(jsii_name="onDeployments")
    def on_deployments(
        self,
        rest_api_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type Deployments to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifRequestStageName()

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onDeployments", [rest_api_id, region, partition]))

    @jsii.member(jsii_name="onDocumentationPart")
    def on_documentation_part(
        self,
        rest_api_id: builtins.str,
        documentation_part_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type DocumentationPart to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param documentation_part_id: - Identifier for the documentationPartId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onDocumentationPart", [rest_api_id, documentation_part_id, region, partition]))

    @jsii.member(jsii_name="onDocumentationParts")
    def on_documentation_parts(
        self,
        rest_api_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type DocumentationParts to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onDocumentationParts", [rest_api_id, region, partition]))

    @jsii.member(jsii_name="onDocumentationVersion")
    def on_documentation_version(
        self,
        rest_api_id: builtins.str,
        documentation_version_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type DocumentationVersion to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param documentation_version_id: - Identifier for the documentationVersionId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onDocumentationVersion", [rest_api_id, documentation_version_id, region, partition]))

    @jsii.member(jsii_name="onDocumentationVersions")
    def on_documentation_versions(
        self,
        rest_api_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type DocumentationVersions to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onDocumentationVersions", [rest_api_id, region, partition]))

    @jsii.member(jsii_name="onDomainName")
    def on_domain_name(
        self,
        domain_name: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type DomainName to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param domain_name: - Identifier for the domainName.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifRequestEndpointType() - .ifRequestMtlsTrustStoreUri() - .ifRequestMtlsTrustStoreVersion() - .ifRequestSecurityPolicy() - .ifResourceEndpointType() - .ifResourceMtlsTrustStoreUri() - .ifResourceMtlsTrustStoreVersion() - .ifResourceSecurityPolicy()

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onDomainName", [domain_name, region, partition]))

    @jsii.member(jsii_name="onDomainNames")
    def on_domain_names(
        self,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type DomainNames to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifRequestEndpointType() - .ifRequestMtlsTrustStoreUri() - .ifRequestMtlsTrustStoreVersion() - .ifRequestSecurityPolicy()

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onDomainNames", [region, partition]))

    @jsii.member(jsii_name="onGatewayResponse")
    def on_gateway_response(
        self,
        rest_api_id: builtins.str,
        response_type: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type GatewayResponse to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param response_type: - Identifier for the responseType.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onGatewayResponse", [rest_api_id, response_type, region, partition]))

    @jsii.member(jsii_name="onGatewayResponses")
    def on_gateway_responses(
        self,
        rest_api_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type GatewayResponses to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onGatewayResponses", [rest_api_id, region, partition]))

    @jsii.member(jsii_name="onIntegration")
    def on_integration(
        self,
        rest_api_id: builtins.str,
        resource_id: builtins.str,
        http_method_type: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type Integration to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param resource_id: - Identifier for the resourceId.
        :param http_method_type: - Identifier for the httpMethodType.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onIntegration", [rest_api_id, resource_id, http_method_type, region, partition]))

    @jsii.member(jsii_name="onIntegrationResponse")
    def on_integration_response(
        self,
        rest_api_id: builtins.str,
        resource_id: builtins.str,
        http_method_type: builtins.str,
        status_code: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type IntegrationResponse to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param resource_id: - Identifier for the resourceId.
        :param http_method_type: - Identifier for the httpMethodType.
        :param status_code: - Identifier for the statusCode.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onIntegrationResponse", [rest_api_id, resource_id, http_method_type, status_code, region, partition]))

    @jsii.member(jsii_name="onMethod")
    def on_method(
        self,
        rest_api_id: builtins.str,
        resource_id: builtins.str,
        http_method_type: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type Method to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param resource_id: - Identifier for the resourceId.
        :param http_method_type: - Identifier for the httpMethodType.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifRequestApiKeyRequired() - .ifRequestRouteAuthorizationType() - .ifResourceApiKeyRequired() - .ifResourceRouteAuthorizationType()

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onMethod", [rest_api_id, resource_id, http_method_type, region, partition]))

    @jsii.member(jsii_name="onMethodResponse")
    def on_method_response(
        self,
        rest_api_id: builtins.str,
        resource_id: builtins.str,
        http_method_type: builtins.str,
        status_code: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type MethodResponse to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param resource_id: - Identifier for the resourceId.
        :param http_method_type: - Identifier for the httpMethodType.
        :param status_code: - Identifier for the statusCode.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onMethodResponse", [rest_api_id, resource_id, http_method_type, status_code, region, partition]))

    @jsii.member(jsii_name="onModel")
    def on_model(
        self,
        rest_api_id: builtins.str,
        model_name: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type Model to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param model_name: - Identifier for the modelName.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onModel", [rest_api_id, model_name, region, partition]))

    @jsii.member(jsii_name="onModels")
    def on_models(
        self,
        rest_api_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type Models to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onModels", [rest_api_id, region, partition]))

    @jsii.member(jsii_name="onRequestValidator")
    def on_request_validator(
        self,
        rest_api_id: builtins.str,
        request_validator_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type RequestValidator to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param request_validator_id: - Identifier for the requestValidatorId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onRequestValidator", [rest_api_id, request_validator_id, region, partition]))

    @jsii.member(jsii_name="onRequestValidators")
    def on_request_validators(
        self,
        rest_api_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type RequestValidators to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onRequestValidators", [rest_api_id, region, partition]))

    @jsii.member(jsii_name="onResource")
    def on_resource(
        self,
        rest_api_id: builtins.str,
        resource_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type Resource to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param resource_id: - Identifier for the resourceId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onResource", [rest_api_id, resource_id, region, partition]))

    @jsii.member(jsii_name="onResources")
    def on_resources(
        self,
        rest_api_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type Resources to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onResources", [rest_api_id, region, partition]))

    @jsii.member(jsii_name="onRestApi")
    def on_rest_api(
        self,
        rest_api_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type RestApi to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifRequestApiKeyRequired() - .ifRequestApiName() - .ifRequestAuthorizerType() - .ifRequestAuthorizerUri() - .ifRequestDisableExecuteApiEndpoint() - .ifRequestEndpointType() - .ifRequestRouteAuthorizationType() - .ifResourceApiKeyRequired() - .ifResourceApiName() - .ifResourceAuthorizerType() - .ifResourceAuthorizerUri() - .ifResourceDisableExecuteApiEndpoint() - .ifResourceEndpointType() - .ifResourceRouteAuthorizationType()

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onRestApi", [rest_api_id, region, partition]))

    @jsii.member(jsii_name="onRestApis")
    def on_rest_apis(
        self,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type RestApis to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifRequestApiKeyRequired() - .ifRequestApiName() - .ifRequestAuthorizerType() - .ifRequestAuthorizerUri() - .ifRequestDisableExecuteApiEndpoint() - .ifRequestEndpointType() - .ifRequestRouteAuthorizationType()

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onRestApis", [region, partition]))

    @jsii.member(jsii_name="onSdk")
    def on_sdk(
        self,
        rest_api_id: builtins.str,
        stage_name: builtins.str,
        sdk_type: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type Sdk to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param stage_name: - Identifier for the stageName.
        :param sdk_type: - Identifier for the sdkType.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onSdk", [rest_api_id, stage_name, sdk_type, region, partition]))

    @jsii.member(jsii_name="onStage")
    def on_stage(
        self,
        rest_api_id: builtins.str,
        stage_name: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type Stage to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param stage_name: - Identifier for the stageName.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifRequestAccessLoggingDestination() - .ifRequestAccessLoggingFormat() - .ifResourceAccessLoggingDestination() - .ifResourceAccessLoggingFormat()

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onStage", [rest_api_id, stage_name, region, partition]))

    @jsii.member(jsii_name="onStages")
    def on_stages(
        self,
        rest_api_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type Stages to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifRequestAccessLoggingDestination() - .ifRequestAccessLoggingFormat()

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onStages", [rest_api_id, region, partition]))

    @jsii.member(jsii_name="onTemplate")
    def on_template(
        self,
        model_name: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type Template to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param model_name: - Identifier for the modelName.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onTemplate", [model_name, region, partition]))

    @jsii.member(jsii_name="onUsagePlan")
    def on_usage_plan(
        self,
        usage_plan_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type UsagePlan to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param usage_plan_id: - Identifier for the usagePlanId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onUsagePlan", [usage_plan_id, region, partition]))

    @jsii.member(jsii_name="onUsagePlanKey")
    def on_usage_plan_key(
        self,
        usage_plan_id: builtins.str,
        id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type UsagePlanKey to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param usage_plan_id: - Identifier for the usagePlanId.
        :param id: - Identifier for the id.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onUsagePlanKey", [usage_plan_id, id, region, partition]))

    @jsii.member(jsii_name="onUsagePlanKeys")
    def on_usage_plan_keys(
        self,
        usage_plan_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type UsagePlanKeys to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param usage_plan_id: - Identifier for the usagePlanId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onUsagePlanKeys", [usage_plan_id, region, partition]))

    @jsii.member(jsii_name="onUsagePlans")
    def on_usage_plans(
        self,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type UsagePlans to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onUsagePlans", [region, partition]))

    @jsii.member(jsii_name="onVpcLink")
    def on_vpc_link(
        self,
        vpc_link_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type VpcLink to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param vpc_link_id: - Identifier for the vpcLinkId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onVpcLink", [vpc_link_id, region, partition]))

    @jsii.member(jsii_name="onVpcLinks")
    def on_vpc_links(
        self,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type VpcLinks to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "onVpcLinks", [region, partition]))

    @jsii.member(jsii_name="toAddCertificateToDomain")
    def to_add_certificate_to_domain(self) -> "Apigateway":
        '''(experimental) Grants permission to add certificates for mutual TLS authentication to a domain name.

        This is an additional authorization control for managing the DomainName resource due to the sensitive nature of mTLS

        Access Level: Permissions management

        https://docs.aws.amazon.com/apigateway/api-reference/ADD_CERTIFICATE_TO_DOMAIN.html

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "toAddCertificateToDomain", []))

    @jsii.member(jsii_name="toDELETE")
    def to_delete(self) -> "Apigateway":
        '''(experimental) Grants permission to delete a particular resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/apigateway/api-reference/API_DELETE.html

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "toDELETE", []))

    @jsii.member(jsii_name="toGET")
    def to_get(self) -> "Apigateway":
        '''(experimental) Grants permission to read a particular resource.

        Access Level: Read

        https://docs.aws.amazon.com/apigateway/api-reference/API_GET.html

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "toGET", []))

    @jsii.member(jsii_name="toPATCH")
    def to_patch(self) -> "Apigateway":
        '''(experimental) Grants permission to update a particular resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/apigateway/api-reference/API_PATCH.html

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "toPATCH", []))

    @jsii.member(jsii_name="toPOST")
    def to_post(self) -> "Apigateway":
        '''(experimental) Grants permission to create a particular resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/apigateway/api-reference/API_POST.html

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "toPOST", []))

    @jsii.member(jsii_name="toPUT")
    def to_put(self) -> "Apigateway":
        '''(experimental) Grants permission to update a particular resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/apigateway/api-reference/API_PUT.html

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "toPUT", []))

    @jsii.member(jsii_name="toRemoveCertificateFromDomain")
    def to_remove_certificate_from_domain(self) -> "Apigateway":
        '''(experimental) Grants permission to remove certificates for mutual TLS authentication from a domain name.

        This is an additional authorization control for managing the DomainName resource due to the sensitive nature of mTLS

        Access Level: Permissions management

        https://docs.aws.amazon.com/apigateway/api-reference/REMOVE_CERTIFICATE_FROM_DOMAIN.html

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "toRemoveCertificateFromDomain", []))

    @jsii.member(jsii_name="toSetWebACL")
    def to_set_web_acl(self) -> "Apigateway":
        '''(experimental) Grants permission set a WAF access control list (ACL).

        This is an additional authorization control for managing the Stage resource due to the sensitive nature of WebAcl's

        Access Level: Permissions management

        https://docs.aws.amazon.com/apigateway/api-reference/WEBACL_SET.html

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "toSetWebACL", []))

    @jsii.member(jsii_name="toUpdateRestApiPolicy")
    def to_update_rest_api_policy(self) -> "Apigateway":
        '''(experimental) Grants permission to manage the IAM resource policy for an API.

        This is an additional authorization control for managing an API due to the sensitive nature of the resource policy

        Access Level: Permissions management

        https://docs.aws.amazon.com/apigateway/api-reference/UPDATE_REST_API_POLICY.html

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "toUpdateRestApiPolicy", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class ApigatewayV2(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.ApigatewayV2",
):
    '''(experimental) Statement provider for service `apigateway-v2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonapigatewaymanagementv2.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `apigateway-v2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonapigatewaymanagementv2.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(ApigatewayV2, self, [sid])

    @jsii.member(jsii_name="ifRequestAccessLoggingDestination")
    def if_request_access_logging_destination(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by access log destination. Available during the CreateStage and UpdateStage operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Stage
        - Stages

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifRequestAccessLoggingDestination", [value, operator]))

    @jsii.member(jsii_name="ifRequestAccessLoggingFormat")
    def if_request_access_logging_format(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by access log format. Available during the CreateStage and UpdateStage operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Stage
        - Stages

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifRequestAccessLoggingFormat", [value, operator]))

    @jsii.member(jsii_name="ifRequestApiKeyRequired")
    def if_request_api_key_required(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access based on whether an API key is required or not.

        Available during the CreateRoute and UpdateRoute operations. Also available as a collection during import and reimport

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Api
        - Apis
        - Route
        - Routes

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifRequestApiKeyRequired", [value]))

    @jsii.member(jsii_name="ifRequestApiName")
    def if_request_api_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by API name. Available during the CreateApi and UpdateApi operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Api
        - Apis

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifRequestApiName", [value, operator]))

    @jsii.member(jsii_name="ifRequestAuthorizerType")
    def if_request_authorizer_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by type of authorizer in the request, for example REQUEST or JWT.

        Available during CreateAuthorizer and UpdateAuthorizer. Also available during import and reimport as an ArrayOfString

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Api
        - Apis
        - Authorizer
        - Authorizers

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifRequestAuthorizerType", [value, operator]))

    @jsii.member(jsii_name="ifRequestAuthorizerUri")
    def if_request_authorizer_uri(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by URI of a Lambda authorizer function.

        Available during CreateAuthorizer and UpdateAuthorizer. Also available during import and reimport as an ArrayOfString

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Api
        - Apis
        - Authorizer
        - Authorizers

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifRequestAuthorizerUri", [value, operator]))

    @jsii.member(jsii_name="ifRequestDisableExecuteApiEndpoint")
    def if_request_disable_execute_api_endpoint(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by status of the default execute-api endpoint. Available during the CreateApi and UpdateApi operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Api
        - Apis

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifRequestDisableExecuteApiEndpoint", [value]))

    @jsii.member(jsii_name="ifRequestEndpointType")
    def if_request_endpoint_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by endpoint type. Available during the CreateDomainName, UpdateDomainName, CreateApi, and UpdateApi operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Api
        - Apis

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifRequestEndpointType", [value, operator]))

    @jsii.member(jsii_name="ifRequestMtlsTrustStoreUri")
    def if_request_mtls_trust_store_uri(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by URI of the truststore used for mutual TLS authentication. Available during the CreateDomainName and UpdateDomainName operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifRequestMtlsTrustStoreUri", [value, operator]))

    @jsii.member(jsii_name="ifRequestMtlsTrustStoreVersion")
    def if_request_mtls_trust_store_version(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by version of the truststore used for mutual TLS authentication. Available during the CreateDomainName and UpdateDomainName operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifRequestMtlsTrustStoreVersion", [value, operator]))

    @jsii.member(jsii_name="ifRequestRouteAuthorizationType")
    def if_request_route_authorization_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by authorization type, for example NONE, AWS_IAM, CUSTOM, JWT.

        Available during the CreateRoute and UpdateRoute operations. Also available as a collection during import

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Api
        - Apis
        - Route
        - Routes

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifRequestRouteAuthorizationType", [value, operator]))

    @jsii.member(jsii_name="ifRequestSecurityPolicy")
    def if_request_security_policy(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by TLS version. Available during the CreateDomain and UpdateDomain operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifRequestSecurityPolicy", [value, operator]))

    @jsii.member(jsii_name="ifRequestStageName")
    def if_request_stage_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by stage name of the deployment that you attempt to create. Available during the CreateDeployment operation.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Deployments

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifRequestStageName", [value, operator]))

    @jsii.member(jsii_name="ifResourceAccessLoggingDestination")
    def if_resource_access_logging_destination(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by access log destination of the current Stage resource. Available during the UpdateStage and DeleteStage operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Stage

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifResourceAccessLoggingDestination", [value, operator]))

    @jsii.member(jsii_name="ifResourceAccessLoggingFormat")
    def if_resource_access_logging_format(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by access log format of the current Stage resource. Available during the UpdateStage and DeleteStage operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Stage

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifResourceAccessLoggingFormat", [value, operator]))

    @jsii.member(jsii_name="ifResourceApiKeyRequired")
    def if_resource_api_key_required(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access based on whether an API key is required or not for the existing Route resource.

        Available during the UpdateRoute and DeleteRoute operations. Also available as a collection during reimport

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Api
        - Route

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifResourceApiKeyRequired", [value]))

    @jsii.member(jsii_name="ifResourceApiName")
    def if_resource_api_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by API name. Available during the UpdateApi and DeleteApi operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Api

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifResourceApiName", [value, operator]))

    @jsii.member(jsii_name="ifResourceAuthorizerType")
    def if_resource_authorizer_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by the current type of authorizer, for example REQUEST or JWT.

        Available during UpdateAuthorizer and DeleteAuthorizer operations. Also available during import and reimport as an ArrayOfString

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Api
        - Authorizer

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifResourceAuthorizerType", [value, operator]))

    @jsii.member(jsii_name="ifResourceAuthorizerUri")
    def if_resource_authorizer_uri(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by the URI of the current Lambda authorizer associated with the current API.

        Available during UpdateAuthorizer and DeleteAuthorizer. Also available as a collection during reimport

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Api
        - Authorizer

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifResourceAuthorizerUri", [value, operator]))

    @jsii.member(jsii_name="ifResourceDisableExecuteApiEndpoint")
    def if_resource_disable_execute_api_endpoint(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by status of the default execute-api endpoint. Available during the UpdateApi and DeleteApi operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Api

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifResourceDisableExecuteApiEndpoint", [value]))

    @jsii.member(jsii_name="ifResourceEndpointType")
    def if_resource_endpoint_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by endpoint type. Available during the UpdateDomainName, DeleteDomainName, UpdateApi, and DeleteApi operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Api

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifResourceEndpointType", [value, operator]))

    @jsii.member(jsii_name="ifResourceMtlsTrustStoreUri")
    def if_resource_mtls_trust_store_uri(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by URI of the truststore used for mutual TLS authentication. Available during the UpdateDomainName and DeleteDomainName operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifResourceMtlsTrustStoreUri", [value, operator]))

    @jsii.member(jsii_name="ifResourceMtlsTrustStoreVersion")
    def if_resource_mtls_trust_store_version(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by version of the truststore used for mutual TLS authentication. Available during the UpdateDomainName and DeleteDomainName operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifResourceMtlsTrustStoreVersion", [value, operator]))

    @jsii.member(jsii_name="ifResourceRouteAuthorizationType")
    def if_resource_route_authorization_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) ilters access by authorization type of the existing Route resource, for example NONE, AWS_IAM, CUSTOM.

        Available during the UpdateRoute and DeleteRoute operations. Also available as a collection during reimport

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Api
        - Route

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifResourceRouteAuthorizationType", [value, operator]))

    @jsii.member(jsii_name="ifResourceSecurityPolicy")
    def if_resource_security_policy(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by TLS version. Available during the UpdateDomainName and DeleteDomainName operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifResourceSecurityPolicy", [value, operator]))

    @jsii.member(jsii_name="onAccessLogSettings")
    def on_access_log_settings(
        self,
        api_id: builtins.str,
        stage_name: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type AccessLogSettings to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param stage_name: - Identifier for the stageName.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onAccessLogSettings", [api_id, stage_name, region, partition]))

    @jsii.member(jsii_name="onApi")
    def on_api(
        self,
        api_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type Api to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifRequestApiKeyRequired() - .ifRequestApiName() - .ifRequestAuthorizerType() - .ifRequestAuthorizerUri() - .ifRequestDisableExecuteApiEndpoint() - .ifRequestEndpointType() - .ifRequestRouteAuthorizationType() - .ifResourceApiKeyRequired() - .ifResourceApiName() - .ifResourceAuthorizerType() - .ifResourceAuthorizerUri() - .ifResourceDisableExecuteApiEndpoint() - .ifResourceEndpointType() - .ifResourceRouteAuthorizationType()

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onApi", [api_id, region, partition]))

    @jsii.member(jsii_name="onApiMapping")
    def on_api_mapping(
        self,
        domain_name: builtins.str,
        api_mapping_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type ApiMapping to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param domain_name: - Identifier for the domainName.
        :param api_mapping_id: - Identifier for the apiMappingId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onApiMapping", [domain_name, api_mapping_id, region, partition]))

    @jsii.member(jsii_name="onApiMappings")
    def on_api_mappings(
        self,
        domain_name: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type ApiMappings to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param domain_name: - Identifier for the domainName.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onApiMappings", [domain_name, region, partition]))

    @jsii.member(jsii_name="onApis")
    def on_apis(
        self,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type Apis to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifRequestApiKeyRequired() - .ifRequestApiName() - .ifRequestAuthorizerType() - .ifRequestAuthorizerUri() - .ifRequestDisableExecuteApiEndpoint() - .ifRequestEndpointType() - .ifRequestRouteAuthorizationType()

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onApis", [region, partition]))

    @jsii.member(jsii_name="onAuthorizer")
    def on_authorizer(
        self,
        api_id: builtins.str,
        authorizer_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type Authorizer to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param authorizer_id: - Identifier for the authorizerId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifRequestAuthorizerType() - .ifRequestAuthorizerUri() - .ifResourceAuthorizerType() - .ifResourceAuthorizerUri()

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onAuthorizer", [api_id, authorizer_id, region, partition]))

    @jsii.member(jsii_name="onAuthorizers")
    def on_authorizers(
        self,
        api_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type Authorizers to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifRequestAuthorizerType() - .ifRequestAuthorizerUri()

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onAuthorizers", [api_id, region, partition]))

    @jsii.member(jsii_name="onAuthorizersCache")
    def on_authorizers_cache(
        self,
        api_id: builtins.str,
        stage_name: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type AuthorizersCache to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param stage_name: - Identifier for the stageName.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onAuthorizersCache", [api_id, stage_name, region, partition]))

    @jsii.member(jsii_name="onCors")
    def on_cors(
        self,
        api_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type Cors to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onCors", [api_id, region, partition]))

    @jsii.member(jsii_name="onDeployment")
    def on_deployment(
        self,
        api_id: builtins.str,
        deployment_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type Deployment to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param deployment_id: - Identifier for the deploymentId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onDeployment", [api_id, deployment_id, region, partition]))

    @jsii.member(jsii_name="onDeployments")
    def on_deployments(
        self,
        api_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type Deployments to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifRequestStageName()

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onDeployments", [api_id, region, partition]))

    @jsii.member(jsii_name="onExportedAPI")
    def on_exported_api(
        self,
        api_id: builtins.str,
        specification: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type ExportedAPI to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param specification: - Identifier for the specification.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onExportedAPI", [api_id, specification, region, partition]))

    @jsii.member(jsii_name="onIntegration")
    def on_integration(
        self,
        api_id: builtins.str,
        integration_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type Integration to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param integration_id: - Identifier for the integrationId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onIntegration", [api_id, integration_id, region, partition]))

    @jsii.member(jsii_name="onIntegrationResponse")
    def on_integration_response(
        self,
        api_id: builtins.str,
        integration_id: builtins.str,
        integration_response_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type IntegrationResponse to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param integration_id: - Identifier for the integrationId.
        :param integration_response_id: - Identifier for the integrationResponseId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onIntegrationResponse", [api_id, integration_id, integration_response_id, region, partition]))

    @jsii.member(jsii_name="onIntegrationResponses")
    def on_integration_responses(
        self,
        api_id: builtins.str,
        integration_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type IntegrationResponses to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param integration_id: - Identifier for the integrationId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onIntegrationResponses", [api_id, integration_id, region, partition]))

    @jsii.member(jsii_name="onIntegrations")
    def on_integrations(
        self,
        api_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type Integrations to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onIntegrations", [api_id, region, partition]))

    @jsii.member(jsii_name="onModel")
    def on_model(
        self,
        api_id: builtins.str,
        model_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type Model to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param model_id: - Identifier for the modelId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onModel", [api_id, model_id, region, partition]))

    @jsii.member(jsii_name="onModels")
    def on_models(
        self,
        api_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type Models to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onModels", [api_id, region, partition]))

    @jsii.member(jsii_name="onModelTemplate")
    def on_model_template(
        self,
        api_id: builtins.str,
        model_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type ModelTemplate to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param model_id: - Identifier for the modelId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onModelTemplate", [api_id, model_id, region, partition]))

    @jsii.member(jsii_name="onRoute")
    def on_route(
        self,
        api_id: builtins.str,
        route_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type Route to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param route_id: - Identifier for the routeId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifRequestApiKeyRequired() - .ifRequestRouteAuthorizationType() - .ifResourceApiKeyRequired() - .ifResourceRouteAuthorizationType()

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onRoute", [api_id, route_id, region, partition]))

    @jsii.member(jsii_name="onRouteRequestParameter")
    def on_route_request_parameter(
        self,
        api_id: builtins.str,
        route_id: builtins.str,
        request_parameter_key: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type RouteRequestParameter to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param route_id: - Identifier for the routeId.
        :param request_parameter_key: - Identifier for the requestParameterKey.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onRouteRequestParameter", [api_id, route_id, request_parameter_key, region, partition]))

    @jsii.member(jsii_name="onRouteResponse")
    def on_route_response(
        self,
        api_id: builtins.str,
        route_id: builtins.str,
        route_response_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type RouteResponse to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param route_id: - Identifier for the routeId.
        :param route_response_id: - Identifier for the routeResponseId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onRouteResponse", [api_id, route_id, route_response_id, region, partition]))

    @jsii.member(jsii_name="onRouteResponses")
    def on_route_responses(
        self,
        api_id: builtins.str,
        route_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type RouteResponses to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param route_id: - Identifier for the routeId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onRouteResponses", [api_id, route_id, region, partition]))

    @jsii.member(jsii_name="onRoutes")
    def on_routes(
        self,
        api_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type Routes to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifRequestApiKeyRequired() - .ifRequestRouteAuthorizationType()

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onRoutes", [api_id, region, partition]))

    @jsii.member(jsii_name="onRouteSettings")
    def on_route_settings(
        self,
        api_id: builtins.str,
        stage_name: builtins.str,
        route_key: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type RouteSettings to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param stage_name: - Identifier for the stageName.
        :param route_key: - Identifier for the routeKey.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onRouteSettings", [api_id, stage_name, route_key, region, partition]))

    @jsii.member(jsii_name="onStage")
    def on_stage(
        self,
        api_id: builtins.str,
        stage_name: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type Stage to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param stage_name: - Identifier for the stageName.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifRequestAccessLoggingDestination() - .ifRequestAccessLoggingFormat() - .ifResourceAccessLoggingDestination() - .ifResourceAccessLoggingFormat()

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onStage", [api_id, stage_name, region, partition]))

    @jsii.member(jsii_name="onStages")
    def on_stages(
        self,
        api_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type Stages to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifRequestAccessLoggingDestination() - .ifRequestAccessLoggingFormat()

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onStages", [api_id, region, partition]))

    @jsii.member(jsii_name="toDELETE")
    def to_delete(self) -> "ApigatewayV2":
        '''(experimental) Grants permission to delete a particular resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/apigatewayv2/api-reference/API_DELETE.html

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "toDELETE", []))

    @jsii.member(jsii_name="toGET")
    def to_get(self) -> "ApigatewayV2":
        '''(experimental) Grants permission to read a particular resource.

        Access Level: Read

        https://docs.aws.amazon.com/apigatewayv2/api-reference/API_GET.html

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "toGET", []))

    @jsii.member(jsii_name="toPATCH")
    def to_patch(self) -> "ApigatewayV2":
        '''(experimental) Grants permission to update a particular resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/apigatewayv2/api-reference/API_PATCH.html

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "toPATCH", []))

    @jsii.member(jsii_name="toPOST")
    def to_post(self) -> "ApigatewayV2":
        '''(experimental) Grants permission to create a particular resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/apigatewayv2/api-reference/API_POST.html

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "toPOST", []))

    @jsii.member(jsii_name="toPUT")
    def to_put(self) -> "ApigatewayV2":
        '''(experimental) Grants permission to update a particular resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/apigatewayv2/api-reference/API_PUT.html

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "toPUT", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class AppIntegrations(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.AppIntegrations",
):
    '''(experimental) Statement provider for service `app-integrations <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonappintegrations.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `app-integrations <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonappintegrations.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(AppIntegrations, self, [sid])

    @jsii.member(jsii_name="onEventIntegration")
    def on_event_integration(
        self,
        event_integration_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "AppIntegrations":
        '''(experimental) Adds a resource of type event-integration to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/API_EventIntegration.html

        :param event_integration_name: - Identifier for the eventIntegrationName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("AppIntegrations", jsii.invoke(self, "onEventIntegration", [event_integration_name, account, region, partition]))

    @jsii.member(jsii_name="onEventIntegrationAssociation")
    def on_event_integration_association(
        self,
        event_integration_name: builtins.str,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "AppIntegrations":
        '''(experimental) Adds a resource of type event-integration-association to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/API_EventIntegrationAssociation.html

        :param event_integration_name: - Identifier for the eventIntegrationName.
        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("AppIntegrations", jsii.invoke(self, "onEventIntegrationAssociation", [event_integration_name, resource_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateEventIntegration")
    def to_create_event_integration(self) -> "AppIntegrations":
        '''(experimental) Grants permissions to create a new EventIntegration.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/appintegrations/latest/APIReference/API_CreateEventIntegration.html

        :stability: experimental
        '''
        return typing.cast("AppIntegrations", jsii.invoke(self, "toCreateEventIntegration", []))

    @jsii.member(jsii_name="toCreateEventIntegrationAssociation")
    def to_create_event_integration_association(self) -> "AppIntegrations":
        '''(experimental) Grants permissions to create an EventIntegrationAssociation.

        Access Level: Write

        Dependent actions:

        - events:PutRule
        - events:PutTargets

        https://docs.aws.amazon.com/appintegrations/latest/APIReference/API_CreateEventIntegrationAssociation.html

        :stability: experimental
        '''
        return typing.cast("AppIntegrations", jsii.invoke(self, "toCreateEventIntegrationAssociation", []))

    @jsii.member(jsii_name="toDeleteEventIntegration")
    def to_delete_event_integration(self) -> "AppIntegrations":
        '''(experimental) Grants permissions to delete an EventIntegration.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appintegrations/latest/APIReference/API_DeleteEventIntegration.html

        :stability: experimental
        '''
        return typing.cast("AppIntegrations", jsii.invoke(self, "toDeleteEventIntegration", []))

    @jsii.member(jsii_name="toDeleteEventIntegrationAssociation")
    def to_delete_event_integration_association(self) -> "AppIntegrations":
        '''(experimental) Grants permissions to delete an EventIntegrationAssociation.

        Access Level: Write

        Dependent actions:

        - events:DeleteRule
        - events:ListTargetsByRule
        - events:RemoveTargets

        https://docs.aws.amazon.com/appintegrations/latest/APIReference/API_DeleteEventIntegrationAssociation.html

        :stability: experimental
        '''
        return typing.cast("AppIntegrations", jsii.invoke(self, "toDeleteEventIntegrationAssociation", []))

    @jsii.member(jsii_name="toGetEventIntegration")
    def to_get_event_integration(self) -> "AppIntegrations":
        '''(experimental) Grants permissions to view details about EventIntegrations.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appintegrations/latest/APIReference/API_GetEventIntegration.html

        :stability: experimental
        '''
        return typing.cast("AppIntegrations", jsii.invoke(self, "toGetEventIntegration", []))

    @jsii.member(jsii_name="toListEventIntegrationAssociations")
    def to_list_event_integration_associations(self) -> "AppIntegrations":
        '''(experimental) Grants permissions to list EventIntegrationAssociations.

        Access Level: Read

        https://docs.aws.amazon.com/appintegrations/latest/APIReference/API_ListEventIntegrationAssociations

        :stability: experimental
        '''
        return typing.cast("AppIntegrations", jsii.invoke(self, "toListEventIntegrationAssociations", []))

    @jsii.member(jsii_name="toListEventIntegrations")
    def to_list_event_integrations(self) -> "AppIntegrations":
        '''(experimental) Grants permissions to list EventIntegrations.

        Access Level: List

        https://docs.aws.amazon.com/appintegrations/latest/APIReference/API_ListEventIntegrations.html

        :stability: experimental
        '''
        return typing.cast("AppIntegrations", jsii.invoke(self, "toListEventIntegrations", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "AppIntegrations":
        '''(experimental) Grants permission to lists tag for an Amazon AppIntegration resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appintegrations/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("AppIntegrations", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "AppIntegrations":
        '''(experimental) Grants permission to tag an Amazon AppIntegration resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appintegrations/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("AppIntegrations", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "AppIntegrations":
        '''(experimental) Grants permissions to untag an Amazon AppIntegration resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appintegrations/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("AppIntegrations", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateEventIntegration")
    def to_update_event_integration(self) -> "AppIntegrations":
        '''(experimental) Grants permissions to modify an EventIntegration.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appintegrations/latest/APIReference/API_UpdateEventIntegration.html

        :stability: experimental
        '''
        return typing.cast("AppIntegrations", jsii.invoke(self, "toUpdateEventIntegration", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Appconfig(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Appconfig",
):
    '''(experimental) Statement provider for service `appconfig <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsappconfig.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `appconfig <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsappconfig.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Appconfig, self, [sid])

    @jsii.member(jsii_name="onApplication")
    def on_application(
        self,
        application_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appconfig":
        '''(experimental) Adds a resource of type application to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/appconfig-creating-application.html

        :param application_id: - Identifier for the applicationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "onApplication", [application_id, account, region, partition]))

    @jsii.member(jsii_name="onConfigurationprofile")
    def on_configurationprofile(
        self,
        application_id: builtins.str,
        configuration_profile_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appconfig":
        '''(experimental) Adds a resource of type configurationprofile to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/appconfig-creating-configuration-and-profile.html

        :param application_id: - Identifier for the applicationId.
        :param configuration_profile_id: - Identifier for the configurationProfileId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "onConfigurationprofile", [application_id, configuration_profile_id, account, region, partition]))

    @jsii.member(jsii_name="onDeployment")
    def on_deployment(
        self,
        application_id: builtins.str,
        environment_id: builtins.str,
        deployment_number: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appconfig":
        '''(experimental) Adds a resource of type deployment to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/appconfig-deploying.html

        :param application_id: - Identifier for the applicationId.
        :param environment_id: - Identifier for the environmentId.
        :param deployment_number: - Identifier for the deploymentNumber.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "onDeployment", [application_id, environment_id, deployment_number, account, region, partition]))

    @jsii.member(jsii_name="onDeploymentstrategy")
    def on_deploymentstrategy(
        self,
        deployment_strategy_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appconfig":
        '''(experimental) Adds a resource of type deploymentstrategy to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/appconfig-creating-deployment-strategy.html

        :param deployment_strategy_id: - Identifier for the deploymentStrategyId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "onDeploymentstrategy", [deployment_strategy_id, account, region, partition]))

    @jsii.member(jsii_name="onEnvironment")
    def on_environment(
        self,
        application_id: builtins.str,
        environment_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appconfig":
        '''(experimental) Adds a resource of type environment to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/appconfig-creating-environment.html

        :param application_id: - Identifier for the applicationId.
        :param environment_id: - Identifier for the environmentId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "onEnvironment", [application_id, environment_id, account, region, partition]))

    @jsii.member(jsii_name="onHostedconfigurationversion")
    def on_hostedconfigurationversion(
        self,
        application_id: builtins.str,
        configuration_profile_id: builtins.str,
        version_number: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appconfig":
        '''(experimental) Adds a resource of type hostedconfigurationversion to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/appconfig-creating-configuration-and-profile.html

        :param application_id: - Identifier for the applicationId.
        :param configuration_profile_id: - Identifier for the configurationProfileId.
        :param version_number: - Identifier for the versionNumber.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "onHostedconfigurationversion", [application_id, configuration_profile_id, version_number, account, region, partition]))

    @jsii.member(jsii_name="toCreateApplication")
    def to_create_application(self) -> "Appconfig":
        '''(experimental) Grants permission to create an application.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_CreateApplication.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toCreateApplication", []))

    @jsii.member(jsii_name="toCreateConfigurationProfile")
    def to_create_configuration_profile(self) -> "Appconfig":
        '''(experimental) Grants permission to create a configuration profile.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_CreateConfigurationProfile.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toCreateConfigurationProfile", []))

    @jsii.member(jsii_name="toCreateDeploymentStrategy")
    def to_create_deployment_strategy(self) -> "Appconfig":
        '''(experimental) Grants permission to create a deployment strategy.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_CreateDeploymentStrategy.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toCreateDeploymentStrategy", []))

    @jsii.member(jsii_name="toCreateEnvironment")
    def to_create_environment(self) -> "Appconfig":
        '''(experimental) Grants permission to create an environment.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_CreateEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toCreateEnvironment", []))

    @jsii.member(jsii_name="toCreateHostedConfigurationVersion")
    def to_create_hosted_configuration_version(self) -> "Appconfig":
        '''(experimental) Grants permission to create a hosted configuration version.

        Access Level: Write

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_CreateHostedConfigurationVersion.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toCreateHostedConfigurationVersion", []))

    @jsii.member(jsii_name="toDeleteApplication")
    def to_delete_application(self) -> "Appconfig":
        '''(experimental) Grants permission to delete an application.

        Access Level: Write

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_DeleteApplication.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toDeleteApplication", []))

    @jsii.member(jsii_name="toDeleteConfigurationProfile")
    def to_delete_configuration_profile(self) -> "Appconfig":
        '''(experimental) Grants permission to delete a configuration profile.

        Access Level: Write

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_DeleteConfigurationProfile.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toDeleteConfigurationProfile", []))

    @jsii.member(jsii_name="toDeleteDeploymentStrategy")
    def to_delete_deployment_strategy(self) -> "Appconfig":
        '''(experimental) Grants permission to delete a deployment strategy.

        Access Level: Write

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_DeleteDeploymentStrategy.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toDeleteDeploymentStrategy", []))

    @jsii.member(jsii_name="toDeleteEnvironment")
    def to_delete_environment(self) -> "Appconfig":
        '''(experimental) Grants permission to delete an environment.

        Access Level: Write

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_DeleteEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toDeleteEnvironment", []))

    @jsii.member(jsii_name="toDeleteHostedConfigurationVersion")
    def to_delete_hosted_configuration_version(self) -> "Appconfig":
        '''(experimental) Grants permission to delete a hosted configuration version.

        Access Level: Write

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_DeleteHostedConfigurationVersion.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toDeleteHostedConfigurationVersion", []))

    @jsii.member(jsii_name="toGetApplication")
    def to_get_application(self) -> "Appconfig":
        '''(experimental) Grants permission to view details about an application.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_GetApplication.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toGetApplication", []))

    @jsii.member(jsii_name="toGetConfiguration")
    def to_get_configuration(self) -> "Appconfig":
        '''(experimental) Grants permission to view details about a configuration.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_GetConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toGetConfiguration", []))

    @jsii.member(jsii_name="toGetConfigurationProfile")
    def to_get_configuration_profile(self) -> "Appconfig":
        '''(experimental) Grants permission to view details about a configuration profile.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_GetConfigurationProfile.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toGetConfigurationProfile", []))

    @jsii.member(jsii_name="toGetDeployment")
    def to_get_deployment(self) -> "Appconfig":
        '''(experimental) Grants permission to view details about a deployment.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_GetDeployment.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toGetDeployment", []))

    @jsii.member(jsii_name="toGetDeploymentStrategy")
    def to_get_deployment_strategy(self) -> "Appconfig":
        '''(experimental) Grants permission to view details about a deployment strategy.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_GetDeploymentStrategy.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toGetDeploymentStrategy", []))

    @jsii.member(jsii_name="toGetEnvironment")
    def to_get_environment(self) -> "Appconfig":
        '''(experimental) Grants permission to view details about an environment.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_GetEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toGetEnvironment", []))

    @jsii.member(jsii_name="toGetHostedConfigurationVersion")
    def to_get_hosted_configuration_version(self) -> "Appconfig":
        '''(experimental) Grants permission to view details about a hosted configuration version.

        Access Level: Read

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_GetHostedConfigurationVersion.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toGetHostedConfigurationVersion", []))

    @jsii.member(jsii_name="toListApplications")
    def to_list_applications(self) -> "Appconfig":
        '''(experimental) Grants permission to list the applications in your account.

        Access Level: List

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_ListApplications.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toListApplications", []))

    @jsii.member(jsii_name="toListConfigurationProfiles")
    def to_list_configuration_profiles(self) -> "Appconfig":
        '''(experimental) Grants permission to list the configuration profiles for an application.

        Access Level: List

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_ListConfigurationProfiles.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toListConfigurationProfiles", []))

    @jsii.member(jsii_name="toListDeployments")
    def to_list_deployments(self) -> "Appconfig":
        '''(experimental) Grants permission to list the deployments for an environment.

        Access Level: List

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_ListDeployments.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toListDeployments", []))

    @jsii.member(jsii_name="toListDeploymentStrategies")
    def to_list_deployment_strategies(self) -> "Appconfig":
        '''(experimental) Grants permission to list the deployment strategies for your account.

        Access Level: List

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_ListDeploymentStrategies.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toListDeploymentStrategies", []))

    @jsii.member(jsii_name="toListEnvironments")
    def to_list_environments(self) -> "Appconfig":
        '''(experimental) Grants permission to list the environments for an application.

        Access Level: List

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_ListEnvironments.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toListEnvironments", []))

    @jsii.member(jsii_name="toListHostedConfigurationVersions")
    def to_list_hosted_configuration_versions(self) -> "Appconfig":
        '''(experimental) Grants permission to list the hosted configuration versions for a configuration profile.

        Access Level: List

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_ListHostedConfigurationVersions.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toListHostedConfigurationVersions", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Appconfig":
        '''(experimental) Grants permission to view a list of resource tags for a specified resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toStartDeployment")
    def to_start_deployment(self) -> "Appconfig":
        '''(experimental) Grants permission to initiate a deployment.

        Access Level: Write

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_StartDeployment.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toStartDeployment", []))

    @jsii.member(jsii_name="toStopDeployment")
    def to_stop_deployment(self) -> "Appconfig":
        '''(experimental) Grants permission to stop a deployment.

        Access Level: Write

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_StopDeployment.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toStopDeployment", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Appconfig":
        '''(experimental) Grants permission to tag an appconfig resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Appconfig":
        '''(experimental) Grants permission to untag an appconfig resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateApplication")
    def to_update_application(self) -> "Appconfig":
        '''(experimental) Grants permission to modify an application.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_UpdateApplication.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toUpdateApplication", []))

    @jsii.member(jsii_name="toUpdateConfigurationProfile")
    def to_update_configuration_profile(self) -> "Appconfig":
        '''(experimental) Grants permission to modify a configuration profile.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_UpdateConfigurationProfile.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toUpdateConfigurationProfile", []))

    @jsii.member(jsii_name="toUpdateDeploymentStrategy")
    def to_update_deployment_strategy(self) -> "Appconfig":
        '''(experimental) Grants permission to modify a deployment strategy.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_UpdateDeploymentStrategy.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toUpdateDeploymentStrategy", []))

    @jsii.member(jsii_name="toUpdateEnvironment")
    def to_update_environment(self) -> "Appconfig":
        '''(experimental) Grants permission to modify an environment.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_UpdateEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toUpdateEnvironment", []))

    @jsii.member(jsii_name="toValidateConfiguration")
    def to_validate_configuration(self) -> "Appconfig":
        '''(experimental) Grants permission to validate a configuration.

        Access Level: Write

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_ValidateConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toValidateConfiguration", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Appflow(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Appflow"):
    '''(experimental) Statement provider for service `appflow <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonappflow.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `appflow <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonappflow.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Appflow, self, [sid])

    @jsii.member(jsii_name="onConnectorprofile")
    def on_connectorprofile(
        self,
        profile_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appflow":
        '''(experimental) Adds a resource of type connectorprofile to the statement.

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_ConnectorProfile.html

        :param profile_name: - Identifier for the profileName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "onConnectorprofile", [profile_name, account, region, partition]))

    @jsii.member(jsii_name="onFlow")
    def on_flow(
        self,
        flow_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appflow":
        '''(experimental) Adds a resource of type flow to the statement.

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_FlowDefinition.html

        :param flow_name: - Identifier for the flowName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "onFlow", [flow_name, account, region, partition]))

    @jsii.member(jsii_name="toCreateConnectorProfile")
    def to_create_connector_profile(self) -> "Appflow":
        '''(experimental) Grants permission to create a login profile to be used with Amazon AppFlow flows.

        Access Level: Write

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_CreateConnectorProfile.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toCreateConnectorProfile", []))

    @jsii.member(jsii_name="toCreateFlow")
    def to_create_flow(self) -> "Appflow":
        '''(experimental) Grants permission to create an Amazon AppFlow flow.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_CreateFlow.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toCreateFlow", []))

    @jsii.member(jsii_name="toDeleteConnectorProfile")
    def to_delete_connector_profile(self) -> "Appflow":
        '''(experimental) Grants permission to delete a login profile configured in Amazon AppFlow.

        Access Level: Write

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_DescribeConnectorProfiles.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toDeleteConnectorProfile", []))

    @jsii.member(jsii_name="toDeleteFlow")
    def to_delete_flow(self) -> "Appflow":
        '''(experimental) Grants permission to delete an Amazon AppFlow flow.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_DeleteFlow.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toDeleteFlow", []))

    @jsii.member(jsii_name="toDescribeConnectorEntity")
    def to_describe_connector_entity(self) -> "Appflow":
        '''(experimental) Grants permission to describe all fields for an object in a login profile configured in Amazon AppFlow.

        Access Level: Read

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_DescribeConnectorEntity.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toDescribeConnectorEntity", []))

    @jsii.member(jsii_name="toDescribeConnectorFields")
    def to_describe_connector_fields(self) -> "Appflow":
        '''(experimental) Grants permission to describe all fields for an object in a login profile configured in Amazon AppFlow (Console Only).

        Access Level: Read

        https://docs.aws.amazon.com/appflow/latest/userguide/identity-access-management.html#appflow-api-actions

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toDescribeConnectorFields", []))

    @jsii.member(jsii_name="toDescribeConnectorProfiles")
    def to_describe_connector_profiles(self) -> "Appflow":
        '''(experimental) Grants permission to describe all login profiles configured in Amazon AppFlow.

        Access Level: Read

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_DescribeConnectorProfiles.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toDescribeConnectorProfiles", []))

    @jsii.member(jsii_name="toDescribeConnectors")
    def to_describe_connectors(self) -> "Appflow":
        '''(experimental) Grants permission to describe all connectors supported by Amazon AppFlow.

        Access Level: Read

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_DescribeConnectors.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toDescribeConnectors", []))

    @jsii.member(jsii_name="toDescribeFlow")
    def to_describe_flow(self) -> "Appflow":
        '''(experimental) Grants permission to describe a specific flow configured in Amazon AppFlow.

        Access Level: Read

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_DescribeFlow.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toDescribeFlow", []))

    @jsii.member(jsii_name="toDescribeFlowExecution")
    def to_describe_flow_execution(self) -> "Appflow":
        '''(experimental) Grants permission to describe all flow executions for a flow configured in Amazon AppFlow (Console Only).

        Access Level: Read

        https://docs.aws.amazon.com/appflow/latest/userguide/identity-access-management.html#appflow-api-actions

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toDescribeFlowExecution", []))

    @jsii.member(jsii_name="toDescribeFlowExecutionRecords")
    def to_describe_flow_execution_records(self) -> "Appflow":
        '''(experimental) Grants permission to describe all flow executions for a flow configured in Amazon AppFlow.

        Access Level: Read

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_DescribeFlowExecutionRecords.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toDescribeFlowExecutionRecords", []))

    @jsii.member(jsii_name="toDescribeFlows")
    def to_describe_flows(self) -> "Appflow":
        '''(experimental) Grants permission to describe all flows configured in Amazon AppFlow (Console Only).

        Access Level: Read

        https://docs.aws.amazon.com/appflow/latest/userguide/identity-access-management.html#appflow-api-actions

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toDescribeFlows", []))

    @jsii.member(jsii_name="toListConnectorEntities")
    def to_list_connector_entities(self) -> "Appflow":
        '''(experimental) Grants permission to list all objects for a login profile configured in Amazon AppFlow.

        Access Level: List

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_ListConnectorEntities.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toListConnectorEntities", []))

    @jsii.member(jsii_name="toListConnectorFields")
    def to_list_connector_fields(self) -> "Appflow":
        '''(experimental) Grants permission to list all objects for a login profile configured in Amazon AppFlow (Console Only).

        Access Level: Read

        https://docs.aws.amazon.com/appflow/latest/userguide/identity-access-management.html#appflow-api-actions

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toListConnectorFields", []))

    @jsii.member(jsii_name="toListFlows")
    def to_list_flows(self) -> "Appflow":
        '''(experimental) Grants permission to list all flows configured in Amazon AppFlow.

        Access Level: List

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_ListFlows.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toListFlows", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Appflow":
        '''(experimental) Grants permission to list tags for a flow.

        Access Level: List

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toRunFlow")
    def to_run_flow(self) -> "Appflow":
        '''(experimental) Grants permission to run a flow configured in Amazon AppFlow (Console Only).

        Access Level: Write

        https://docs.aws.amazon.com/appflow/latest/userguide/identity-access-management.html#appflow-api-actions

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toRunFlow", []))

    @jsii.member(jsii_name="toStartFlow")
    def to_start_flow(self) -> "Appflow":
        '''(experimental) Grants permission to activate (for scheduled and event-triggered flows) or run (for on-demand flows) a flow configured in Amazon AppFlow.

        Access Level: Write

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_StartFlow.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toStartFlow", []))

    @jsii.member(jsii_name="toStopFlow")
    def to_stop_flow(self) -> "Appflow":
        '''(experimental) Grants permission to deactivate a scheduled or event-triggered flow configured in Amazon AppFlow.

        Access Level: Write

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_StopFlow.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toStopFlow", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Appflow":
        '''(experimental) Grants permission to tag a flow.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Appflow":
        '''(experimental) Grants permission to untag a flow.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateConnectorProfile")
    def to_update_connector_profile(self) -> "Appflow":
        '''(experimental) Grants permission to update a login profile configured in Amazon AppFlow.

        Access Level: Write

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_UpdateConnectorProfile.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toUpdateConnectorProfile", []))

    @jsii.member(jsii_name="toUpdateFlow")
    def to_update_flow(self) -> "Appflow":
        '''(experimental) Grants permission to update a flow configured in Amazon AppFlow.

        Access Level: Write

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_UpdateFlow.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toUpdateFlow", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class ApplicationAutoscaling(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.ApplicationAutoscaling",
):
    '''(experimental) Statement provider for service `application-autoscaling <https://docs.aws.amazon.com/service-authorization/latest/reference/list_applicationautoscaling.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `application-autoscaling <https://docs.aws.amazon.com/service-authorization/latest/reference/list_applicationautoscaling.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(ApplicationAutoscaling, self, [sid])

    @jsii.member(jsii_name="toDeleteScalingPolicy")
    def to_delete_scaling_policy(self) -> "ApplicationAutoscaling":
        '''(experimental) Deletes an Application Auto Scaling scaling policy that was previously created.

        Access Level: Write

        https://docs.aws.amazon.com/autoscaling/application/APIReference/API_DeleteScalingPolicy.html

        :stability: experimental
        '''
        return typing.cast("ApplicationAutoscaling", jsii.invoke(self, "toDeleteScalingPolicy", []))

    @jsii.member(jsii_name="toDeleteScheduledAction")
    def to_delete_scheduled_action(self) -> "ApplicationAutoscaling":
        '''(experimental) Deletes an Application Auto Scaling scheduled action that was previously created.

        Access Level: Write

        https://docs.aws.amazon.com/autoscaling/application/APIReference/API_DeleteScheduledAction.html

        :stability: experimental
        '''
        return typing.cast("ApplicationAutoscaling", jsii.invoke(self, "toDeleteScheduledAction", []))

    @jsii.member(jsii_name="toDeregisterScalableTarget")
    def to_deregister_scalable_target(self) -> "ApplicationAutoscaling":
        '''(experimental) Deregisters a scalable target that was previously registered.

        Access Level: Write

        https://docs.aws.amazon.com/autoscaling/application/APIReference/API_DeregisterScalableTarget.html

        :stability: experimental
        '''
        return typing.cast("ApplicationAutoscaling", jsii.invoke(self, "toDeregisterScalableTarget", []))

    @jsii.member(jsii_name="toDescribeScalableTargets")
    def to_describe_scalable_targets(self) -> "ApplicationAutoscaling":
        '''(experimental) Provides descriptive information for scalable targets with a specified service namespace.

        Access Level: Read

        https://docs.aws.amazon.com/autoscaling/application/APIReference/API_DescribeScalableTargets.html

        :stability: experimental
        '''
        return typing.cast("ApplicationAutoscaling", jsii.invoke(self, "toDescribeScalableTargets", []))

    @jsii.member(jsii_name="toDescribeScalingActivities")
    def to_describe_scaling_activities(self) -> "ApplicationAutoscaling":
        '''(experimental) Provides descriptive information for scaling activities with a specified service namespace for the previous six weeks.

        Access Level: Read

        https://docs.aws.amazon.com/autoscaling/application/APIReference/API_DescribeScalingActivities.html

        :stability: experimental
        '''
        return typing.cast("ApplicationAutoscaling", jsii.invoke(self, "toDescribeScalingActivities", []))

    @jsii.member(jsii_name="toDescribeScalingPolicies")
    def to_describe_scaling_policies(self) -> "ApplicationAutoscaling":
        '''(experimental) Provides descriptive information for scaling policies with a specified service namespace.

        Access Level: Read

        https://docs.aws.amazon.com/autoscaling/application/APIReference/API_DescribeScalingPolicies.html

        :stability: experimental
        '''
        return typing.cast("ApplicationAutoscaling", jsii.invoke(self, "toDescribeScalingPolicies", []))

    @jsii.member(jsii_name="toDescribeScheduledActions")
    def to_describe_scheduled_actions(self) -> "ApplicationAutoscaling":
        '''(experimental) Provides descriptive information for scheduled actions with a specified service namespace.

        Access Level: Read

        https://docs.aws.amazon.com/autoscaling/application/APIReference/API_DescribeScheduledActions.html

        :stability: experimental
        '''
        return typing.cast("ApplicationAutoscaling", jsii.invoke(self, "toDescribeScheduledActions", []))

    @jsii.member(jsii_name="toPutScalingPolicy")
    def to_put_scaling_policy(self) -> "ApplicationAutoscaling":
        '''(experimental) Creates or updates a policy for an existing Application Auto Scaling scalable target.

        Access Level: Write

        https://docs.aws.amazon.com/autoscaling/application/APIReference/API_PutScalingPolicy.html

        :stability: experimental
        '''
        return typing.cast("ApplicationAutoscaling", jsii.invoke(self, "toPutScalingPolicy", []))

    @jsii.member(jsii_name="toPutScheduledAction")
    def to_put_scheduled_action(self) -> "ApplicationAutoscaling":
        '''(experimental) Creates or updates a scheduled action for an existing Application Auto Scaling scalable target.

        Access Level: Write

        https://docs.aws.amazon.com/autoscaling/application/APIReference/API_PutScheduledAction.html

        :stability: experimental
        '''
        return typing.cast("ApplicationAutoscaling", jsii.invoke(self, "toPutScheduledAction", []))

    @jsii.member(jsii_name="toRegisterScalableTarget")
    def to_register_scalable_target(self) -> "ApplicationAutoscaling":
        '''(experimental) Registers or updates a scalable target.

        A scalable target is a resource that can be scaled out or in with Application Auto Scaling.

        Access Level: Write

        https://docs.aws.amazon.com/autoscaling/application/APIReference/API_RegisterScalableTarget.html

        :stability: experimental
        '''
        return typing.cast("ApplicationAutoscaling", jsii.invoke(self, "toRegisterScalableTarget", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Applicationinsights(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Applicationinsights",
):
    '''(experimental) Statement provider for service `applicationinsights <https://docs.aws.amazon.com/service-authorization/latest/reference/list_cloudwatchapplicationinsights.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `applicationinsights <https://docs.aws.amazon.com/service-authorization/latest/reference/list_cloudwatchapplicationinsights.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Applicationinsights, self, [sid])

    @jsii.member(jsii_name="toCreateApplication")
    def to_create_application(self) -> "Applicationinsights":
        '''(experimental) Grants permission to create an application from a resource group.

        Access Level: Write

        https://docs.aws.amazon.com/appinsights/latest/APIReference/API_CreateApplication.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toCreateApplication", []))

    @jsii.member(jsii_name="toCreateComponent")
    def to_create_component(self) -> "Applicationinsights":
        '''(experimental) Grants permission to create a component from a group of resources.

        Access Level: Write

        https://docs.aws.amazon.com/appinsights/latest/APIReference/API_CreateComponent.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toCreateComponent", []))

    @jsii.member(jsii_name="toCreateLogPattern")
    def to_create_log_pattern(self) -> "Applicationinsights":
        '''(experimental) Grants permission to create log a pattern.

        Access Level: Write

        https://docs.aws.amazon.com/appinsights/latest/APIReference/API_CreateLogPattern.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toCreateLogPattern", []))

    @jsii.member(jsii_name="toDeleteApplication")
    def to_delete_application(self) -> "Applicationinsights":
        '''(experimental) Grants permission to delete an application.

        Access Level: Write

        https://docs.aws.amazon.com/appinsights/latest/APIReference/API_DeleteApplication.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toDeleteApplication", []))

    @jsii.member(jsii_name="toDeleteComponent")
    def to_delete_component(self) -> "Applicationinsights":
        '''(experimental) Grants permission to delete a component.

        Access Level: Write

        https://docs.aws.amazon.com/appinsights/latest/APIReference/API_DeleteComponent.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toDeleteComponent", []))

    @jsii.member(jsii_name="toDeleteLogPattern")
    def to_delete_log_pattern(self) -> "Applicationinsights":
        '''(experimental) Grants permission to delete a log pattern.

        Access Level: Write

        https://docs.aws.amazon.com/appinsights/latest/APIReference/API_DeleteLogPattern.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toDeleteLogPattern", []))

    @jsii.member(jsii_name="toDescribeApplication")
    def to_describe_application(self) -> "Applicationinsights":
        '''(experimental) Grants permission to describe an application.

        Access Level: Read

        https://docs.aws.amazon.com/appinsights/latest/APIReference/API_DescribeApplication.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toDescribeApplication", []))

    @jsii.member(jsii_name="toDescribeComponent")
    def to_describe_component(self) -> "Applicationinsights":
        '''(experimental) Grants permission to describe a component.

        Access Level: Read

        https://docs.aws.amazon.com/appinsights/latest/APIReference/API_DescribeComponent.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toDescribeComponent", []))

    @jsii.member(jsii_name="toDescribeComponentConfiguration")
    def to_describe_component_configuration(self) -> "Applicationinsights":
        '''(experimental) Grants permission to describe a component's configuration.

        Access Level: Read

        https://docs.aws.amazon.com/appinsights/latest/APIReference/API_DescribeComponentConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toDescribeComponentConfiguration", []))

    @jsii.member(jsii_name="toDescribeComponentConfigurationRecommendation")
    def to_describe_component_configuration_recommendation(
        self,
    ) -> "Applicationinsights":
        '''(experimental) Grants permission to describe the recommended application component configuration.

        Access Level: Read

        https://docs.aws.amazon.com/appinsights/latest/APIReference/API_DescribeComponentConfigurationRecommendation.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toDescribeComponentConfigurationRecommendation", []))

    @jsii.member(jsii_name="toDescribeLogPattern")
    def to_describe_log_pattern(self) -> "Applicationinsights":
        '''(experimental) Grants permission to describe a log pattern.

        Access Level: Read

        https://docs.aws.amazon.com/appinsights/latest/APIReference/API_DescribeLogPattern.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toDescribeLogPattern", []))

    @jsii.member(jsii_name="toDescribeObservation")
    def to_describe_observation(self) -> "Applicationinsights":
        '''(experimental) Grants permission to describe an observation.

        Access Level: Read

        https://docs.aws.amazon.com/appinsights/latest/APIReference/API_DescribeObservation.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toDescribeObservation", []))

    @jsii.member(jsii_name="toDescribeProblem")
    def to_describe_problem(self) -> "Applicationinsights":
        '''(experimental) Grants permission to describe a problem.

        Access Level: Read

        https://docs.aws.amazon.com/appinsights/latest/APIReference/API_DescribeProblem.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toDescribeProblem", []))

    @jsii.member(jsii_name="toDescribeProblemObservations")
    def to_describe_problem_observations(self) -> "Applicationinsights":
        '''(experimental) Grants permission to describe the observation in a problem.

        Access Level: Read

        https://docs.aws.amazon.com/appinsights/latest/APIReference/API_DescribeProblemObservations.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toDescribeProblemObservations", []))

    @jsii.member(jsii_name="toListApplications")
    def to_list_applications(self) -> "Applicationinsights":
        '''(experimental) Grants permission to list all applications.

        Access Level: List

        https://docs.aws.amazon.com/appinsights/latest/APIReference/API_ListApplications.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toListApplications", []))

    @jsii.member(jsii_name="toListComponents")
    def to_list_components(self) -> "Applicationinsights":
        '''(experimental) Grants permission to list an application's components.

        Access Level: List

        https://docs.aws.amazon.com/appinsights/latest/APIReference/API_ListComponents.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toListComponents", []))

    @jsii.member(jsii_name="toListConfigurationHistory")
    def to_list_configuration_history(self) -> "Applicationinsights":
        '''(experimental) Grants permission to list configuration history.

        Access Level: List

        https://docs.aws.amazon.com/appinsights/latest/APIReference/API_ListConfigurationHistory.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toListConfigurationHistory", []))

    @jsii.member(jsii_name="toListLogPatterns")
    def to_list_log_patterns(self) -> "Applicationinsights":
        '''(experimental) Grants permission to list log patterns.

        Access Level: List

        https://docs.aws.amazon.com/appinsights/latest/APIReference/API_ListLogPatterns.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toListLogPatterns", []))

    @jsii.member(jsii_name="toListLogPatternSets")
    def to_list_log_pattern_sets(self) -> "Applicationinsights":
        '''(experimental) Grants permission to list log pattern sets for an application.

        Access Level: List

        https://docs.aws.amazon.com/appinsights/latest/APIReference/API_ListLogPatternSets.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toListLogPatternSets", []))

    @jsii.member(jsii_name="toListProblems")
    def to_list_problems(self) -> "Applicationinsights":
        '''(experimental) Grants permission to list the problems in an application.

        Access Level: List

        https://docs.aws.amazon.com/appinsights/latest/APIReference/API_ListProblems.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toListProblems", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Applicationinsights":
        '''(experimental) Grants permission to list tags for the resource.

        Access Level: List

        https://docs.aws.amazon.com/appinsights/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Applicationinsights":
        '''(experimental) Grants permission to tag a resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/appinsights/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Applicationinsights":
        '''(experimental) Grants permission to untag a resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/appinsights/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateApplication")
    def to_update_application(self) -> "Applicationinsights":
        '''(experimental) Grants permission to update an application.

        Access Level: Write

        https://docs.aws.amazon.com/appinsights/latest/APIReference/API_UpdateApplication.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toUpdateApplication", []))

    @jsii.member(jsii_name="toUpdateComponent")
    def to_update_component(self) -> "Applicationinsights":
        '''(experimental) Grants permission to update a component.

        Access Level: Write

        https://docs.aws.amazon.com/appinsights/latest/APIReference/API_UpdateComponent.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toUpdateComponent", []))

    @jsii.member(jsii_name="toUpdateComponentConfiguration")
    def to_update_component_configuration(self) -> "Applicationinsights":
        '''(experimental) Grants permission to update a component's configuration.

        Access Level: Write

        https://docs.aws.amazon.com/appinsights/latest/APIReference/API_UpdateComponentConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toUpdateComponentConfiguration", []))

    @jsii.member(jsii_name="toUpdateLogPattern")
    def to_update_log_pattern(self) -> "Applicationinsights":
        '''(experimental) Grants permission to update a log pattern.

        Access Level: Write

        https://docs.aws.amazon.com/appinsights/latest/APIReference/API_UpdateLogPattern.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toUpdateLogPattern", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Appmesh(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Appmesh"):
    '''(experimental) Statement provider for service `appmesh <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsappmesh.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `appmesh <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsappmesh.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Appmesh, self, [sid])

    @jsii.member(jsii_name="onGatewayRoute")
    def on_gateway_route(
        self,
        mesh_name: builtins.str,
        virtual_gateway_name: builtins.str,
        gateway_route_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appmesh":
        '''(experimental) Adds a resource of type gatewayRoute to the statement.

        https://docs.aws.amazon.com/app-mesh/latest/userguide/virtual_gateways.html

        :param mesh_name: - Identifier for the meshName.
        :param virtual_gateway_name: - Identifier for the virtualGatewayName.
        :param gateway_route_name: - Identifier for the gatewayRouteName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "onGatewayRoute", [mesh_name, virtual_gateway_name, gateway_route_name, account, region, partition]))

    @jsii.member(jsii_name="onMesh")
    def on_mesh(
        self,
        mesh_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appmesh":
        '''(experimental) Adds a resource of type mesh to the statement.

        https://docs.aws.amazon.com/app-mesh/latest/userguide/meshes.html

        :param mesh_name: - Identifier for the meshName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "onMesh", [mesh_name, account, region, partition]))

    @jsii.member(jsii_name="onRoute")
    def on_route(
        self,
        mesh_name: builtins.str,
        virtual_router_name: builtins.str,
        route_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appmesh":
        '''(experimental) Adds a resource of type route to the statement.

        https://docs.aws.amazon.com/app-mesh/latest/userguide/routes.html

        :param mesh_name: - Identifier for the meshName.
        :param virtual_router_name: - Identifier for the virtualRouterName.
        :param route_name: - Identifier for the routeName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "onRoute", [mesh_name, virtual_router_name, route_name, account, region, partition]))

    @jsii.member(jsii_name="onVirtualGateway")
    def on_virtual_gateway(
        self,
        mesh_name: builtins.str,
        virtual_gateway_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appmesh":
        '''(experimental) Adds a resource of type virtualGateway to the statement.

        https://docs.aws.amazon.com/app-mesh/latest/userguide/virtual_gateways.html

        :param mesh_name: - Identifier for the meshName.
        :param virtual_gateway_name: - Identifier for the virtualGatewayName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "onVirtualGateway", [mesh_name, virtual_gateway_name, account, region, partition]))

    @jsii.member(jsii_name="onVirtualNode")
    def on_virtual_node(
        self,
        mesh_name: builtins.str,
        virtual_node_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appmesh":
        '''(experimental) Adds a resource of type virtualNode to the statement.

        https://docs.aws.amazon.com/app-mesh/latest/userguide/virtual_nodes.html

        :param mesh_name: - Identifier for the meshName.
        :param virtual_node_name: - Identifier for the virtualNodeName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "onVirtualNode", [mesh_name, virtual_node_name, account, region, partition]))

    @jsii.member(jsii_name="onVirtualRouter")
    def on_virtual_router(
        self,
        mesh_name: builtins.str,
        virtual_router_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appmesh":
        '''(experimental) Adds a resource of type virtualRouter to the statement.

        https://docs.aws.amazon.com/app-mesh/latest/userguide/virtual_routers.html

        :param mesh_name: - Identifier for the meshName.
        :param virtual_router_name: - Identifier for the virtualRouterName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "onVirtualRouter", [mesh_name, virtual_router_name, account, region, partition]))

    @jsii.member(jsii_name="onVirtualService")
    def on_virtual_service(
        self,
        mesh_name: builtins.str,
        virtual_service_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appmesh":
        '''(experimental) Adds a resource of type virtualService to the statement.

        https://docs.aws.amazon.com/app-mesh/latest/userguide/virtual_services.html

        :param mesh_name: - Identifier for the meshName.
        :param virtual_service_name: - Identifier for the virtualServiceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "onVirtualService", [mesh_name, virtual_service_name, account, region, partition]))

    @jsii.member(jsii_name="toCreateGatewayRoute")
    def to_create_gateway_route(self) -> "Appmesh":
        '''(experimental) Creates a gateway route that is associated with a virtual gateway.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_CreateGatewayRoute.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toCreateGatewayRoute", []))

    @jsii.member(jsii_name="toCreateMesh")
    def to_create_mesh(self) -> "Appmesh":
        '''(experimental) Creates a service mesh.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_CreateMesh.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toCreateMesh", []))

    @jsii.member(jsii_name="toCreateRoute")
    def to_create_route(self) -> "Appmesh":
        '''(experimental) Creates a route that is associated with a virtual router.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_CreateRoute.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toCreateRoute", []))

    @jsii.member(jsii_name="toCreateVirtualGateway")
    def to_create_virtual_gateway(self) -> "Appmesh":
        '''(experimental) Creates a virtual gateway within a service mesh.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_CreateVirtualGateway.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toCreateVirtualGateway", []))

    @jsii.member(jsii_name="toCreateVirtualNode")
    def to_create_virtual_node(self) -> "Appmesh":
        '''(experimental) Creates a virtual node within a service mesh.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_CreateVirtualNode.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toCreateVirtualNode", []))

    @jsii.member(jsii_name="toCreateVirtualRouter")
    def to_create_virtual_router(self) -> "Appmesh":
        '''(experimental) Creates a virtual router within a service mesh.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_CreateVirtualRouter.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toCreateVirtualRouter", []))

    @jsii.member(jsii_name="toCreateVirtualService")
    def to_create_virtual_service(self) -> "Appmesh":
        '''(experimental) Creates a virtual service within a service mesh.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_CreateVirtualService.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toCreateVirtualService", []))

    @jsii.member(jsii_name="toDeleteGatewayRoute")
    def to_delete_gateway_route(self) -> "Appmesh":
        '''(experimental) Deletes an existing gateway route.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DeleteGatewayRoute.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toDeleteGatewayRoute", []))

    @jsii.member(jsii_name="toDeleteMesh")
    def to_delete_mesh(self) -> "Appmesh":
        '''(experimental) Deletes an existing service mesh.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DeleteMesh.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toDeleteMesh", []))

    @jsii.member(jsii_name="toDeleteRoute")
    def to_delete_route(self) -> "Appmesh":
        '''(experimental) Deletes an existing route.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DeleteRoute.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toDeleteRoute", []))

    @jsii.member(jsii_name="toDeleteVirtualGateway")
    def to_delete_virtual_gateway(self) -> "Appmesh":
        '''(experimental) Deletes an existing virtual gateway.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DeleteVirtualGateway.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toDeleteVirtualGateway", []))

    @jsii.member(jsii_name="toDeleteVirtualNode")
    def to_delete_virtual_node(self) -> "Appmesh":
        '''(experimental) Deletes an existing virtual node.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DeleteVirtualNode.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toDeleteVirtualNode", []))

    @jsii.member(jsii_name="toDeleteVirtualRouter")
    def to_delete_virtual_router(self) -> "Appmesh":
        '''(experimental) Deletes an existing virtual router.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DeleteVirtualRouter.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toDeleteVirtualRouter", []))

    @jsii.member(jsii_name="toDeleteVirtualService")
    def to_delete_virtual_service(self) -> "Appmesh":
        '''(experimental) Deletes an existing virtual service.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DeleteVirtualService.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toDeleteVirtualService", []))

    @jsii.member(jsii_name="toDescribeGatewayRoute")
    def to_describe_gateway_route(self) -> "Appmesh":
        '''(experimental) Describes an existing gateway route.

        Access Level: Read

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DescribeGatewayRoute.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toDescribeGatewayRoute", []))

    @jsii.member(jsii_name="toDescribeMesh")
    def to_describe_mesh(self) -> "Appmesh":
        '''(experimental) Describes an existing service mesh.

        Access Level: Read

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DescribeMesh.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toDescribeMesh", []))

    @jsii.member(jsii_name="toDescribeRoute")
    def to_describe_route(self) -> "Appmesh":
        '''(experimental) Describes an existing route.

        Access Level: Read

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DescribeRoute.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toDescribeRoute", []))

    @jsii.member(jsii_name="toDescribeVirtualGateway")
    def to_describe_virtual_gateway(self) -> "Appmesh":
        '''(experimental) Describes an existing virtual gateway.

        Access Level: Read

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DescribeVirtualGateway.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toDescribeVirtualGateway", []))

    @jsii.member(jsii_name="toDescribeVirtualNode")
    def to_describe_virtual_node(self) -> "Appmesh":
        '''(experimental) Describes an existing virtual node.

        Access Level: Read

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DescribeVirtualNode.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toDescribeVirtualNode", []))

    @jsii.member(jsii_name="toDescribeVirtualRouter")
    def to_describe_virtual_router(self) -> "Appmesh":
        '''(experimental) Describes an existing virtual router.

        Access Level: Read

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DescribeVirtualRouter.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toDescribeVirtualRouter", []))

    @jsii.member(jsii_name="toDescribeVirtualService")
    def to_describe_virtual_service(self) -> "Appmesh":
        '''(experimental) Describes an existing virtual service.

        Access Level: Read

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DescribeVirtualService.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toDescribeVirtualService", []))

    @jsii.member(jsii_name="toListGatewayRoutes")
    def to_list_gateway_routes(self) -> "Appmesh":
        '''(experimental) Returns a list of existing gateway routes in a service mesh.

        Access Level: List

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_ListGatewayRoutes.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toListGatewayRoutes", []))

    @jsii.member(jsii_name="toListMeshes")
    def to_list_meshes(self) -> "Appmesh":
        '''(experimental) Returns a list of existing service meshes.

        Access Level: List

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_ListMeshes.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toListMeshes", []))

    @jsii.member(jsii_name="toListRoutes")
    def to_list_routes(self) -> "Appmesh":
        '''(experimental) Returns a list of existing routes in a service mesh.

        Access Level: List

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_ListRoutes.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toListRoutes", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Appmesh":
        '''(experimental) List the tags for an App Mesh resource.

        Access Level: List

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListVirtualGateways")
    def to_list_virtual_gateways(self) -> "Appmesh":
        '''(experimental) Returns a list of existing virtual gateways in a service mesh.

        Access Level: List

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_ListVirtualGateways.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toListVirtualGateways", []))

    @jsii.member(jsii_name="toListVirtualNodes")
    def to_list_virtual_nodes(self) -> "Appmesh":
        '''(experimental) Returns a list of existing virtual nodes.

        Access Level: List

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_ListVirtualNodes.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toListVirtualNodes", []))

    @jsii.member(jsii_name="toListVirtualRouters")
    def to_list_virtual_routers(self) -> "Appmesh":
        '''(experimental) Returns a list of existing virtual routers in a service mesh.

        Access Level: List

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_ListVirtualRouters.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toListVirtualRouters", []))

    @jsii.member(jsii_name="toListVirtualServices")
    def to_list_virtual_services(self) -> "Appmesh":
        '''(experimental) Returns a list of existing virtual services in a service mesh.

        Access Level: List

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_ListVirtualServices.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toListVirtualServices", []))

    @jsii.member(jsii_name="toStreamAggregatedResources")
    def to_stream_aggregated_resources(self) -> "Appmesh":
        '''(experimental) Allows an Envoy Proxy to receive streamed resources for an App Mesh endpoint (VirtualNode or VirtualGateway).

        Access Level: Read

        https://docs.aws.amazon.com/app-mesh/latest/userguide/envoy.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toStreamAggregatedResources", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Appmesh":
        '''(experimental) Associates the specified tags to a resource with the specified resourceArn.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Appmesh":
        '''(experimental) Deletes specified tags from a resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateGatewayRoute")
    def to_update_gateway_route(self) -> "Appmesh":
        '''(experimental) Updates an existing gateway route for a specified service mesh and virtual gateway.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_UpdateGatewayRoute.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toUpdateGatewayRoute", []))

    @jsii.member(jsii_name="toUpdateMesh")
    def to_update_mesh(self) -> "Appmesh":
        '''(experimental) Updates an existing service mesh.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_UpdateMesh.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toUpdateMesh", []))

    @jsii.member(jsii_name="toUpdateRoute")
    def to_update_route(self) -> "Appmesh":
        '''(experimental) Updates an existing route for a specified service mesh and virtual router.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_UpdateRoute.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toUpdateRoute", []))

    @jsii.member(jsii_name="toUpdateVirtualGateway")
    def to_update_virtual_gateway(self) -> "Appmesh":
        '''(experimental) Updates an existing virtual gateway in a specified service mesh.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_UpdateVirtualGateway.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toUpdateVirtualGateway", []))

    @jsii.member(jsii_name="toUpdateVirtualNode")
    def to_update_virtual_node(self) -> "Appmesh":
        '''(experimental) Updates an existing virtual node in a specified service mesh.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_UpdateVirtualNode.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toUpdateVirtualNode", []))

    @jsii.member(jsii_name="toUpdateVirtualRouter")
    def to_update_virtual_router(self) -> "Appmesh":
        '''(experimental) Updates an existing virtual router in a specified service mesh.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_UpdateVirtualRouter.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toUpdateVirtualRouter", []))

    @jsii.member(jsii_name="toUpdateVirtualService")
    def to_update_virtual_service(self) -> "Appmesh":
        '''(experimental) Updates an existing virtual service in a specified service mesh.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_UpdateVirtualService.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toUpdateVirtualService", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class AppmeshPreview(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.AppmeshPreview",
):
    '''(experimental) Statement provider for service `appmesh-preview <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsappmeshpreview.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `appmesh-preview <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsappmeshpreview.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(AppmeshPreview, self, [sid])

    @jsii.member(jsii_name="onGatewayRoute")
    def on_gateway_route(
        self,
        mesh_name: builtins.str,
        virtual_gateway_name: builtins.str,
        gateway_route_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "AppmeshPreview":
        '''(experimental) Adds a resource of type gatewayRoute to the statement.

        https://docs.aws.amazon.com/app-mesh/latest/userguide/virtual_gateways.html

        :param mesh_name: - Identifier for the meshName.
        :param virtual_gateway_name: - Identifier for the virtualGatewayName.
        :param gateway_route_name: - Identifier for the gatewayRouteName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "onGatewayRoute", [mesh_name, virtual_gateway_name, gateway_route_name, account, region, partition]))

    @jsii.member(jsii_name="onMesh")
    def on_mesh(
        self,
        mesh_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "AppmeshPreview":
        '''(experimental) Adds a resource of type mesh to the statement.

        https://docs.aws.amazon.com/app-mesh/latest/userguide/meshes.html

        :param mesh_name: - Identifier for the meshName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "onMesh", [mesh_name, account, region, partition]))

    @jsii.member(jsii_name="onRoute")
    def on_route(
        self,
        mesh_name: builtins.str,
        virtual_router_name: builtins.str,
        route_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "AppmeshPreview":
        '''(experimental) Adds a resource of type route to the statement.

        https://docs.aws.amazon.com/app-mesh/latest/userguide/routes.html

        :param mesh_name: - Identifier for the meshName.
        :param virtual_router_name: - Identifier for the virtualRouterName.
        :param route_name: - Identifier for the routeName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "onRoute", [mesh_name, virtual_router_name, route_name, account, region, partition]))

    @jsii.member(jsii_name="onVirtualGateway")
    def on_virtual_gateway(
        self,
        mesh_name: builtins.str,
        virtual_gateway_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "AppmeshPreview":
        '''(experimental) Adds a resource of type virtualGateway to the statement.

        https://docs.aws.amazon.com/app-mesh/latest/userguide/virtual_gateways.html

        :param mesh_name: - Identifier for the meshName.
        :param virtual_gateway_name: - Identifier for the virtualGatewayName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "onVirtualGateway", [mesh_name, virtual_gateway_name, account, region, partition]))

    @jsii.member(jsii_name="onVirtualNode")
    def on_virtual_node(
        self,
        mesh_name: builtins.str,
        virtual_node_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "AppmeshPreview":
        '''(experimental) Adds a resource of type virtualNode to the statement.

        https://docs.aws.amazon.com/app-mesh/latest/userguide/virtual_nodes.html

        :param mesh_name: - Identifier for the meshName.
        :param virtual_node_name: - Identifier for the virtualNodeName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "onVirtualNode", [mesh_name, virtual_node_name, account, region, partition]))

    @jsii.member(jsii_name="onVirtualRouter")
    def on_virtual_router(
        self,
        mesh_name: builtins.str,
        virtual_router_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "AppmeshPreview":
        '''(experimental) Adds a resource of type virtualRouter to the statement.

        https://docs.aws.amazon.com/app-mesh/latest/userguide/virtual_routers.html

        :param mesh_name: - Identifier for the meshName.
        :param virtual_router_name: - Identifier for the virtualRouterName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "onVirtualRouter", [mesh_name, virtual_router_name, account, region, partition]))

    @jsii.member(jsii_name="onVirtualService")
    def on_virtual_service(
        self,
        mesh_name: builtins.str,
        virtual_service_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "AppmeshPreview":
        '''(experimental) Adds a resource of type virtualService to the statement.

        https://docs.aws.amazon.com/app-mesh/latest/userguide/virtual_services.html

        :param mesh_name: - Identifier for the meshName.
        :param virtual_service_name: - Identifier for the virtualServiceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "onVirtualService", [mesh_name, virtual_service_name, account, region, partition]))

    @jsii.member(jsii_name="toCreateGatewayRoute")
    def to_create_gateway_route(self) -> "AppmeshPreview":
        '''(experimental) Creates a gateway route that is associated with a virtual gateway.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_CreateGatewayRoute.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toCreateGatewayRoute", []))

    @jsii.member(jsii_name="toCreateMesh")
    def to_create_mesh(self) -> "AppmeshPreview":
        '''(experimental) Creates a service mesh.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_CreateMesh.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toCreateMesh", []))

    @jsii.member(jsii_name="toCreateRoute")
    def to_create_route(self) -> "AppmeshPreview":
        '''(experimental) Creates a route that is associated with a virtual router.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_CreateRoute.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toCreateRoute", []))

    @jsii.member(jsii_name="toCreateVirtualGateway")
    def to_create_virtual_gateway(self) -> "AppmeshPreview":
        '''(experimental) Creates a virtual gateway within a service mesh.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_CreateVirtualGateway.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toCreateVirtualGateway", []))

    @jsii.member(jsii_name="toCreateVirtualNode")
    def to_create_virtual_node(self) -> "AppmeshPreview":
        '''(experimental) Creates a virtual node within a service mesh.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_CreateVirtualNode.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toCreateVirtualNode", []))

    @jsii.member(jsii_name="toCreateVirtualRouter")
    def to_create_virtual_router(self) -> "AppmeshPreview":
        '''(experimental) Creates a virtual router within a service mesh.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_CreateVirtualRouter.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toCreateVirtualRouter", []))

    @jsii.member(jsii_name="toCreateVirtualService")
    def to_create_virtual_service(self) -> "AppmeshPreview":
        '''(experimental) Creates a virtual service within a service mesh.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_CreateVirtualService.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toCreateVirtualService", []))

    @jsii.member(jsii_name="toDeleteGatewayRoute")
    def to_delete_gateway_route(self) -> "AppmeshPreview":
        '''(experimental) Deletes an existing gateway route.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DeleteGatewayRoute.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toDeleteGatewayRoute", []))

    @jsii.member(jsii_name="toDeleteMesh")
    def to_delete_mesh(self) -> "AppmeshPreview":
        '''(experimental) Deletes an existing service mesh.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DeleteMesh.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toDeleteMesh", []))

    @jsii.member(jsii_name="toDeleteRoute")
    def to_delete_route(self) -> "AppmeshPreview":
        '''(experimental) Deletes an existing route.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DeleteRoute.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toDeleteRoute", []))

    @jsii.member(jsii_name="toDeleteVirtualGateway")
    def to_delete_virtual_gateway(self) -> "AppmeshPreview":
        '''(experimental) Deletes an existing virtual gateway.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DeleteVirtualGateway.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toDeleteVirtualGateway", []))

    @jsii.member(jsii_name="toDeleteVirtualNode")
    def to_delete_virtual_node(self) -> "AppmeshPreview":
        '''(experimental) Deletes an existing virtual node.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DeleteVirtualNode.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toDeleteVirtualNode", []))

    @jsii.member(jsii_name="toDeleteVirtualRouter")
    def to_delete_virtual_router(self) -> "AppmeshPreview":
        '''(experimental) Deletes an existing virtual router.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DeleteVirtualRouter.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toDeleteVirtualRouter", []))

    @jsii.member(jsii_name="toDeleteVirtualService")
    def to_delete_virtual_service(self) -> "AppmeshPreview":
        '''(experimental) Deletes an existing virtual service.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DeleteVirtualService.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toDeleteVirtualService", []))

    @jsii.member(jsii_name="toDescribeGatewayRoute")
    def to_describe_gateway_route(self) -> "AppmeshPreview":
        '''(experimental) Describes an existing gateway route.

        Access Level: Read

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DescribeGatewayRoute.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toDescribeGatewayRoute", []))

    @jsii.member(jsii_name="toDescribeMesh")
    def to_describe_mesh(self) -> "AppmeshPreview":
        '''(experimental) Describes an existing service mesh.

        Access Level: Read

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DescribeMesh.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toDescribeMesh", []))

    @jsii.member(jsii_name="toDescribeRoute")
    def to_describe_route(self) -> "AppmeshPreview":
        '''(experimental) Describes an existing route.

        Access Level: Read

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DescribeRoute.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toDescribeRoute", []))

    @jsii.member(jsii_name="toDescribeVirtualGateway")
    def to_describe_virtual_gateway(self) -> "AppmeshPreview":
        '''(experimental) Describes an existing virtual gateway.

        Access Level: Read

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DescribeVirtualGateway.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toDescribeVirtualGateway", []))

    @jsii.member(jsii_name="toDescribeVirtualNode")
    def to_describe_virtual_node(self) -> "AppmeshPreview":
        '''(experimental) Describes an existing virtual node.

        Access Level: Read

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DescribeVirtualNode.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toDescribeVirtualNode", []))

    @jsii.member(jsii_name="toDescribeVirtualRouter")
    def to_describe_virtual_router(self) -> "AppmeshPreview":
        '''(experimental) Describes an existing virtual router.

        Access Level: Read

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DescribeVirtualRouter.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toDescribeVirtualRouter", []))

    @jsii.member(jsii_name="toDescribeVirtualService")
    def to_describe_virtual_service(self) -> "AppmeshPreview":
        '''(experimental) Describes an existing virtual service.

        Access Level: Read

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DescribeVirtualService.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toDescribeVirtualService", []))

    @jsii.member(jsii_name="toListGatewayRoutes")
    def to_list_gateway_routes(self) -> "AppmeshPreview":
        '''(experimental) Returns a list of existing gateway routes in a service mesh.

        Access Level: List

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_ListGatewayRoutes.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toListGatewayRoutes", []))

    @jsii.member(jsii_name="toListMeshes")
    def to_list_meshes(self) -> "AppmeshPreview":
        '''(experimental) Returns a list of existing service meshes.

        Access Level: List

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_ListMeshes.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toListMeshes", []))

    @jsii.member(jsii_name="toListRoutes")
    def to_list_routes(self) -> "AppmeshPreview":
        '''(experimental) Returns a list of existing routes in a service mesh.

        Access Level: List

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_ListRoutes.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toListRoutes", []))

    @jsii.member(jsii_name="toListVirtualGateways")
    def to_list_virtual_gateways(self) -> "AppmeshPreview":
        '''(experimental) Returns a list of existing virtual gateways in a service mesh.

        Access Level: List

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_ListVirtualGateways.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toListVirtualGateways", []))

    @jsii.member(jsii_name="toListVirtualNodes")
    def to_list_virtual_nodes(self) -> "AppmeshPreview":
        '''(experimental) Returns a list of existing virtual nodes.

        Access Level: List

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_ListVirtualNodes.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toListVirtualNodes", []))

    @jsii.member(jsii_name="toListVirtualRouters")
    def to_list_virtual_routers(self) -> "AppmeshPreview":
        '''(experimental) Returns a list of existing virtual routers in a service mesh.

        Access Level: List

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_ListVirtualRouters.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toListVirtualRouters", []))

    @jsii.member(jsii_name="toListVirtualServices")
    def to_list_virtual_services(self) -> "AppmeshPreview":
        '''(experimental) Returns a list of existing virtual services in a service mesh.

        Access Level: List

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_ListVirtualServices.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toListVirtualServices", []))

    @jsii.member(jsii_name="toStreamAggregatedResources")
    def to_stream_aggregated_resources(self) -> "AppmeshPreview":
        '''(experimental) Allows an Envoy Proxy to receive streamed resources for an App Mesh endpoint (VirtualNode/VirtualGateway).

        Access Level: Read

        https://docs.aws.amazon.com/app-mesh/latest/userguide/envoy.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toStreamAggregatedResources", []))

    @jsii.member(jsii_name="toUpdateGatewayRoute")
    def to_update_gateway_route(self) -> "AppmeshPreview":
        '''(experimental) Updates an existing gateway route for a specified service mesh and virtual gateway.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_UpdateGatewayRoute.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toUpdateGatewayRoute", []))

    @jsii.member(jsii_name="toUpdateMesh")
    def to_update_mesh(self) -> "AppmeshPreview":
        '''(experimental) Updates an existing service mesh.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_UpdateMesh.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toUpdateMesh", []))

    @jsii.member(jsii_name="toUpdateRoute")
    def to_update_route(self) -> "AppmeshPreview":
        '''(experimental) Updates an existing route for a specified service mesh and virtual router.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_UpdateRoute.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toUpdateRoute", []))

    @jsii.member(jsii_name="toUpdateVirtualGateway")
    def to_update_virtual_gateway(self) -> "AppmeshPreview":
        '''(experimental) Updates an existing virtual gateway in a specified service mesh.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_UpdateVirtualGateway.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toUpdateVirtualGateway", []))

    @jsii.member(jsii_name="toUpdateVirtualNode")
    def to_update_virtual_node(self) -> "AppmeshPreview":
        '''(experimental) Updates an existing virtual node in a specified service mesh.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_UpdateVirtualNode.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toUpdateVirtualNode", []))

    @jsii.member(jsii_name="toUpdateVirtualRouter")
    def to_update_virtual_router(self) -> "AppmeshPreview":
        '''(experimental) Updates an existing virtual router in a specified service mesh.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_UpdateVirtualRouter.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toUpdateVirtualRouter", []))

    @jsii.member(jsii_name="toUpdateVirtualService")
    def to_update_virtual_service(self) -> "AppmeshPreview":
        '''(experimental) Updates an existing virtual service in a specified service mesh.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_UpdateVirtualService.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toUpdateVirtualService", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Appstream(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Appstream",
):
    '''(experimental) Statement provider for service `appstream <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonappstream2.0.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `appstream <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonappstream2.0.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Appstream, self, [sid])

    @jsii.member(jsii_name="ifUserId")
    def if_user_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Appstream":
        '''(experimental) Filters access by the ID of the AppStream 2.0 user.

        https://docs.aws.amazon.com/appstream2/latest/developerguide/external-identity-providers-setting-up-saml.html#external-identity-providers-embed-inline-policy-for-IAM-role

        Applies to actions:

        - .toStream()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "ifUserId", [value, operator]))

    @jsii.member(jsii_name="onFleet")
    def on_fleet(
        self,
        fleet_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appstream":
        '''(experimental) Adds a resource of type fleet to the statement.

        https://docs.aws.amazon.com/appstream2/latest/developerguide/what-is-appstream.html#what-is-concepts

        :param fleet_name: - Identifier for the fleetName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "onFleet", [fleet_name, account, region, partition]))

    @jsii.member(jsii_name="onImage")
    def on_image(
        self,
        image_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appstream":
        '''(experimental) Adds a resource of type image to the statement.

        https://docs.aws.amazon.com/appstream2/latest/developerguide/what-is-appstream.html#what-is-concepts

        :param image_name: - Identifier for the imageName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "onImage", [image_name, account, region, partition]))

    @jsii.member(jsii_name="onImageBuilder")
    def on_image_builder(
        self,
        image_builder_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appstream":
        '''(experimental) Adds a resource of type image-builder to the statement.

        https://docs.aws.amazon.com/appstream2/latest/developerguide/what-is-appstream.html#what-is-concepts

        :param image_builder_name: - Identifier for the imageBuilderName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "onImageBuilder", [image_builder_name, account, region, partition]))

    @jsii.member(jsii_name="onStack")
    def on_stack(
        self,
        stack_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appstream":
        '''(experimental) Adds a resource of type stack to the statement.

        https://docs.aws.amazon.com/appstream2/latest/developerguide/what-is-appstream.html#what-is-concepts

        :param stack_name: - Identifier for the stackName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "onStack", [stack_name, account, region, partition]))

    @jsii.member(jsii_name="toAssociateFleet")
    def to_associate_fleet(self) -> "Appstream":
        '''(experimental) Grants permission to associate the specified fleet with the specified stack.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_AssociateFleet.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toAssociateFleet", []))

    @jsii.member(jsii_name="toBatchAssociateUserStack")
    def to_batch_associate_user_stack(self) -> "Appstream":
        '''(experimental) Grants permission to associate the specified users with the specified stacks.

        Users in a user pool cannot be assigned to stacks with fleets that are joined to an Active Directory domain

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_BatchAssociateUserStack.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toBatchAssociateUserStack", []))

    @jsii.member(jsii_name="toBatchDisassociateUserStack")
    def to_batch_disassociate_user_stack(self) -> "Appstream":
        '''(experimental) Grants permission to disassociate the specified users from the specified stacks.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_BatchDisassociateUserStack.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toBatchDisassociateUserStack", []))

    @jsii.member(jsii_name="toCopyImage")
    def to_copy_image(self) -> "Appstream":
        '''(experimental) Grants permission to copy the specified image within the same Region or to a new Region within the same AWS account.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_CopyImage.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toCopyImage", []))

    @jsii.member(jsii_name="toCreateDirectoryConfig")
    def to_create_directory_config(self) -> "Appstream":
        '''(experimental) Grants permission to create a Directory Config object in AppStream 2.0. This object includes the configuration information required to join fleets and image builders to Microsoft Active Directory domains.

        Access Level: Write

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_CreateDirectoryConfig.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toCreateDirectoryConfig", []))

    @jsii.member(jsii_name="toCreateFleet")
    def to_create_fleet(self) -> "Appstream":
        '''(experimental) Grants permission to create a fleet.

        A fleet is a group of streaming instances from which applications are launched and streamed to users

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_CreateFleet.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toCreateFleet", []))

    @jsii.member(jsii_name="toCreateImageBuilder")
    def to_create_image_builder(self) -> "Appstream":
        '''(experimental) Grants permission to create an image builder.

        An image builder is a virtual machine that is used to create an image

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_CreateImageBuilder.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toCreateImageBuilder", []))

    @jsii.member(jsii_name="toCreateImageBuilderStreamingURL")
    def to_create_image_builder_streaming_url(self) -> "Appstream":
        '''(experimental) Grants permission to create a URL to start an image builder streaming session.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_CreateImageBuilderStreamingURL.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toCreateImageBuilderStreamingURL", []))

    @jsii.member(jsii_name="toCreateStack")
    def to_create_stack(self) -> "Appstream":
        '''(experimental) Grants permission to create a stack to start streaming applications to users.

        A stack consists of an associated fleet, user access policies, and storage configurations

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_CreateStack.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toCreateStack", []))

    @jsii.member(jsii_name="toCreateStreamingURL")
    def to_create_streaming_url(self) -> "Appstream":
        '''(experimental) Grants permission to create a temporary URL to start an AppStream 2.0 streaming session for the specified user. A streaming URL enables application streaming to be tested without user setup.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_CreateStreamingURL.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toCreateStreamingURL", []))

    @jsii.member(jsii_name="toCreateUsageReportSubscription")
    def to_create_usage_report_subscription(self) -> "Appstream":
        '''(experimental) Grants permission to create a usage report subscription. Usage reports are generated daily.

        Access Level: Write

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_CreateUsageReportSubscription.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toCreateUsageReportSubscription", []))

    @jsii.member(jsii_name="toCreateUser")
    def to_create_user(self) -> "Appstream":
        '''(experimental) Grants permission to create a new user in the user pool.

        Access Level: Write

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_CreateUser.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toCreateUser", []))

    @jsii.member(jsii_name="toDeleteDirectoryConfig")
    def to_delete_directory_config(self) -> "Appstream":
        '''(experimental) Grants permission to delete the specified Directory Config object from AppStream 2.0. This object includes the configuration information required to join fleets and image builders to Microsoft Active Directory domains.

        Access Level: Write

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DeleteDirectoryConfig.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDeleteDirectoryConfig", []))

    @jsii.member(jsii_name="toDeleteFleet")
    def to_delete_fleet(self) -> "Appstream":
        '''(experimental) Grants permission to delete the specified fleet.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DeleteFleet.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDeleteFleet", []))

    @jsii.member(jsii_name="toDeleteImage")
    def to_delete_image(self) -> "Appstream":
        '''(experimental) Grants permission to delete the specified image. An image cannot be deleted when it is in use.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DeleteImage.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDeleteImage", []))

    @jsii.member(jsii_name="toDeleteImageBuilder")
    def to_delete_image_builder(self) -> "Appstream":
        '''(experimental) Grants permission to delete the specified image builder and release capacity.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DeleteImageBuilder.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDeleteImageBuilder", []))

    @jsii.member(jsii_name="toDeleteImagePermissions")
    def to_delete_image_permissions(self) -> "Appstream":
        '''(experimental) Grants permission to delete permissions for the specified private image.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DeleteImagePermissions.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDeleteImagePermissions", []))

    @jsii.member(jsii_name="toDeleteStack")
    def to_delete_stack(self) -> "Appstream":
        '''(experimental) Grants permission to delete the specified stack.

        After the stack is deleted, the application streaming environment provided by the stack is no longer available to users. Also, any reservations made for application streaming sessions for the stack are released

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DeleteStack.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDeleteStack", []))

    @jsii.member(jsii_name="toDeleteUsageReportSubscription")
    def to_delete_usage_report_subscription(self) -> "Appstream":
        '''(experimental) Grants permission to disable usage report generation.

        Access Level: Write

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DeleteUsageReportSubscription.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDeleteUsageReportSubscription", []))

    @jsii.member(jsii_name="toDeleteUser")
    def to_delete_user(self) -> "Appstream":
        '''(experimental) Grants permission to delete a user from the user pool.

        Access Level: Write

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DeleteUser.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDeleteUser", []))

    @jsii.member(jsii_name="toDescribeDirectoryConfigs")
    def to_describe_directory_configs(self) -> "Appstream":
        '''(experimental) Grants permission to retrieve a list that describes one or more specified Directory Config objects for AppStream 2.0, if the names for these objects are provided. Otherwise, all Directory Config objects in the account are described. This object includes the configuration information required to join fleets and image builders to Microsoft Active Directory domains.

        Access Level: Read

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DescribeDirectoryConfigs.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDescribeDirectoryConfigs", []))

    @jsii.member(jsii_name="toDescribeFleets")
    def to_describe_fleets(self) -> "Appstream":
        '''(experimental) Grants permission to retrieve a list that describes one or more specified fleets, if the fleet names are provided.

        Otherwise, all fleets in the account are described

        Access Level: Read

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DescribeFleets.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDescribeFleets", []))

    @jsii.member(jsii_name="toDescribeImageBuilders")
    def to_describe_image_builders(self) -> "Appstream":
        '''(experimental) Grants permission to retrieve a list that describes one or more specified image builders, if the image builder names are provided.

        Otherwise, all image builders in the account are described

        Access Level: Read

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DescribeImageBuilders.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDescribeImageBuilders", []))

    @jsii.member(jsii_name="toDescribeImagePermissions")
    def to_describe_image_permissions(self) -> "Appstream":
        '''(experimental) Grants permission to retrieve a list that describes the permissions for shared AWS account IDs on a private image that you own.

        Access Level: Read

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DescribeImagePermissions.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDescribeImagePermissions", []))

    @jsii.member(jsii_name="toDescribeImages")
    def to_describe_images(self) -> "Appstream":
        '''(experimental) Grants permission to retrieve a list that describes one or more specified images, if the image names or image ARNs are provided.

        Otherwise, all images in the account are described

        Access Level: Read

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DescribeImages.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDescribeImages", []))

    @jsii.member(jsii_name="toDescribeSessions")
    def to_describe_sessions(self) -> "Appstream":
        '''(experimental) Grants permission to retrieve a list that describes the streaming sessions for the specified stack and fleet.

        If a user ID is provided for the stack and fleet, only the streaming sessions for that user are described

        Access Level: Read

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DescribeSessions.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDescribeSessions", []))

    @jsii.member(jsii_name="toDescribeStacks")
    def to_describe_stacks(self) -> "Appstream":
        '''(experimental) Grants permission to retrieve a list that describes one or more specified stacks, if the stack names are provided.

        Otherwise, all stacks in the account are described

        Access Level: Read

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DescribeStacks.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDescribeStacks", []))

    @jsii.member(jsii_name="toDescribeUsageReportSubscriptions")
    def to_describe_usage_report_subscriptions(self) -> "Appstream":
        '''(experimental) Grants permission to retrieve a list that describes one or more usage report subscriptions.

        Access Level: Read

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DescribeUsageReportSubscriptions.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDescribeUsageReportSubscriptions", []))

    @jsii.member(jsii_name="toDescribeUsers")
    def to_describe_users(self) -> "Appstream":
        '''(experimental) Grants permission to retrieve a list that describes users in the user pool.

        Access Level: Read

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DescribeUsers.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDescribeUsers", []))

    @jsii.member(jsii_name="toDescribeUserStackAssociations")
    def to_describe_user_stack_associations(self) -> "Appstream":
        '''(experimental) Grants permission to retrieve a list that describes the UserStackAssociation objects.

        Access Level: Read

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DescribeUserStackAssociations.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDescribeUserStackAssociations", []))

    @jsii.member(jsii_name="toDisableUser")
    def to_disable_user(self) -> "Appstream":
        '''(experimental) Grants permission to disable the specified user in the user pool. This action does not delete the user.

        Access Level: Write

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DisableUser.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDisableUser", []))

    @jsii.member(jsii_name="toDisassociateFleet")
    def to_disassociate_fleet(self) -> "Appstream":
        '''(experimental) Grants permission to disassociate the specified fleet from the specified stack.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DisassociateFleet.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDisassociateFleet", []))

    @jsii.member(jsii_name="toEnableUser")
    def to_enable_user(self) -> "Appstream":
        '''(experimental) Grants permission to enable a user in the user pool.

        Access Level: Write

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_EnableUser.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toEnableUser", []))

    @jsii.member(jsii_name="toExpireSession")
    def to_expire_session(self) -> "Appstream":
        '''(experimental) Grants permission to immediately stop the specified streaming session.

        Access Level: Write

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_ExpireSession.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toExpireSession", []))

    @jsii.member(jsii_name="toListAssociatedFleets")
    def to_list_associated_fleets(self) -> "Appstream":
        '''(experimental) Grants permission to retrieve the name of the fleet that is associated with the specified stack.

        Access Level: Read

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_ListAssociatedFleets.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toListAssociatedFleets", []))

    @jsii.member(jsii_name="toListAssociatedStacks")
    def to_list_associated_stacks(self) -> "Appstream":
        '''(experimental) Grants permission to retrieve the name of the stack with which the specified fleet is associated.

        Access Level: Read

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_ListAssociatedStacks.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toListAssociatedStacks", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Appstream":
        '''(experimental) Grants permission to retrieve a list of all tags for the specified AppStream 2.0 resource. The following resources can be tagged: Image builders, images, fleets, and stacks.

        Access Level: Read

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toStartFleet")
    def to_start_fleet(self) -> "Appstream":
        '''(experimental) Grants permission to start the specified fleet.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_StartFleet.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toStartFleet", []))

    @jsii.member(jsii_name="toStartImageBuilder")
    def to_start_image_builder(self) -> "Appstream":
        '''(experimental) Grants permission to start the specified image builder.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_StartImageBuilder.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toStartImageBuilder", []))

    @jsii.member(jsii_name="toStopFleet")
    def to_stop_fleet(self) -> "Appstream":
        '''(experimental) Grants permission to stop the specified fleet.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_StopFleet.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toStopFleet", []))

    @jsii.member(jsii_name="toStopImageBuilder")
    def to_stop_image_builder(self) -> "Appstream":
        '''(experimental) Grants permission to stop the specified image builder.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_StopImageBuilder.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toStopImageBuilder", []))

    @jsii.member(jsii_name="toStream")
    def to_stream(self) -> "Appstream":
        '''(experimental) Grants permission to federated users to sign in by using their existing credentials and stream applications from the specified stack.

        Access Level: Write

        Possible conditions:

        - .ifUserId()

        https://docs.aws.amazon.com/appstream2/latest/developerguide/external-identity-providers-setting-up-saml.html#external-identity-providers-embed-inline-policy-for-IAM-role

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toStream", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Appstream":
        '''(experimental) Grants permission to add or overwrite one or more tags for the specified AppStream 2.0 resource. The following resources can be tagged: Image builders, images, fleets, and stacks.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Appstream":
        '''(experimental) Grants permission to disassociate one or more tags from the specified AppStream 2.0 resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateDirectoryConfig")
    def to_update_directory_config(self) -> "Appstream":
        '''(experimental) Grants permission to update the specified Directory Config object in AppStream 2.0. This object includes the configuration information required to join fleets and image builders to Microsoft Active Directory domains.

        Access Level: Write

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_UpdateDirectoryConfig.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toUpdateDirectoryConfig", []))

    @jsii.member(jsii_name="toUpdateFleet")
    def to_update_fleet(self) -> "Appstream":
        '''(experimental) Grants permission to update the specified fleet.

        All attributes except the fleet name can be updated when the fleet is in the STOPPED state

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_UpdateFleet.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toUpdateFleet", []))

    @jsii.member(jsii_name="toUpdateImagePermissions")
    def to_update_image_permissions(self) -> "Appstream":
        '''(experimental) Grants permission to add or update permissions for the specified private image.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_UpdateImagePermissions.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toUpdateImagePermissions", []))

    @jsii.member(jsii_name="toUpdateStack")
    def to_update_stack(self) -> "Appstream":
        '''(experimental) Grants permission to update the specified fields for the specified stack.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_UpdateStack.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toUpdateStack", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Appsync(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Appsync"):
    '''(experimental) Statement provider for service `appsync <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsappsync.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `appsync <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsappsync.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Appsync, self, [sid])

    @jsii.member(jsii_name="onDatasource")
    def on_datasource(
        self,
        graph_qlapi_id: builtins.str,
        datasource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appsync":
        '''(experimental) Adds a resource of type datasource to the statement.

        https://docs.aws.amazon.com/appsync/latest/devguide/attaching-a-data-source.html

        :param graph_qlapi_id: - Identifier for the graphQLAPIId.
        :param datasource_name: - Identifier for the datasourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "onDatasource", [graph_qlapi_id, datasource_name, account, region, partition]))

    @jsii.member(jsii_name="onField")
    def on_field(
        self,
        graph_qlapi_id: builtins.str,
        type_name: builtins.str,
        field_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appsync":
        '''(experimental) Adds a resource of type field to the statement.

        https://docs.aws.amazon.com/appsync/latest/devguide/configuring-resolvers.html

        :param graph_qlapi_id: - Identifier for the graphQLAPIId.
        :param type_name: - Identifier for the typeName.
        :param field_name: - Identifier for the fieldName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "onField", [graph_qlapi_id, type_name, field_name, account, region, partition]))

    @jsii.member(jsii_name="onFunction")
    def on_function(
        self,
        graph_qlapi_id: builtins.str,
        function_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appsync":
        '''(experimental) Adds a resource of type function to the statement.

        https://docs.aws.amazon.com/appsync/latest/devguide/pipeline-resolvers.html

        :param graph_qlapi_id: - Identifier for the graphQLAPIId.
        :param function_id: - Identifier for the functionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "onFunction", [graph_qlapi_id, function_id, account, region, partition]))

    @jsii.member(jsii_name="onGraphqlapi")
    def on_graphqlapi(
        self,
        graph_qlapi_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appsync":
        '''(experimental) Adds a resource of type graphqlapi to the statement.

        https://docs.aws.amazon.com/appsync/latest/devguide/designing-a-graphql-api.html

        :param graph_qlapi_id: - Identifier for the graphQLAPIId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "onGraphqlapi", [graph_qlapi_id, account, region, partition]))

    @jsii.member(jsii_name="onType")
    def on_type(
        self,
        graph_qlapi_id: builtins.str,
        type_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appsync":
        '''(experimental) Adds a resource of type type to the statement.

        https://docs.aws.amazon.com/appsync/latest/devguide/designing-your-schema.html#adding-a-root-query-type

        :param graph_qlapi_id: - Identifier for the graphQLAPIId.
        :param type_name: - Identifier for the typeName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "onType", [graph_qlapi_id, type_name, account, region, partition]))

    @jsii.member(jsii_name="toCreateApiKey")
    def to_create_api_key(self) -> "Appsync":
        '''(experimental) Creates a unique key that you can distribute to clients who are executing your API.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_CreateApiKey.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toCreateApiKey", []))

    @jsii.member(jsii_name="toCreateDataSource")
    def to_create_data_source(self) -> "Appsync":
        '''(experimental) Creates a DataSource object.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_CreateDataSource.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toCreateDataSource", []))

    @jsii.member(jsii_name="toCreateFunction")
    def to_create_function(self) -> "Appsync":
        '''(experimental) Create a new Function object.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_CreateFunction.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toCreateFunction", []))

    @jsii.member(jsii_name="toCreateGraphqlApi")
    def to_create_graphql_api(self) -> "Appsync":
        '''(experimental) Creates a GraphqlApi object, which is the top level AppSync resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_CreateGraphqlApi.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toCreateGraphqlApi", []))

    @jsii.member(jsii_name="toCreateResolver")
    def to_create_resolver(self) -> "Appsync":
        '''(experimental) Creates a Resolver object.

        A resolver converts incoming requests into a format that a data source can understand, and converts the data source's responses into GraphQL.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_CreateResolver.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toCreateResolver", []))

    @jsii.member(jsii_name="toCreateType")
    def to_create_type(self) -> "Appsync":
        '''(experimental) Creates a Type object.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_CreateType.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toCreateType", []))

    @jsii.member(jsii_name="toDeleteApiKey")
    def to_delete_api_key(self) -> "Appsync":
        '''(experimental) Deletes an API key.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_DeleteApiKey.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toDeleteApiKey", []))

    @jsii.member(jsii_name="toDeleteDataSource")
    def to_delete_data_source(self) -> "Appsync":
        '''(experimental) Deletes a DataSource object.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_DeleteDataSource.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toDeleteDataSource", []))

    @jsii.member(jsii_name="toDeleteFunction")
    def to_delete_function(self) -> "Appsync":
        '''(experimental) Deletes a Function object.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_DeleteFunction.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toDeleteFunction", []))

    @jsii.member(jsii_name="toDeleteGraphqlApi")
    def to_delete_graphql_api(self) -> "Appsync":
        '''(experimental) Deletes a GraphqlApi object. This will also clean up every AppSync resource below that API.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_DeleteGraphqlApi.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toDeleteGraphqlApi", []))

    @jsii.member(jsii_name="toDeleteResolver")
    def to_delete_resolver(self) -> "Appsync":
        '''(experimental) Deletes a Resolver object.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_DeleteResolver.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toDeleteResolver", []))

    @jsii.member(jsii_name="toDeleteType")
    def to_delete_type(self) -> "Appsync":
        '''(experimental) Deletes a Type object.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_DeleteType.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toDeleteType", []))

    @jsii.member(jsii_name="toGetDataSource")
    def to_get_data_source(self) -> "Appsync":
        '''(experimental) Retrieves a DataSource object.

        Access Level: Read

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_GetDataSource.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toGetDataSource", []))

    @jsii.member(jsii_name="toGetFunction")
    def to_get_function(self) -> "Appsync":
        '''(experimental) Retrieves a Function object.

        Access Level: Read

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_GetFunction.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toGetFunction", []))

    @jsii.member(jsii_name="toGetGraphqlApi")
    def to_get_graphql_api(self) -> "Appsync":
        '''(experimental) Retrieves a GraphqlApi object.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_GetGraphqlApi.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toGetGraphqlApi", []))

    @jsii.member(jsii_name="toGetIntrospectionSchema")
    def to_get_introspection_schema(self) -> "Appsync":
        '''(experimental) Retrieves the introspection schema for a GraphQL API.

        Access Level: Read

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_GetIntrospectionSchema.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toGetIntrospectionSchema", []))

    @jsii.member(jsii_name="toGetResolver")
    def to_get_resolver(self) -> "Appsync":
        '''(experimental) Retrieves a Resolver object.

        Access Level: Read

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_GetResolver.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toGetResolver", []))

    @jsii.member(jsii_name="toGetSchemaCreationStatus")
    def to_get_schema_creation_status(self) -> "Appsync":
        '''(experimental) Retrieves the current status of a schema creation operation.

        Access Level: Read

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_GetSchemaCreationStatus.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toGetSchemaCreationStatus", []))

    @jsii.member(jsii_name="toGetType")
    def to_get_type(self) -> "Appsync":
        '''(experimental) Retrieves a Type object.

        Access Level: Read

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_GetType.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toGetType", []))

    @jsii.member(jsii_name="toGraphQL")
    def to_graph_ql(self) -> "Appsync":
        '''(experimental) Sends a GraphQL query to a GraphQL API.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/devguide/using-your-api.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toGraphQL", []))

    @jsii.member(jsii_name="toListApiKeys")
    def to_list_api_keys(self) -> "Appsync":
        '''(experimental) Lists the API keys for a given API.

        Access Level: List

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_ListApiKeys.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toListApiKeys", []))

    @jsii.member(jsii_name="toListDataSources")
    def to_list_data_sources(self) -> "Appsync":
        '''(experimental) Lists the data sources for a given API.

        Access Level: List

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_ListDataSources.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toListDataSources", []))

    @jsii.member(jsii_name="toListFunctions")
    def to_list_functions(self) -> "Appsync":
        '''(experimental) Lists the functions for a given API.

        Access Level: List

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_ListFunctions.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toListFunctions", []))

    @jsii.member(jsii_name="toListGraphqlApis")
    def to_list_graphql_apis(self) -> "Appsync":
        '''(experimental) Lists your GraphQL APIs.

        Access Level: List

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_ListGraphqlApis.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toListGraphqlApis", []))

    @jsii.member(jsii_name="toListResolvers")
    def to_list_resolvers(self) -> "Appsync":
        '''(experimental) Lists the resolvers for a given API and type.

        Access Level: List

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_ListResolvers.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toListResolvers", []))

    @jsii.member(jsii_name="toListResolversByFunction")
    def to_list_resolvers_by_function(self) -> "Appsync":
        '''(experimental) List the resolvers that are associated with a specific function.

        Access Level: List

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_ListResolversByFunction.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toListResolversByFunction", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Appsync":
        '''(experimental) List the tags for a resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTypes")
    def to_list_types(self) -> "Appsync":
        '''(experimental) Lists the types for a given API.

        Access Level: List

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_ListTypes.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toListTypes", []))

    @jsii.member(jsii_name="toSetWebACL")
    def to_set_web_acl(self) -> "Appsync":
        '''(experimental) Gives WebAcl permissions to WAF.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_SetWebACL.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toSetWebACL", []))

    @jsii.member(jsii_name="toStartSchemaCreation")
    def to_start_schema_creation(self) -> "Appsync":
        '''(experimental) Adds a new schema to your GraphQL API.

        This operation is asynchronous - GetSchemaCreationStatus can show when it has completed.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_StartSchemaCreation.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toStartSchemaCreation", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Appsync":
        '''(experimental) Tag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Appsync":
        '''(experimental) Untag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateApiKey")
    def to_update_api_key(self) -> "Appsync":
        '''(experimental) Updates an API key for a given API.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_UpdateApiKey.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toUpdateApiKey", []))

    @jsii.member(jsii_name="toUpdateDataSource")
    def to_update_data_source(self) -> "Appsync":
        '''(experimental) Updates a DataSource object.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_UpdateDataSource.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toUpdateDataSource", []))

    @jsii.member(jsii_name="toUpdateFunction")
    def to_update_function(self) -> "Appsync":
        '''(experimental) Updates an existing Function object.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_UpdateFunction.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toUpdateFunction", []))

    @jsii.member(jsii_name="toUpdateGraphqlApi")
    def to_update_graphql_api(self) -> "Appsync":
        '''(experimental) Updates a GraphqlApi object.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_UpdateGraphqlApi.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toUpdateGraphqlApi", []))

    @jsii.member(jsii_name="toUpdateResolver")
    def to_update_resolver(self) -> "Appsync":
        '''(experimental) Updates a Resolver object.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_UpdateResolver.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toUpdateResolver", []))

    @jsii.member(jsii_name="toUpdateType")
    def to_update_type(self) -> "Appsync":
        '''(experimental) Updates a Type object.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_UpdateType.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toUpdateType", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Aps(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Aps"):
    '''(experimental) Statement provider for service `aps <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmanagedserviceforprometheus.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `aps <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmanagedserviceforprometheus.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Aps, self, [sid])

    @jsii.member(jsii_name="onWorkspace")
    def on_workspace(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Aps":
        '''(experimental) Adds a resource of type workspace to the statement.

        https://docs.aws.amazon.com/prometheus/latest/userguide/security-iam.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "onWorkspace", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateWorkspace")
    def to_create_workspace(self) -> "Aps":
        '''(experimental) Grants permission to create a workspace.

        Access Level: Write

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-CreateWorkspace

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toCreateWorkspace", []))

    @jsii.member(jsii_name="toDeleteWorkspace")
    def to_delete_workspace(self) -> "Aps":
        '''(experimental) Grants permission to delete a workspace.

        Access Level: Write

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-DeleteWorkspace

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toDeleteWorkspace", []))

    @jsii.member(jsii_name="toDescribeWorkspace")
    def to_describe_workspace(self) -> "Aps":
        '''(experimental) Grants permission to describe a workspace.

        Access Level: Read

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-DescribeWorkspace

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toDescribeWorkspace", []))

    @jsii.member(jsii_name="toGetLabels")
    def to_get_labels(self) -> "Aps":
        '''(experimental) Grants permission to retrieve AMP workspace labels.

        Access Level: Read

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-GetLabels

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toGetLabels", []))

    @jsii.member(jsii_name="toGetMetricMetadata")
    def to_get_metric_metadata(self) -> "Aps":
        '''(experimental) Grants permission to retrieve the metadata for AMP workspace metrics.

        Access Level: Read

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-GetMetricMetadata

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toGetMetricMetadata", []))

    @jsii.member(jsii_name="toGetSeries")
    def to_get_series(self) -> "Aps":
        '''(experimental) Grants permission to retrieve AMP workspace time series data.

        Access Level: Read

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-GetSeries

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toGetSeries", []))

    @jsii.member(jsii_name="toListWorkspaces")
    def to_list_workspaces(self) -> "Aps":
        '''(experimental) Grants permission to list workspaces.

        Access Level: List

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-ListWorkspaces

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toListWorkspaces", []))

    @jsii.member(jsii_name="toQueryMetrics")
    def to_query_metrics(self) -> "Aps":
        '''(experimental) Grants permission to run a query on AMP workspace metrics.

        Access Level: Read

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-QueryMetrics

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toQueryMetrics", []))

    @jsii.member(jsii_name="toRemoteWrite")
    def to_remote_write(self) -> "Aps":
        '''(experimental) Grants permission to perform a remote write operation to initiate the streaming of metrics to AMP workspace.

        Access Level: Write

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-RemoteWrite

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toRemoteWrite", []))

    @jsii.member(jsii_name="toUpdateWorkspaceAlias")
    def to_update_workspace_alias(self) -> "Aps":
        '''(experimental) Grants permission to modify the alias of existing AMP workspace.

        Access Level: Write

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-UpdateWorkspaceAlias

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toUpdateWorkspaceAlias", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Arsenal(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Arsenal"):
    '''(experimental) Statement provider for service `arsenal <https://docs.aws.amazon.com/service-authorization/latest/reference/list_applicationdiscoveryarsenal.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `arsenal <https://docs.aws.amazon.com/service-authorization/latest/reference/list_applicationdiscoveryarsenal.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Arsenal, self, [sid])

    @jsii.member(jsii_name="toRegisterOnPremisesAgent")
    def to_register_on_premises_agent(self) -> "Arsenal":
        '''(experimental) Grants permission to register AWS provided data collectors to the Application Discovery Service.

        Access Level: Write

        https://docs.aws.amazon.com/application-discovery/latest/userguide/setting-up.html

        :stability: experimental
        '''
        return typing.cast("Arsenal", jsii.invoke(self, "toRegisterOnPremisesAgent", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Artifact(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Artifact",
):
    '''(experimental) Statement provider for service `artifact <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsartifact.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `artifact <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsartifact.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Artifact, self, [sid])

    @jsii.member(jsii_name="onAgreement")
    def on_agreement(
        self,
        resource_name: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Artifact":
        '''(experimental) Adds a resource of type agreement to the statement.

        https://docs.aws.amazon.com/artifact/latest/ug/managingagreements.html

        :param resource_name: - Identifier for the resourceName.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Artifact", jsii.invoke(self, "onAgreement", [resource_name, partition]))

    @jsii.member(jsii_name="onCustomerAgreement")
    def on_customer_agreement(
        self,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Artifact":
        '''(experimental) Adds a resource of type customer-agreement to the statement.

        https://docs.aws.amazon.com/artifact/latest/ug/$managingagreements.html

        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Artifact", jsii.invoke(self, "onCustomerAgreement", [resource_name, account, partition]))

    @jsii.member(jsii_name="onReportPackage")
    def on_report_package(
        self,
        resource_name: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Artifact":
        '''(experimental) Adds a resource of type report-package to the statement.

        https://docs.aws.amazon.com/artifact/latest/ug/what-is-aws-artifact.html

        :param resource_name: - Identifier for the resourceName.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Artifact", jsii.invoke(self, "onReportPackage", [resource_name, partition]))

    @jsii.member(jsii_name="toAcceptAgreement")
    def to_accept_agreement(self) -> "Artifact":
        '''(experimental) Grants permission to accept an AWS agreement that has not yet been accepted by the customer account.

        Access Level: Write

        https://docs.aws.amazon.com/artifact/latest/ug/managingagreements.html

        :stability: experimental
        '''
        return typing.cast("Artifact", jsii.invoke(self, "toAcceptAgreement", []))

    @jsii.member(jsii_name="toDownloadAgreement")
    def to_download_agreement(self) -> "Artifact":
        '''(experimental) Grants permission to download an AWS agreement that has not yet been accepted or a customer agreement that has been accepted by the customer account.

        Access Level: Read

        https://docs.aws.amazon.com/artifact/latest/ug/managingagreements.html

        :stability: experimental
        '''
        return typing.cast("Artifact", jsii.invoke(self, "toDownloadAgreement", []))

    @jsii.member(jsii_name="toGet")
    def to_get(self) -> "Artifact":
        '''(experimental) Grants permission to download an AWS compliance report package.

        Access Level: Read

        https://docs.aws.amazon.com/artifact/latest/ug/getting-started.html

        :stability: experimental
        '''
        return typing.cast("Artifact", jsii.invoke(self, "toGet", []))

    @jsii.member(jsii_name="toTerminateAgreement")
    def to_terminate_agreement(self) -> "Artifact":
        '''(experimental) Grants permission to terminate a customer agreement that was previously accepted by the customer account.

        Access Level: Write

        https://docs.aws.amazon.com/artifact/latest/ug/managingagreements.html

        :stability: experimental
        '''
        return typing.cast("Artifact", jsii.invoke(self, "toTerminateAgreement", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Athena(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Athena"):
    '''(experimental) Statement provider for service `athena <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonathena.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `athena <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonathena.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Athena, self, [sid])

    @jsii.member(jsii_name="onDatacatalog")
    def on_datacatalog(
        self,
        data_catalog_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Athena":
        '''(experimental) Adds a resource of type datacatalog to the statement.

        https://docs.aws.amazon.com/athena/latest/ug/datacatalogs-example-policies.html

        :param data_catalog_name: - Identifier for the dataCatalogName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "onDatacatalog", [data_catalog_name, account, region, partition]))

    @jsii.member(jsii_name="onWorkgroup")
    def on_workgroup(
        self,
        work_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Athena":
        '''(experimental) Adds a resource of type workgroup to the statement.

        https://docs.aws.amazon.com/athena/latest/ug/example-policies-workgroup.html

        :param work_group_name: - Identifier for the workGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "onWorkgroup", [work_group_name, account, region, partition]))

    @jsii.member(jsii_name="toBatchGetNamedQuery")
    def to_batch_get_named_query(self) -> "Athena":
        '''(experimental) Grants permissions to get information about one or more named queries.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/APIReference/API_BatchGetNamedQuery.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toBatchGetNamedQuery", []))

    @jsii.member(jsii_name="toBatchGetQueryExecution")
    def to_batch_get_query_execution(self) -> "Athena":
        '''(experimental) Grants permissions to get information about one or more query executions.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/APIReference/API_BatchGetQueryExecution.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toBatchGetQueryExecution", []))

    @jsii.member(jsii_name="toCreateDataCatalog")
    def to_create_data_catalog(self) -> "Athena":
        '''(experimental) Grants permissions to create a datacatalog.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/athena/latest/APIReference/API_CreateDataCatalog.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toCreateDataCatalog", []))

    @jsii.member(jsii_name="toCreateNamedQuery")
    def to_create_named_query(self) -> "Athena":
        '''(experimental) Grants permissions to create a named query.

        Access Level: Write

        https://docs.aws.amazon.com/athena/latest/APIReference/API_CreateNamedQuery.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toCreateNamedQuery", []))

    @jsii.member(jsii_name="toCreatePreparedStatement")
    def to_create_prepared_statement(self) -> "Athena":
        '''(experimental) Grants permissions to create a prepared statement.

        Access Level: Write

        https://docs.aws.amazon.com/athena/latest/APIReference/API_CreatePreparedStatement.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toCreatePreparedStatement", []))

    @jsii.member(jsii_name="toCreateWorkGroup")
    def to_create_work_group(self) -> "Athena":
        '''(experimental) Grants permissions to create a workgroup.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/athena/latest/APIReference/API_CreateWorkGroup.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toCreateWorkGroup", []))

    @jsii.member(jsii_name="toDeleteDataCatalog")
    def to_delete_data_catalog(self) -> "Athena":
        '''(experimental) Grants permissions to delete a datacatalog.

        Access Level: Write

        https://docs.aws.amazon.com/athena/latest/APIReference/API_DeleteDataCatalog.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toDeleteDataCatalog", []))

    @jsii.member(jsii_name="toDeleteNamedQuery")
    def to_delete_named_query(self) -> "Athena":
        '''(experimental) Grants permissions to delete a named query specified.

        Access Level: Write

        https://docs.aws.amazon.com/athena/latest/APIReference/API_DeleteNamedQuery.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toDeleteNamedQuery", []))

    @jsii.member(jsii_name="toDeletePreparedStatement")
    def to_delete_prepared_statement(self) -> "Athena":
        '''(experimental) Grants permissions to delete a prepared statement specified.

        Access Level: Write

        https://docs.aws.amazon.com/athena/latest/APIReference/API_DeletePreparedStatement.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toDeletePreparedStatement", []))

    @jsii.member(jsii_name="toDeleteWorkGroup")
    def to_delete_work_group(self) -> "Athena":
        '''(experimental) Grants permissions to delete a workgroup.

        Access Level: Write

        https://docs.aws.amazon.com/athena/latest/APIReference/API_DeleteWorkGroup.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toDeleteWorkGroup", []))

    @jsii.member(jsii_name="toGetDatabase")
    def to_get_database(self) -> "Athena":
        '''(experimental) Grants permissions to get a database for a given datacatalog.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/APIReference/API_GetDatabase.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toGetDatabase", []))

    @jsii.member(jsii_name="toGetDataCatalog")
    def to_get_data_catalog(self) -> "Athena":
        '''(experimental) Grants permissions to get a datacatalog.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/APIReference/API_GetDataCatalog.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toGetDataCatalog", []))

    @jsii.member(jsii_name="toGetNamedQuery")
    def to_get_named_query(self) -> "Athena":
        '''(experimental) Grants permissions to get information about the specified named query.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/APIReference/API_GetNamedQuery.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toGetNamedQuery", []))

    @jsii.member(jsii_name="toGetPreparedStatement")
    def to_get_prepared_statement(self) -> "Athena":
        '''(experimental) Grants permissions to get information about the specified prepared statement.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/APIReference/API_GetPreparedStatement.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toGetPreparedStatement", []))

    @jsii.member(jsii_name="toGetQueryExecution")
    def to_get_query_execution(self) -> "Athena":
        '''(experimental) Grants permissions to get information about the specified query execution.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/APIReference/API_GetQueryExecution.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toGetQueryExecution", []))

    @jsii.member(jsii_name="toGetQueryResults")
    def to_get_query_results(self) -> "Athena":
        '''(experimental) Grants permissions to get the query results.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/APIReference/API_GetQueryResults.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toGetQueryResults", []))

    @jsii.member(jsii_name="toGetQueryResultsStream")
    def to_get_query_results_stream(self) -> "Athena":
        '''(experimental) Grants permissions to get the query results stream.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/ug/connect-with-previous-jdbc.html#jdbc-prev-version-policies

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toGetQueryResultsStream", []))

    @jsii.member(jsii_name="toGetTableMetadata")
    def to_get_table_metadata(self) -> "Athena":
        '''(experimental) Grants permissions to get a metadata about a table for a given datacatalog.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/APIReference/API_ GetTableMetadata.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toGetTableMetadata", []))

    @jsii.member(jsii_name="toGetWorkGroup")
    def to_get_work_group(self) -> "Athena":
        '''(experimental) Grants permissions to get a workgroup.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/APIReference/API_GetWorkGroup.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toGetWorkGroup", []))

    @jsii.member(jsii_name="toListDatabases")
    def to_list_databases(self) -> "Athena":
        '''(experimental) Grants permissions to return a list of databases for a given datacatalog.

        Access Level: List

        https://docs.aws.amazon.com/athena/latest/APIReference/API_ListDatabases.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toListDatabases", []))

    @jsii.member(jsii_name="toListDataCatalogs")
    def to_list_data_catalogs(self) -> "Athena":
        '''(experimental) Grants permissions to return a list of datacatalogs for the specified AWS account.

        Access Level: List

        https://docs.aws.amazon.com/athena/latest/APIReference/API_ListDataCatalogs.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toListDataCatalogs", []))

    @jsii.member(jsii_name="toListEngineVersions")
    def to_list_engine_versions(self) -> "Athena":
        '''(experimental) Grants permissions to return a list of athena engine versions for the specified AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/APIReference/API_ListEngineVersions.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toListEngineVersions", []))

    @jsii.member(jsii_name="toListNamedQueries")
    def to_list_named_queries(self) -> "Athena":
        '''(experimental) Grants permissions to return a list of named queries in Amazon Athena for the specified AWS account.

        Access Level: List

        https://docs.aws.amazon.com/athena/latest/APIReference/API_ListNamedQueries.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toListNamedQueries", []))

    @jsii.member(jsii_name="toListPreparedStatements")
    def to_list_prepared_statements(self) -> "Athena":
        '''(experimental) Grants permissions to return a list of prepared statements for the specified workgroup.

        Access Level: List

        https://docs.aws.amazon.com/athena/latest/APIReference/API_ListPreparedStatements.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toListPreparedStatements", []))

    @jsii.member(jsii_name="toListQueryExecutions")
    def to_list_query_executions(self) -> "Athena":
        '''(experimental) Grants permissions to return a list of query executions for the specified AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/APIReference/API_ListQueryExecutions.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toListQueryExecutions", []))

    @jsii.member(jsii_name="toListTableMetadata")
    def to_list_table_metadata(self) -> "Athena":
        '''(experimental) Grants permissions to return a list of table metadata in a database for a given datacatalog.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/APIReference/API_ListTableMetadata.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toListTableMetadata", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Athena":
        '''(experimental) Grants permissions to return a list of tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListWorkGroups")
    def to_list_work_groups(self) -> "Athena":
        '''(experimental) Grants permissions to return a list of workgroups for the specified AWS account.

        Access Level: List

        https://docs.aws.amazon.com/athena/latest/APIReference/API_ListWorkGroups.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toListWorkGroups", []))

    @jsii.member(jsii_name="toStartQueryExecution")
    def to_start_query_execution(self) -> "Athena":
        '''(experimental) Grants permissions to start a query execution using an SQL query provided as a string.

        Access Level: Write

        https://docs.aws.amazon.com/athena/latest/APIReference/API_StartQueryExecution.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toStartQueryExecution", []))

    @jsii.member(jsii_name="toStopQueryExecution")
    def to_stop_query_execution(self) -> "Athena":
        '''(experimental) Grants permissions to stop the specified query execution.

        Access Level: Write

        https://docs.aws.amazon.com/athena/latest/APIReference/API_StopQueryExecution.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toStopQueryExecution", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Athena":
        '''(experimental) Grants permissions to add a tag to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/athena/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Athena":
        '''(experimental) Grants permissions to remove a tag from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/athena/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateDataCatalog")
    def to_update_data_catalog(self) -> "Athena":
        '''(experimental) Grants permissions to update a datacatalog.

        Access Level: Write

        https://docs.aws.amazon.com/athena/latest/APIReference/API_UpdateDataCatalog.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toUpdateDataCatalog", []))

    @jsii.member(jsii_name="toUpdatePreparedStatement")
    def to_update_prepared_statement(self) -> "Athena":
        '''(experimental) Grants permissions to update a prepared statement.

        Access Level: Write

        https://docs.aws.amazon.com/athena/latest/APIReference/API_UpdatePreparedStatement.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toUpdatePreparedStatement", []))

    @jsii.member(jsii_name="toUpdateWorkGroup")
    def to_update_work_group(self) -> "Athena":
        '''(experimental) Grants permissions to update a workgroup.

        Access Level: Write

        https://docs.aws.amazon.com/athena/latest/APIReference/API_UpdateWorkGroup.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toUpdateWorkGroup", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Auditmanager(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Auditmanager",
):
    '''(experimental) Statement provider for service `auditmanager <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsauditmanager.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `auditmanager <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsauditmanager.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Auditmanager, self, [sid])

    @jsii.member(jsii_name="onAssessment")
    def on_assessment(
        self,
        assessment_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Auditmanager":
        '''(experimental) Adds a resource of type assessment to the statement.

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_Assessment.html

        :param assessment_id: - Identifier for the assessmentId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "onAssessment", [assessment_id, account, region, partition]))

    @jsii.member(jsii_name="onAssessmentControlSet")
    def on_assessment_control_set(
        self,
        assessment_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Auditmanager":
        '''(experimental) Adds a resource of type assessmentControlSet to the statement.

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_AssessmentControlSet.html

        :param assessment_id: - Identifier for the assessmentId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "onAssessmentControlSet", [assessment_id, account, region, partition]))

    @jsii.member(jsii_name="onAssessmentFramework")
    def on_assessment_framework(
        self,
        assessment_framework_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Auditmanager":
        '''(experimental) Adds a resource of type assessmentFramework to the statement.

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_AssessmentFramework.html

        :param assessment_framework_id: - Identifier for the assessmentFrameworkId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "onAssessmentFramework", [assessment_framework_id, account, region, partition]))

    @jsii.member(jsii_name="onControl")
    def on_control(
        self,
        control_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Auditmanager":
        '''(experimental) Adds a resource of type control to the statement.

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_Control.html

        :param control_id: - Identifier for the controlId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "onControl", [control_id, account, region, partition]))

    @jsii.member(jsii_name="toAssociateAssessmentReportEvidenceFolder")
    def to_associate_assessment_report_evidence_folder(self) -> "Auditmanager":
        '''(experimental) Grants permission to associate an evidence folder with an assessment report in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_AssociateAssessmentReportEvidenceFolder.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toAssociateAssessmentReportEvidenceFolder", []))

    @jsii.member(jsii_name="toBatchAssociateAssessmentReportEvidence")
    def to_batch_associate_assessment_report_evidence(self) -> "Auditmanager":
        '''(experimental) Grants permission to associate a list of evidence to an assessment report in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_BatchAssociateAssessmentReportEvidence.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toBatchAssociateAssessmentReportEvidence", []))

    @jsii.member(jsii_name="toBatchCreateDelegationByAssessment")
    def to_batch_create_delegation_by_assessment(self) -> "Auditmanager":
        '''(experimental) Grants permission to create delegations for an assessment in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_BatchCreateDelegationByAssessment.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toBatchCreateDelegationByAssessment", []))

    @jsii.member(jsii_name="toBatchDeleteDelegationByAssessment")
    def to_batch_delete_delegation_by_assessment(self) -> "Auditmanager":
        '''(experimental) Grants permission to delete delegations for an assessment in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_BatchDeleteDelegationByAssessment.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toBatchDeleteDelegationByAssessment", []))

    @jsii.member(jsii_name="toBatchDisassociateAssessmentReportEvidence")
    def to_batch_disassociate_assessment_report_evidence(self) -> "Auditmanager":
        '''(experimental) Grants permission to disassociate a list of evidence from an assessment report in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_BatchDisassociateAssessmentReportEvidence.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toBatchDisassociateAssessmentReportEvidence", []))

    @jsii.member(jsii_name="toBatchImportEvidenceToAssessmentControl")
    def to_batch_import_evidence_to_assessment_control(self) -> "Auditmanager":
        '''(experimental) Grants permission to import a list of evidence to an assessment control in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_BatchImportEvidenceToAssessmentControl.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toBatchImportEvidenceToAssessmentControl", []))

    @jsii.member(jsii_name="toCreateAssessment")
    def to_create_assessment(self) -> "Auditmanager":
        '''(experimental) Grants permission to create an assessment to be used with AWS Audit Manager.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_CreateAssessment.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toCreateAssessment", []))

    @jsii.member(jsii_name="toCreateAssessmentFramework")
    def to_create_assessment_framework(self) -> "Auditmanager":
        '''(experimental) Grants permission to create a framework for use in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_CreateAssessmentFramework.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toCreateAssessmentFramework", []))

    @jsii.member(jsii_name="toCreateAssessmentReport")
    def to_create_assessment_report(self) -> "Auditmanager":
        '''(experimental) Grants permission to create an assessment report in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_CreateAssessmentReport.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toCreateAssessmentReport", []))

    @jsii.member(jsii_name="toCreateControl")
    def to_create_control(self) -> "Auditmanager":
        '''(experimental) Grants permission to create a control to be used in AWS Audit Manager.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_CreateControl.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toCreateControl", []))

    @jsii.member(jsii_name="toDeleteAssessment")
    def to_delete_assessment(self) -> "Auditmanager":
        '''(experimental) Grants permission to delete an assessment in AWS Audit Manager.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_DeleteAssessment.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toDeleteAssessment", []))

    @jsii.member(jsii_name="toDeleteAssessmentFramework")
    def to_delete_assessment_framework(self) -> "Auditmanager":
        '''(experimental) Grants permission to delete an assessment framework in AWS Audit Manager.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_DeleteAssessmentFramework.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toDeleteAssessmentFramework", []))

    @jsii.member(jsii_name="toDeleteAssessmentReport")
    def to_delete_assessment_report(self) -> "Auditmanager":
        '''(experimental) Grants permission to delete an assessment report in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_DeleteAssessmentReport.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toDeleteAssessmentReport", []))

    @jsii.member(jsii_name="toDeleteControl")
    def to_delete_control(self) -> "Auditmanager":
        '''(experimental) Grants permission to delete a control in AWS Audit Manager.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_DeleteControl.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toDeleteControl", []))

    @jsii.member(jsii_name="toDeregisterAccount")
    def to_deregister_account(self) -> "Auditmanager":
        '''(experimental) Grants permission to deregister an account in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_ DeregisterAccount.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toDeregisterAccount", []))

    @jsii.member(jsii_name="toDeregisterOrganizationAdminAccount")
    def to_deregister_organization_admin_account(self) -> "Auditmanager":
        '''(experimental) Grants permission to deregister the delegated administrator account for AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_DeregisterOrganizationAdminAccount.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toDeregisterOrganizationAdminAccount", []))

    @jsii.member(jsii_name="toDisassociateAssessmentReportEvidenceFolder")
    def to_disassociate_assessment_report_evidence_folder(self) -> "Auditmanager":
        '''(experimental) Grants permission to disassociate an evidence folder from an assessment report in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_DisassociateAssessmentReportEvidenceFolder.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toDisassociateAssessmentReportEvidenceFolder", []))

    @jsii.member(jsii_name="toGetAccountStatus")
    def to_get_account_status(self) -> "Auditmanager":
        '''(experimental) Grants permission to get the status of an account in AWS Audit Manager.

        Access Level: Read

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_GetAccountStatus.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toGetAccountStatus", []))

    @jsii.member(jsii_name="toGetAssessment")
    def to_get_assessment(self) -> "Auditmanager":
        '''(experimental) Grants permission to get an assessment created in AWS Audit Manager.

        Access Level: Read

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_GetAssessment.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toGetAssessment", []))

    @jsii.member(jsii_name="toGetAssessmentFramework")
    def to_get_assessment_framework(self) -> "Auditmanager":
        '''(experimental) Grants permission to get an assessment framework in AWS Audit Manager.

        Access Level: Read

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_GetAssessmentFramework.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toGetAssessmentFramework", []))

    @jsii.member(jsii_name="toGetAssessmentReportUrl")
    def to_get_assessment_report_url(self) -> "Auditmanager":
        '''(experimental) Grants permission to get the URL for an assessment report in AWS Audit Manager.

        Access Level: Read

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_GetAssessmentReportUrl.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toGetAssessmentReportUrl", []))

    @jsii.member(jsii_name="toGetChangeLogs")
    def to_get_change_logs(self) -> "Auditmanager":
        '''(experimental) Grants permission to get changelogs for an assessment in AWS Audit Manager.

        Access Level: Read

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_GetChangeLogs.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toGetChangeLogs", []))

    @jsii.member(jsii_name="toGetControl")
    def to_get_control(self) -> "Auditmanager":
        '''(experimental) Grants permission to get a control in AWS Audit Manager.

        Access Level: Read

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_GetControl.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toGetControl", []))

    @jsii.member(jsii_name="toGetDelegations")
    def to_get_delegations(self) -> "Auditmanager":
        '''(experimental) Grants permission to get all delegations in AWS Audit Manager.

        Access Level: List

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_GetDelegations.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toGetDelegations", []))

    @jsii.member(jsii_name="toGetEvidence")
    def to_get_evidence(self) -> "Auditmanager":
        '''(experimental) Grants permission to get evidence from AWS Audit Manager.

        Access Level: Read

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_GetEvidence.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toGetEvidence", []))

    @jsii.member(jsii_name="toGetEvidenceByEvidenceFolder")
    def to_get_evidence_by_evidence_folder(self) -> "Auditmanager":
        '''(experimental) Grants permission to get all the evidence from an evidence folder in AWS Audit Manager.

        Access Level: Read

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_GetEvidenceByEvidenceFolder.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toGetEvidenceByEvidenceFolder", []))

    @jsii.member(jsii_name="toGetEvidenceFolder")
    def to_get_evidence_folder(self) -> "Auditmanager":
        '''(experimental) Grants permission to get the evidence folder from AWS Audit Manager.

        Access Level: Read

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_GetEvidenceFolder.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toGetEvidenceFolder", []))

    @jsii.member(jsii_name="toGetEvidenceFoldersByAssessment")
    def to_get_evidence_folders_by_assessment(self) -> "Auditmanager":
        '''(experimental) Grants permission to get the evidence folders from an assessment in AWS Audit Manager.

        Access Level: Read

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_GetEvidenceFoldersByAssessment.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toGetEvidenceFoldersByAssessment", []))

    @jsii.member(jsii_name="toGetEvidenceFoldersByAssessmentControl")
    def to_get_evidence_folders_by_assessment_control(self) -> "Auditmanager":
        '''(experimental) Grants permission to get the evidence folders from an assessment control in AWS Audit Manager.

        Access Level: Read

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_GetEvidenceFoldersByAssessmentControl.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toGetEvidenceFoldersByAssessmentControl", []))

    @jsii.member(jsii_name="toGetOrganizationAdminAccount")
    def to_get_organization_admin_account(self) -> "Auditmanager":
        '''(experimental) Grants permission to get the delegated administrator account in AWS Audit Manager.

        Access Level: Read

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_GetOrganizationAdminAccount.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toGetOrganizationAdminAccount", []))

    @jsii.member(jsii_name="toGetServicesInScope")
    def to_get_services_in_scope(self) -> "Auditmanager":
        '''(experimental) Grants permission to get the services in scope for an assessment in AWS Audit Manager.

        Access Level: Read

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_GetServicesInScope.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toGetServicesInScope", []))

    @jsii.member(jsii_name="toGetSettings")
    def to_get_settings(self) -> "Auditmanager":
        '''(experimental) Grants permission to get all settings configured in AWS Audit Manager.

        Access Level: Read

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_GetSettings.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toGetSettings", []))

    @jsii.member(jsii_name="toListAssessmentFrameworks")
    def to_list_assessment_frameworks(self) -> "Auditmanager":
        '''(experimental) Grants permission to list all assessment frameworks in AWS Audit Manager.

        Access Level: List

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_ListAssessmentFrameworks.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toListAssessmentFrameworks", []))

    @jsii.member(jsii_name="toListAssessmentReports")
    def to_list_assessment_reports(self) -> "Auditmanager":
        '''(experimental) Grants permission to list all assessment reports in AWS Audit Manager.

        Access Level: List

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_ListAssessmentReports.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toListAssessmentReports", []))

    @jsii.member(jsii_name="toListAssessments")
    def to_list_assessments(self) -> "Auditmanager":
        '''(experimental) Grants permission to list all assessments in AWS Audit Manager.

        Access Level: List

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_ListAssessments.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toListAssessments", []))

    @jsii.member(jsii_name="toListControls")
    def to_list_controls(self) -> "Auditmanager":
        '''(experimental) Grants permission to list all controls in AWS Audit Manager.

        Access Level: List

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_ListControls.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toListControls", []))

    @jsii.member(jsii_name="toListKeywordsForDataSource")
    def to_list_keywords_for_data_source(self) -> "Auditmanager":
        '''(experimental) Grants permission to list all the data source keywords in AWS Audit Manager.

        Access Level: List

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_ListKeywordsForDataSource.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toListKeywordsForDataSource", []))

    @jsii.member(jsii_name="toListNotifications")
    def to_list_notifications(self) -> "Auditmanager":
        '''(experimental) Grants permission to list all notifications in AWS Audit Manager.

        Access Level: List

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_ListNotifications.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toListNotifications", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Auditmanager":
        '''(experimental) Grants permission to list tags for an AWS Audit Manager resource.

        Access Level: List

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toRegisterAccount")
    def to_register_account(self) -> "Auditmanager":
        '''(experimental) Grants permission to register an account in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_RegisterAccount.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toRegisterAccount", []))

    @jsii.member(jsii_name="toRegisterOrganizationAdminAccount")
    def to_register_organization_admin_account(self) -> "Auditmanager":
        '''(experimental) Grants permission to register an account within the organization as the delegated administrator for AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_RegisterOrganizationAdminAccount.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toRegisterOrganizationAdminAccount", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Auditmanager":
        '''(experimental) Grants permission to tag an AWS Audit Manager resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Auditmanager":
        '''(experimental) Grants permission to untag an AWS Audit Manager resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAssessment")
    def to_update_assessment(self) -> "Auditmanager":
        '''(experimental) Grants permission to update an assessment in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_UpdateAssessment.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toUpdateAssessment", []))

    @jsii.member(jsii_name="toUpdateAssessmentControl")
    def to_update_assessment_control(self) -> "Auditmanager":
        '''(experimental) Grants permission to update an assessment control in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_UpdateAssessmentControl.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toUpdateAssessmentControl", []))

    @jsii.member(jsii_name="toUpdateAssessmentControlSetStatus")
    def to_update_assessment_control_set_status(self) -> "Auditmanager":
        '''(experimental) Grants permission to update the status of an assessment control set in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_UpdateAssessmentControlSetStatus.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toUpdateAssessmentControlSetStatus", []))

    @jsii.member(jsii_name="toUpdateAssessmentFramework")
    def to_update_assessment_framework(self) -> "Auditmanager":
        '''(experimental) Grants permission to update an assessment framework in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_UpdateAssessmentFramework.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toUpdateAssessmentFramework", []))

    @jsii.member(jsii_name="toUpdateAssessmentStatus")
    def to_update_assessment_status(self) -> "Auditmanager":
        '''(experimental) Grants permission to update the status of an assessment in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_UpdateAssessmentStatus.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toUpdateAssessmentStatus", []))

    @jsii.member(jsii_name="toUpdateControl")
    def to_update_control(self) -> "Auditmanager":
        '''(experimental) Grants permission to update a control in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_UpdateControl.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toUpdateControl", []))

    @jsii.member(jsii_name="toUpdateSettings")
    def to_update_settings(self) -> "Auditmanager":
        '''(experimental) Grants permission to update settings in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_UpdateSettings.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toUpdateSettings", []))

    @jsii.member(jsii_name="toValidateAssessmentReportIntegrity")
    def to_validate_assessment_report_integrity(self) -> "Auditmanager":
        '''(experimental) Grants permission to validate the integrity of an assessment report in AWS Audit Manager.

        Access Level: Read

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_ValidateAssessmentReportIntegrity.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toValidateAssessmentReportIntegrity", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Autoscaling(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Autoscaling",
):
    '''(experimental) Statement provider for service `autoscaling <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2autoscaling.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `autoscaling <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2autoscaling.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Autoscaling, self, [sid])

    @jsii.member(jsii_name="ifImageId")
    def if_image_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Autoscaling":
        '''(experimental) The AMI used to create the instance.

        https://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-condition-keys

        Applies to actions:

        - .toCreateLaunchConfiguration()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "ifImageId", [value, operator]))

    @jsii.member(jsii_name="ifInstanceType")
    def if_instance_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Autoscaling":
        '''(experimental) The type of instance, in terms of the hardware resources available.

        https://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-condition-keys

        Applies to actions:

        - .toCreateLaunchConfiguration()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "ifInstanceType", [value, operator]))

    @jsii.member(jsii_name="ifInstanceTypes")
    def if_instance_types(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Autoscaling":
        '''(experimental) The types of instances, in terms of the hardware resources available.

        https://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-condition-keys

        Applies to actions:

        - .toCreateAutoScalingGroup()
        - .toUpdateAutoScalingGroup()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "ifInstanceTypes", [value, operator]))

    @jsii.member(jsii_name="ifLaunchConfigurationName")
    def if_launch_configuration_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Autoscaling":
        '''(experimental) The name of a launch configuration.

        https://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-condition-keys

        Applies to actions:

        - .toCreateAutoScalingGroup()
        - .toUpdateAutoScalingGroup()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "ifLaunchConfigurationName", [value, operator]))

    @jsii.member(jsii_name="ifLaunchTemplateVersionSpecified")
    def if_launch_template_version_specified(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Autoscaling":
        '''(experimental) Filters access by whether users can specify any version of a launch template or only the Latest or Default version.

        https://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-condition-keys

        Applies to actions:

        - .toCreateAutoScalingGroup()
        - .toUpdateAutoScalingGroup()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "ifLaunchTemplateVersionSpecified", [value]))

    @jsii.member(jsii_name="ifLoadBalancerNames")
    def if_load_balancer_names(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Autoscaling":
        '''(experimental) The name of the load balancer.

        https://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-condition-keys

        Applies to actions:

        - .toAttachLoadBalancers()
        - .toCreateAutoScalingGroup()
        - .toDetachLoadBalancers()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "ifLoadBalancerNames", [value, operator]))

    @jsii.member(jsii_name="ifMaxSize")
    def if_max_size(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Autoscaling":
        '''(experimental) The maximum scaling size.

        https://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-condition-keys

        Applies to actions:

        - .toCreateAutoScalingGroup()
        - .toPutScheduledUpdateGroupAction()
        - .toUpdateAutoScalingGroup()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "ifMaxSize", [value, operator]))

    @jsii.member(jsii_name="ifMetadataHttpEndpoint")
    def if_metadata_http_endpoint(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Autoscaling":
        '''(experimental) Filters access by whether the HTTP endpoint is enabled for the instance metadata service.

        https://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-condition-keys

        Applies to actions:

        - .toCreateLaunchConfiguration()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "ifMetadataHttpEndpoint", [value, operator]))

    @jsii.member(jsii_name="ifMetadataHttpPutResponseHopLimit")
    def if_metadata_http_put_response_hop_limit(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Autoscaling":
        '''(experimental) Filters access by the allowed number of hops when calling the instance metadata service.

        https://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-condition-keys

        Applies to actions:

        - .toCreateLaunchConfiguration()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "ifMetadataHttpPutResponseHopLimit", [value, operator]))

    @jsii.member(jsii_name="ifMetadataHttpTokens")
    def if_metadata_http_tokens(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Autoscaling":
        '''(experimental) Filters access by whether tokens are required when calling the instance metadata service (optional or required).

        https://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-condition-keys

        Applies to actions:

        - .toCreateLaunchConfiguration()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "ifMetadataHttpTokens", [value, operator]))

    @jsii.member(jsii_name="ifMinSize")
    def if_min_size(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Autoscaling":
        '''(experimental) The minimum scaling size.

        https://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-condition-keys

        Applies to actions:

        - .toCreateAutoScalingGroup()
        - .toPutScheduledUpdateGroupAction()
        - .toUpdateAutoScalingGroup()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "ifMinSize", [value, operator]))

    @jsii.member(jsii_name="ifResourceTag")
    def if_resource_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Autoscaling":
        '''(experimental) The value of a tag attached to a resource.

        https://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-condition-keys

        Applies to actions:

        - .toAttachInstances()
        - .toAttachLoadBalancerTargetGroups()
        - .toAttachLoadBalancers()
        - .toBatchDeleteScheduledAction()
        - .toBatchPutScheduledUpdateGroupAction()
        - .toCancelInstanceRefresh()
        - .toCompleteLifecycleAction()
        - .toCreateAutoScalingGroup()
        - .toCreateOrUpdateTags()
        - .toDeleteAutoScalingGroup()
        - .toDeleteLifecycleHook()
        - .toDeleteNotificationConfiguration()
        - .toDeletePolicy()
        - .toDeleteScheduledAction()
        - .toDeleteTags()
        - .toDetachInstances()
        - .toDetachLoadBalancerTargetGroups()
        - .toDetachLoadBalancers()
        - .toDisableMetricsCollection()
        - .toEnableMetricsCollection()
        - .toEnterStandby()
        - .toExecutePolicy()
        - .toExitStandby()
        - .toPutLifecycleHook()
        - .toPutNotificationConfiguration()
        - .toPutScalingPolicy()
        - .toPutScheduledUpdateGroupAction()
        - .toRecordLifecycleActionHeartbeat()
        - .toResumeProcesses()
        - .toSetDesiredCapacity()
        - .toSetInstanceHealth()
        - .toSetInstanceProtection()
        - .toStartInstanceRefresh()
        - .toSuspendProcesses()
        - .toTerminateInstanceInAutoScalingGroup()
        - .toUpdateAutoScalingGroup()

        Applies to resource types:

        - autoScalingGroup

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "ifResourceTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifSpotPrice")
    def if_spot_price(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Autoscaling":
        '''(experimental) The spot price associated with an instance.

        https://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-condition-keys

        Applies to actions:

        - .toCreateLaunchConfiguration()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "ifSpotPrice", [value, operator]))

    @jsii.member(jsii_name="ifTargetGroupARNs")
    def if_target_group_ar_ns(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Autoscaling":
        '''(experimental) The ARN of a target group.

        https://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-condition-keys

        Applies to actions:

        - .toAttachLoadBalancerTargetGroups()
        - .toCreateAutoScalingGroup()
        - .toDetachLoadBalancerTargetGroups()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "ifTargetGroupARNs", [value, operator]))

    @jsii.member(jsii_name="ifVPCZoneIdentifiers")
    def if_vpc_zone_identifiers(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Autoscaling":
        '''(experimental) The identifier of a VPC zone.

        https://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-condition-keys

        Applies to actions:

        - .toCreateAutoScalingGroup()
        - .toUpdateAutoScalingGroup()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "ifVPCZoneIdentifiers", [value, operator]))

    @jsii.member(jsii_name="onAutoScalingGroup")
    def on_auto_scaling_group(
        self,
        group_id: builtins.str,
        group_friendly_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Autoscaling":
        '''(experimental) Adds a resource of type autoScalingGroup to the statement.

        https://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-resources

        :param group_id: - Identifier for the groupId.
        :param group_friendly_name: - Identifier for the groupFriendlyName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifResourceTag() - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "onAutoScalingGroup", [group_id, group_friendly_name, account, region, partition]))

    @jsii.member(jsii_name="onLaunchConfiguration")
    def on_launch_configuration(
        self,
        id: builtins.str,
        launch_configuration_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Autoscaling":
        '''(experimental) Adds a resource of type launchConfiguration to the statement.

        https://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-resources

        :param id: - Identifier for the id.
        :param launch_configuration_name: - Identifier for the launchConfigurationName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "onLaunchConfiguration", [id, launch_configuration_name, account, region, partition]))

    @jsii.member(jsii_name="toAttachInstances")
    def to_attach_instances(self) -> "Autoscaling":
        '''(experimental) Attaches one or more EC2 instances to the specified Auto Scaling group.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_AttachInstances.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toAttachInstances", []))

    @jsii.member(jsii_name="toAttachLoadBalancers")
    def to_attach_load_balancers(self) -> "Autoscaling":
        '''(experimental) Attaches one or more load balancers to the specified Auto Scaling group.

        Access Level: Write

        Possible conditions:

        - .ifLoadBalancerNames()

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_AttachLoadBalancers.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toAttachLoadBalancers", []))

    @jsii.member(jsii_name="toAttachLoadBalancerTargetGroups")
    def to_attach_load_balancer_target_groups(self) -> "Autoscaling":
        '''(experimental) Attaches one or more target groups to the specified Auto Scaling group.

        Access Level: Write

        Possible conditions:

        - .ifTargetGroupARNs()

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_AttachLoadBalancerTargetGroups.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toAttachLoadBalancerTargetGroups", []))

    @jsii.member(jsii_name="toBatchDeleteScheduledAction")
    def to_batch_delete_scheduled_action(self) -> "Autoscaling":
        '''(experimental) Deletes the specified scheduled actions.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_BatchDeleteScheduledAction.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toBatchDeleteScheduledAction", []))

    @jsii.member(jsii_name="toBatchPutScheduledUpdateGroupAction")
    def to_batch_put_scheduled_update_group_action(self) -> "Autoscaling":
        '''(experimental) Creates or updates multiple scheduled scaling actions for an Auto Scaling group.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_BatchPutScheduledUpdateGroupAction.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toBatchPutScheduledUpdateGroupAction", []))

    @jsii.member(jsii_name="toCancelInstanceRefresh")
    def to_cancel_instance_refresh(self) -> "Autoscaling":
        '''(experimental) Grants permission to cancel an instance refresh operation in progress.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_CancelInstanceRefresh.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toCancelInstanceRefresh", []))

    @jsii.member(jsii_name="toCompleteLifecycleAction")
    def to_complete_lifecycle_action(self) -> "Autoscaling":
        '''(experimental) Completes the lifecycle action for the specified token or instance with the specified result.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_CompleteLifecycleAction.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toCompleteLifecycleAction", []))

    @jsii.member(jsii_name="toCreateAutoScalingGroup")
    def to_create_auto_scaling_group(self) -> "Autoscaling":
        '''(experimental) Creates an Auto Scaling group with the specified name and attributes.

        Access Level: Tagging

        Possible conditions:

        - .ifInstanceTypes()
        - .ifLaunchConfigurationName()
        - .ifLaunchTemplateVersionSpecified()
        - .ifLoadBalancerNames()
        - .ifMaxSize()
        - .ifMinSize()
        - .ifTargetGroupARNs()
        - .ifVPCZoneIdentifiers()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_CreateAutoScalingGroup.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toCreateAutoScalingGroup", []))

    @jsii.member(jsii_name="toCreateLaunchConfiguration")
    def to_create_launch_configuration(self) -> "Autoscaling":
        '''(experimental) Creates a launch configuration.

        Access Level: Write

        Possible conditions:

        - .ifImageId()
        - .ifInstanceType()
        - .ifSpotPrice()
        - .ifMetadataHttpTokens()
        - .ifMetadataHttpPutResponseHopLimit()
        - .ifMetadataHttpEndpoint()

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_CreateLaunchConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toCreateLaunchConfiguration", []))

    @jsii.member(jsii_name="toCreateOrUpdateTags")
    def to_create_or_update_tags(self) -> "Autoscaling":
        '''(experimental) Creates or updates tags for the specified Auto Scaling group.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_CreateOrUpdateTags.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toCreateOrUpdateTags", []))

    @jsii.member(jsii_name="toDeleteAutoScalingGroup")
    def to_delete_auto_scaling_group(self) -> "Autoscaling":
        '''(experimental) Deletes the specified Auto Scaling group.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DeleteAutoScalingGroup.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDeleteAutoScalingGroup", []))

    @jsii.member(jsii_name="toDeleteLaunchConfiguration")
    def to_delete_launch_configuration(self) -> "Autoscaling":
        '''(experimental) Deletes the specified launch configuration.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DeleteLaunchConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDeleteLaunchConfiguration", []))

    @jsii.member(jsii_name="toDeleteLifecycleHook")
    def to_delete_lifecycle_hook(self) -> "Autoscaling":
        '''(experimental) Deletes the specified lifecycle hook.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DeleteLifecycleHook.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDeleteLifecycleHook", []))

    @jsii.member(jsii_name="toDeleteNotificationConfiguration")
    def to_delete_notification_configuration(self) -> "Autoscaling":
        '''(experimental) Deletes the specified notification.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DeleteNotificationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDeleteNotificationConfiguration", []))

    @jsii.member(jsii_name="toDeletePolicy")
    def to_delete_policy(self) -> "Autoscaling":
        '''(experimental) Deletes the specified Auto Scaling policy.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DeletePolicy.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDeletePolicy", []))

    @jsii.member(jsii_name="toDeleteScheduledAction")
    def to_delete_scheduled_action(self) -> "Autoscaling":
        '''(experimental) Deletes the specified scheduled action.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DeleteScheduledAction.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDeleteScheduledAction", []))

    @jsii.member(jsii_name="toDeleteTags")
    def to_delete_tags(self) -> "Autoscaling":
        '''(experimental) Deletes the specified tags.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DeleteTags.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDeleteTags", []))

    @jsii.member(jsii_name="toDescribeAccountLimits")
    def to_describe_account_limits(self) -> "Autoscaling":
        '''(experimental) Describes the current Auto Scaling resource limits for your AWS account.

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeAccountLimits.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeAccountLimits", []))

    @jsii.member(jsii_name="toDescribeAdjustmentTypes")
    def to_describe_adjustment_types(self) -> "Autoscaling":
        '''(experimental) Describes the policy adjustment types for use with PutScalingPolicy.

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeAdjustmentTypes.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeAdjustmentTypes", []))

    @jsii.member(jsii_name="toDescribeAutoScalingGroups")
    def to_describe_auto_scaling_groups(self) -> "Autoscaling":
        '''(experimental) Describes one or more Auto Scaling groups.

        If a list of names is not provided, the call describes all Auto Scaling groups.

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeAutoScalingGroups.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeAutoScalingGroups", []))

    @jsii.member(jsii_name="toDescribeAutoScalingInstances")
    def to_describe_auto_scaling_instances(self) -> "Autoscaling":
        '''(experimental) Describes one or more Auto Scaling instances. If a list is not provided, the call describes all instances.

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeAutoScalingInstances.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeAutoScalingInstances", []))

    @jsii.member(jsii_name="toDescribeAutoScalingNotificationTypes")
    def to_describe_auto_scaling_notification_types(self) -> "Autoscaling":
        '''(experimental) Describes the notification types that are supported by Auto Scaling.

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeAutoScalingNotificationTypes.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeAutoScalingNotificationTypes", []))

    @jsii.member(jsii_name="toDescribeInstanceRefreshes")
    def to_describe_instance_refreshes(self) -> "Autoscaling":
        '''(experimental) Grants permission to describe one or more instance refreshes for an Auto Scaling group.

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeInstanceRefreshes.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeInstanceRefreshes", []))

    @jsii.member(jsii_name="toDescribeLaunchConfigurations")
    def to_describe_launch_configurations(self) -> "Autoscaling":
        '''(experimental) Describes one or more launch configurations.

        If you omit the list of names, then the call describes all launch configurations.

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeLaunchConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeLaunchConfigurations", []))

    @jsii.member(jsii_name="toDescribeLifecycleHooks")
    def to_describe_lifecycle_hooks(self) -> "Autoscaling":
        '''(experimental) Describes the lifecycle hooks for the specified Auto Scaling group.

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeLifecycleHooks.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeLifecycleHooks", []))

    @jsii.member(jsii_name="toDescribeLifecycleHookTypes")
    def to_describe_lifecycle_hook_types(self) -> "Autoscaling":
        '''(experimental) Describes the available types of lifecycle hooks.

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeLifecycleHookTypes.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeLifecycleHookTypes", []))

    @jsii.member(jsii_name="toDescribeLoadBalancers")
    def to_describe_load_balancers(self) -> "Autoscaling":
        '''(experimental) Describes the load balancers for the specified Auto Scaling group.

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeLoadBalancers.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeLoadBalancers", []))

    @jsii.member(jsii_name="toDescribeLoadBalancerTargetGroups")
    def to_describe_load_balancer_target_groups(self) -> "Autoscaling":
        '''(experimental) Describes the target groups for the specified Auto Scaling group.

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeLoadBalancerTargetGroups.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeLoadBalancerTargetGroups", []))

    @jsii.member(jsii_name="toDescribeMetricCollectionTypes")
    def to_describe_metric_collection_types(self) -> "Autoscaling":
        '''(experimental) Describes the available CloudWatch metrics for Auto Scaling.

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeMetricCollectionTypes.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeMetricCollectionTypes", []))

    @jsii.member(jsii_name="toDescribeNotificationConfigurations")
    def to_describe_notification_configurations(self) -> "Autoscaling":
        '''(experimental) Describes the notification actions associated with the specified Auto Scaling group.

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeNotificationConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeNotificationConfigurations", []))

    @jsii.member(jsii_name="toDescribePolicies")
    def to_describe_policies(self) -> "Autoscaling":
        '''(experimental) Describes the policies for the specified Auto Scaling group.

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribePolicies.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribePolicies", []))

    @jsii.member(jsii_name="toDescribeScalingActivities")
    def to_describe_scaling_activities(self) -> "Autoscaling":
        '''(experimental) Describes one or more scaling activities for the specified Auto Scaling group.

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeScalingActivities.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeScalingActivities", []))

    @jsii.member(jsii_name="toDescribeScalingProcessTypes")
    def to_describe_scaling_process_types(self) -> "Autoscaling":
        '''(experimental) Describes the scaling process types for use with ResumeProcesses and SuspendProcesses.

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeScalingProcessTypes.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeScalingProcessTypes", []))

    @jsii.member(jsii_name="toDescribeScheduledActions")
    def to_describe_scheduled_actions(self) -> "Autoscaling":
        '''(experimental) Describes the actions scheduled for your Auto Scaling group that haven't run.

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeScheduledActions.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeScheduledActions", []))

    @jsii.member(jsii_name="toDescribeTags")
    def to_describe_tags(self) -> "Autoscaling":
        '''(experimental) Describes the specified tags.

        Access Level: Read

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeTags.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeTags", []))

    @jsii.member(jsii_name="toDescribeTerminationPolicyTypes")
    def to_describe_termination_policy_types(self) -> "Autoscaling":
        '''(experimental) Describes the termination policies supported by Auto Scaling.

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeTerminationPolicyTypes.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeTerminationPolicyTypes", []))

    @jsii.member(jsii_name="toDetachInstances")
    def to_detach_instances(self) -> "Autoscaling":
        '''(experimental) Removes one or more instances from the specified Auto Scaling group.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DetachInstances.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDetachInstances", []))

    @jsii.member(jsii_name="toDetachLoadBalancers")
    def to_detach_load_balancers(self) -> "Autoscaling":
        '''(experimental) Removes one or more load balancers from the specified Auto Scaling group.

        Access Level: Write

        Possible conditions:

        - .ifLoadBalancerNames()

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DetachLoadBalancers.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDetachLoadBalancers", []))

    @jsii.member(jsii_name="toDetachLoadBalancerTargetGroups")
    def to_detach_load_balancer_target_groups(self) -> "Autoscaling":
        '''(experimental) Detaches one or more target groups from the specified Auto Scaling group.

        Access Level: Write

        Possible conditions:

        - .ifTargetGroupARNs()

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DetachLoadBalancerTargetGroups.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDetachLoadBalancerTargetGroups", []))

    @jsii.member(jsii_name="toDisableMetricsCollection")
    def to_disable_metrics_collection(self) -> "Autoscaling":
        '''(experimental) Disables monitoring of the specified metrics for the specified Auto Scaling group.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DisableMetricsCollection.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDisableMetricsCollection", []))

    @jsii.member(jsii_name="toEnableMetricsCollection")
    def to_enable_metrics_collection(self) -> "Autoscaling":
        '''(experimental) Enables monitoring of the specified metrics for the specified Auto Scaling group.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_EnableMetricsCollection.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toEnableMetricsCollection", []))

    @jsii.member(jsii_name="toEnterStandby")
    def to_enter_standby(self) -> "Autoscaling":
        '''(experimental) Moves the specified instances into Standby mode.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_EnterStandby.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toEnterStandby", []))

    @jsii.member(jsii_name="toExecutePolicy")
    def to_execute_policy(self) -> "Autoscaling":
        '''(experimental) Executes the specified policy.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_ExecutePolicy.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toExecutePolicy", []))

    @jsii.member(jsii_name="toExitStandby")
    def to_exit_standby(self) -> "Autoscaling":
        '''(experimental) Moves the specified instances out of Standby mode.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_ExitStandby.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toExitStandby", []))

    @jsii.member(jsii_name="toPutLifecycleHook")
    def to_put_lifecycle_hook(self) -> "Autoscaling":
        '''(experimental) Creates or updates a lifecycle hook for the specified Auto Scaling Group.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_PutLifecycleHook.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toPutLifecycleHook", []))

    @jsii.member(jsii_name="toPutNotificationConfiguration")
    def to_put_notification_configuration(self) -> "Autoscaling":
        '''(experimental) Configures an Auto Scaling group to send notifications when specified events take place.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_PutNotificationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toPutNotificationConfiguration", []))

    @jsii.member(jsii_name="toPutScalingPolicy")
    def to_put_scaling_policy(self) -> "Autoscaling":
        '''(experimental) Creates or updates a policy for an Auto Scaling group.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_PutScalingPolicy.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toPutScalingPolicy", []))

    @jsii.member(jsii_name="toPutScheduledUpdateGroupAction")
    def to_put_scheduled_update_group_action(self) -> "Autoscaling":
        '''(experimental) Creates or updates a scheduled scaling action for an Auto Scaling group.

        Access Level: Write

        Possible conditions:

        - .ifMaxSize()
        - .ifMinSize()

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_PutScheduledUpdateGroupAction.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toPutScheduledUpdateGroupAction", []))

    @jsii.member(jsii_name="toRecordLifecycleActionHeartbeat")
    def to_record_lifecycle_action_heartbeat(self) -> "Autoscaling":
        '''(experimental) Records a heartbeat for the lifecycle action associated with the specified token or instance.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_RecordLifecycleActionHeartbeat.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toRecordLifecycleActionHeartbeat", []))

    @jsii.member(jsii_name="toResumeProcesses")
    def to_resume_processes(self) -> "Autoscaling":
        '''(experimental) Resumes the specified suspended Auto Scaling processes, or all suspended process, for the specified Auto Scaling group.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_ResumeProcesses.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toResumeProcesses", []))

    @jsii.member(jsii_name="toSetDesiredCapacity")
    def to_set_desired_capacity(self) -> "Autoscaling":
        '''(experimental) Sets the size of the specified Auto Scaling group.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_SetDesiredCapacity.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toSetDesiredCapacity", []))

    @jsii.member(jsii_name="toSetInstanceHealth")
    def to_set_instance_health(self) -> "Autoscaling":
        '''(experimental) Sets the health status of the specified instance.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_SetInstanceHealth.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toSetInstanceHealth", []))

    @jsii.member(jsii_name="toSetInstanceProtection")
    def to_set_instance_protection(self) -> "Autoscaling":
        '''(experimental) Updates the instance protection settings of the specified instances.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_SetInstanceProtection.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toSetInstanceProtection", []))

    @jsii.member(jsii_name="toStartInstanceRefresh")
    def to_start_instance_refresh(self) -> "Autoscaling":
        '''(experimental) Grants permission to start a new instance refresh operation.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_StartInstanceRefresh.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toStartInstanceRefresh", []))

    @jsii.member(jsii_name="toSuspendProcesses")
    def to_suspend_processes(self) -> "Autoscaling":
        '''(experimental) Suspends the specified Auto Scaling processes, or all processes, for the specified Auto Scaling group.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_SuspendProcesses.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toSuspendProcesses", []))

    @jsii.member(jsii_name="toTerminateInstanceInAutoScalingGroup")
    def to_terminate_instance_in_auto_scaling_group(self) -> "Autoscaling":
        '''(experimental) Terminates the specified instance and optionally adjusts the desired group size.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_TerminateInstanceInAutoScalingGroup.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toTerminateInstanceInAutoScalingGroup", []))

    @jsii.member(jsii_name="toUpdateAutoScalingGroup")
    def to_update_auto_scaling_group(self) -> "Autoscaling":
        '''(experimental) Updates the configuration for the specified Auto Scaling group.

        Access Level: Write

        Possible conditions:

        - .ifInstanceTypes()
        - .ifLaunchConfigurationName()
        - .ifLaunchTemplateVersionSpecified()
        - .ifMaxSize()
        - .ifMinSize()
        - .ifVPCZoneIdentifiers()

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_UpdateAutoScalingGroup.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toUpdateAutoScalingGroup", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class AutoscalingPlans(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.AutoscalingPlans",
):
    '''(experimental) Statement provider for service `autoscaling-plans <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsautoscaling.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `autoscaling-plans <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsautoscaling.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(AutoscalingPlans, self, [sid])

    @jsii.member(jsii_name="toCreateScalingPlan")
    def to_create_scaling_plan(self) -> "AutoscalingPlans":
        '''(experimental) Creates a scaling plan.

        Access Level: Write

        https://docs.aws.amazon.com/autoscaling/plans/APIReference/API_CreateScalingPlan.html

        :stability: experimental
        '''
        return typing.cast("AutoscalingPlans", jsii.invoke(self, "toCreateScalingPlan", []))

    @jsii.member(jsii_name="toDeleteScalingPlan")
    def to_delete_scaling_plan(self) -> "AutoscalingPlans":
        '''(experimental) Deletes the specified scaling plan.

        Access Level: Write

        https://docs.aws.amazon.com/autoscaling/plans/APIReference/API_DeleteScalingPlan.html

        :stability: experimental
        '''
        return typing.cast("AutoscalingPlans", jsii.invoke(self, "toDeleteScalingPlan", []))

    @jsii.member(jsii_name="toDescribeScalingPlanResources")
    def to_describe_scaling_plan_resources(self) -> "AutoscalingPlans":
        '''(experimental) Describes the scalable resources in the specified scaling plan.

        Access Level: Read

        https://docs.aws.amazon.com/autoscaling/plans/APIReference/API_DescribeScalingPlanResources.html

        :stability: experimental
        '''
        return typing.cast("AutoscalingPlans", jsii.invoke(self, "toDescribeScalingPlanResources", []))

    @jsii.member(jsii_name="toDescribeScalingPlans")
    def to_describe_scaling_plans(self) -> "AutoscalingPlans":
        '''(experimental) Describes the specified scaling plans or all of your scaling plans.

        Access Level: Read

        https://docs.aws.amazon.com/autoscaling/plans/APIReference/API_DescribeScalingPlans.html

        :stability: experimental
        '''
        return typing.cast("AutoscalingPlans", jsii.invoke(self, "toDescribeScalingPlans", []))

    @jsii.member(jsii_name="toGetScalingPlanResourceForecastData")
    def to_get_scaling_plan_resource_forecast_data(self) -> "AutoscalingPlans":
        '''(experimental) Retrieves the forecast data for a scalable resource.

        Access Level: Read

        https://docs.aws.amazon.com/autoscaling/plans/APIReference/API_GetScalingPlanResourceForecastData.html

        :stability: experimental
        '''
        return typing.cast("AutoscalingPlans", jsii.invoke(self, "toGetScalingPlanResourceForecastData", []))

    @jsii.member(jsii_name="toUpdateScalingPlan")
    def to_update_scaling_plan(self) -> "AutoscalingPlans":
        '''(experimental) Updates a scaling plan.

        Access Level: Write

        https://docs.aws.amazon.com/autoscaling/plans/APIReference/API_UpdateScalingPlan.html

        :stability: experimental
        '''
        return typing.cast("AutoscalingPlans", jsii.invoke(self, "toUpdateScalingPlan", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class AwsMarketplace(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.AwsMarketplace",
):
    '''(experimental) Statement provider for service `aws-marketplace <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplace.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `aws-marketplace <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplace.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(AwsMarketplace, self, [sid])

    @jsii.member(jsii_name="ifAgreementType")
    def if_agreement_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "AwsMarketplace":
        '''(experimental) Enables you to control access based on the type of the agreement.

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("AwsMarketplace", jsii.invoke(self, "ifAgreementType", [value, operator]))

    @jsii.member(jsii_name="ifPartyType")
    def if_party_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "AwsMarketplace":
        '''(experimental) Enables you to control access based on the party type of the agreement.

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("AwsMarketplace", jsii.invoke(self, "ifPartyType", [value, operator]))

    @jsii.member(jsii_name="toAcceptAgreementApprovalRequest")
    def to_accept_agreement_approval_request(self) -> "AwsMarketplace":
        '''(experimental) Allows users to approve an incoming subscription request (for providers who provide products that require subscription verification).

        Access Level: Write

        https://docs.aws.amazon.com/marketplace/latest/controlling-access/ControllingAccessToAWSMarketplaceSubscriptions.html#SummaryOfAWSMarketplaceSubscriptionsPermissions

        :stability: experimental
        '''
        return typing.cast("AwsMarketplace", jsii.invoke(self, "toAcceptAgreementApprovalRequest", []))

    @jsii.member(jsii_name="toCancelAgreementRequest")
    def to_cancel_agreement_request(self) -> "AwsMarketplace":
        '''(experimental) Allows users to cancel pending subscription requests for products that require subscription verification.

        Access Level: Write

        https://docs.aws.amazon.com/marketplace/latest/controlling-access/ControllingAccessToAWSMarketplaceSubscriptions.html#SummaryOfAWSMarketplaceSubscriptionsPermissions

        :stability: experimental
        '''
        return typing.cast("AwsMarketplace", jsii.invoke(self, "toCancelAgreementRequest", []))

    @jsii.member(jsii_name="toDescribeAgreement")
    def to_describe_agreement(self) -> "AwsMarketplace":
        '''(experimental) Returns metadata about the agreement.

        Access Level: Read

        https://docs.aws.amazon.com/marketplace/latest/controlling-access/ControllingAccessToAWSMarketplaceSubscriptions.html#SummaryOfAWSMarketplaceSubscriptionsPermissions

        :stability: experimental
        '''
        return typing.cast("AwsMarketplace", jsii.invoke(self, "toDescribeAgreement", []))

    @jsii.member(jsii_name="toGetAgreementApprovalRequest")
    def to_get_agreement_approval_request(self) -> "AwsMarketplace":
        '''(experimental) Allows users to view the details of their incoming subscription requests (for providers who provide products that require subscription verification).

        Access Level: Read

        https://docs.aws.amazon.com/marketplace/latest/controlling-access/ControllingAccessToAWSMarketplaceSubscriptions.html#SummaryOfAWSMarketplaceSubscriptionsPermissions

        :stability: experimental
        '''
        return typing.cast("AwsMarketplace", jsii.invoke(self, "toGetAgreementApprovalRequest", []))

    @jsii.member(jsii_name="toGetAgreementRequest")
    def to_get_agreement_request(self) -> "AwsMarketplace":
        '''(experimental) Allows users to view the details of their subscription requests for data products that require subscription verification.

        Access Level: Read

        https://docs.aws.amazon.com/marketplace/latest/controlling-access/ControllingAccessToAWSMarketplaceSubscriptions.html#SummaryOfAWSMarketplaceSubscriptionsPermissions

        :stability: experimental
        '''
        return typing.cast("AwsMarketplace", jsii.invoke(self, "toGetAgreementRequest", []))

    @jsii.member(jsii_name="toGetAgreementTerms")
    def to_get_agreement_terms(self) -> "AwsMarketplace":
        '''(experimental) Returns a list of terms for an agreement.

        Access Level: List

        https://docs.aws.amazon.com/marketplace/latest/controlling-access/ControllingAccessToAWSMarketplaceSubscriptions.html#SummaryOfAWSMarketplaceSubscriptionsPermissions

        :stability: experimental
        '''
        return typing.cast("AwsMarketplace", jsii.invoke(self, "toGetAgreementTerms", []))

    @jsii.member(jsii_name="toListAgreementApprovalRequests")
    def to_list_agreement_approval_requests(self) -> "AwsMarketplace":
        '''(experimental) Allows users to list their incoming subscription requests (for providers who provide products that require subscription verification).

        Access Level: List

        https://docs.aws.amazon.com/marketplace/latest/controlling-access/ControllingAccessToAWSMarketplaceSubscriptions.html#SummaryOfAWSMarketplaceSubscriptionsPermissions

        :stability: experimental
        '''
        return typing.cast("AwsMarketplace", jsii.invoke(self, "toListAgreementApprovalRequests", []))

    @jsii.member(jsii_name="toListAgreementRequests")
    def to_list_agreement_requests(self) -> "AwsMarketplace":
        '''(experimental) Allows users to list their subscription requests for products that require subscription verification.

        Access Level: List

        https://docs.aws.amazon.com/marketplace/latest/controlling-access/ControllingAccessToAWSMarketplaceSubscriptions.html#SummaryOfAWSMarketplaceSubscriptionsPermissions

        :stability: experimental
        '''
        return typing.cast("AwsMarketplace", jsii.invoke(self, "toListAgreementRequests", []))

    @jsii.member(jsii_name="toRejectAgreementApprovalRequest")
    def to_reject_agreement_approval_request(self) -> "AwsMarketplace":
        '''(experimental) Allows users to decline an incoming subscription requests (for providers who provide products that require subscription verification).

        Access Level: Write

        https://docs.aws.amazon.com/marketplace/latest/controlling-access/ControllingAccessToAWSMarketplaceSubscriptions.html#SummaryOfAWSMarketplaceSubscriptionsPermissions

        :stability: experimental
        '''
        return typing.cast("AwsMarketplace", jsii.invoke(self, "toRejectAgreementApprovalRequest", []))

    @jsii.member(jsii_name="toSearchAgreements")
    def to_search_agreements(self) -> "AwsMarketplace":
        '''(experimental) Allows users to search their agreements.

        Access Level: List

        https://docs.aws.amazon.com/marketplace/latest/controlling-access/ControllingAccessToAWSMarketplaceSubscriptions.html#SummaryOfAWSMarketplaceSubscriptionsPermissions

        :stability: experimental
        '''
        return typing.cast("AwsMarketplace", jsii.invoke(self, "toSearchAgreements", []))

    @jsii.member(jsii_name="toSubscribe")
    def to_subscribe(self) -> "AwsMarketplace":
        '''(experimental) Allows users to subscribe to AWS Marketplace products.

        Includes the ability to send a subscription request for products that require subscription verification. Includes the ability to enable auto-renewal for an existing subscription.

        Access Level: Write

        https://docs.aws.amazon.com/marketplace/latest/controlling-access/ControllingAccessToAWSMarketplaceSubscriptions.html#SummaryOfAWSMarketplaceSubscriptionsPermissions

        :stability: experimental
        '''
        return typing.cast("AwsMarketplace", jsii.invoke(self, "toSubscribe", []))

    @jsii.member(jsii_name="toUnsubscribe")
    def to_unsubscribe(self) -> "AwsMarketplace":
        '''(experimental) Allows users to remove subscriptions to AWS Marketplace products. Includes the ability to disable auto-renewal for an existing subscription.

        Access Level: Write

        https://docs.aws.amazon.com/marketplace/latest/controlling-access/ControllingAccessToAWSMarketplaceSubscriptions.html#SummaryOfAWSMarketplaceSubscriptionsPermissions

        :stability: experimental
        '''
        return typing.cast("AwsMarketplace", jsii.invoke(self, "toUnsubscribe", []))

    @jsii.member(jsii_name="toUpdateAgreementApprovalRequest")
    def to_update_agreement_approval_request(self) -> "AwsMarketplace":
        '''(experimental) Allows users to make changes to an incoming subscription request, including the ability to delete the prospective subscriber's information (for providers who provide products that require subscription verification).

        Access Level: Write

        https://docs.aws.amazon.com/marketplace/latest/controlling-access/ControllingAccessToAWSMarketplaceSubscriptions.html#SummaryOfAWSMarketplaceSubscriptionsPermissions

        :stability: experimental
        '''
        return typing.cast("AwsMarketplace", jsii.invoke(self, "toUpdateAgreementApprovalRequest", []))

    @jsii.member(jsii_name="toViewSubscriptions")
    def to_view_subscriptions(self) -> "AwsMarketplace":
        '''(experimental) Allows users to see their account's subscriptions.

        Access Level: List

        https://docs.aws.amazon.com/marketplace/latest/controlling-access/ControllingAccessToAWSMarketplaceSubscriptions.html#SummaryOfAWSMarketplaceSubscriptionsPermissions

        :stability: experimental
        '''
        return typing.cast("AwsMarketplace", jsii.invoke(self, "toViewSubscriptions", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class AwsMarketplaceCatalog(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.AwsMarketplaceCatalog",
):
    '''(experimental) Statement provider for service `aws-marketplace-catalog <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplacecatalog.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `aws-marketplace-catalog <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplacecatalog.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(AwsMarketplaceCatalog, self, [sid])

    @jsii.member(jsii_name="ifCatalogChangeType")
    def if_catalog_change_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "AwsMarketplaceCatalog":
        '''(experimental) Enables you to verify change type in the StartChangeSet request.

        https://docs.aws.amazon.com/marketplace-catalog/latest/api-reference/api-access-control.html

        Applies to actions:

        - .toStartChangeSet()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceCatalog", jsii.invoke(self, "ifCatalogChangeType", [value, operator]))

    @jsii.member(jsii_name="onChangeSet")
    def on_change_set(
        self,
        catalog: builtins.str,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "AwsMarketplaceCatalog":
        '''(experimental) Adds a resource of type ChangeSet to the statement.

        https://docs.aws.amazon.com/marketplace-catalog/latest/api-reference/API_StartChangeSet.html#API_StartChangeSet_ResponseSyntax

        :param catalog: - Identifier for the catalog.
        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceCatalog", jsii.invoke(self, "onChangeSet", [catalog, resource_id, account, region, partition]))

    @jsii.member(jsii_name="onEntity")
    def on_entity(
        self,
        catalog: builtins.str,
        entity_type: builtins.str,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "AwsMarketplaceCatalog":
        '''(experimental) Adds a resource of type Entity to the statement.

        https://docs.aws.amazon.com/marketplace-catalog/latest/api-reference/API_DescribeEntity.html#API_DescribeEntity_ResponseSyntax

        :param catalog: - Identifier for the catalog.
        :param entity_type: - Identifier for the entityType.
        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceCatalog", jsii.invoke(self, "onEntity", [catalog, entity_type, resource_id, account, region, partition]))

    @jsii.member(jsii_name="toCancelChangeSet")
    def to_cancel_change_set(self) -> "AwsMarketplaceCatalog":
        '''(experimental) Cancels a running change set.

        Access Level: Write

        https://docs.aws.amazon.com/marketplace-catalog/latest/api-reference/API_Operations.htmlAPI_CancelChangeSet.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceCatalog", jsii.invoke(self, "toCancelChangeSet", []))

    @jsii.member(jsii_name="toCompleteTask")
    def to_complete_task(self) -> "AwsMarketplaceCatalog":
        '''(experimental) Complete an existing task and submit the content to the associated change.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceCatalog", jsii.invoke(self, "toCompleteTask", []))

    @jsii.member(jsii_name="toDescribeChangeSet")
    def to_describe_change_set(self) -> "AwsMarketplaceCatalog":
        '''(experimental) Returns the details of an existing change set.

        Access Level: Read

        https://docs.aws.amazon.com/marketplace-catalog/latest/api-reference/API_Operations.htmlAPI_DescribeChangeSet.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceCatalog", jsii.invoke(self, "toDescribeChangeSet", []))

    @jsii.member(jsii_name="toDescribeEntity")
    def to_describe_entity(self) -> "AwsMarketplaceCatalog":
        '''(experimental) Returns the details of an existing entity.

        Access Level: Read

        https://docs.aws.amazon.com/marketplace-catalog/latest/api-reference/API_Operations.htmlAPI_DescribeEntity.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceCatalog", jsii.invoke(self, "toDescribeEntity", []))

    @jsii.member(jsii_name="toDescribeTask")
    def to_describe_task(self) -> "AwsMarketplaceCatalog":
        '''(experimental) Returns the details of an existing task.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceCatalog", jsii.invoke(self, "toDescribeTask", []))

    @jsii.member(jsii_name="toListChangeSets")
    def to_list_change_sets(self) -> "AwsMarketplaceCatalog":
        '''(experimental) Lists existing change sets.

        Access Level: Read

        https://docs.aws.amazon.com/marketplace-catalog/latest/api-reference/API_Operations.htmlAPI_ListChangeSets.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceCatalog", jsii.invoke(self, "toListChangeSets", []))

    @jsii.member(jsii_name="toListEntities")
    def to_list_entities(self) -> "AwsMarketplaceCatalog":
        '''(experimental) Lists existing entities.

        Access Level: Read

        https://docs.aws.amazon.com/marketplace-catalog/latest/api-reference/API_Operations.htmlAPI_ListEntities.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceCatalog", jsii.invoke(self, "toListEntities", []))

    @jsii.member(jsii_name="toListTasks")
    def to_list_tasks(self) -> "AwsMarketplaceCatalog":
        '''(experimental) Lists existing tasks.

        Access Level: List

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceCatalog", jsii.invoke(self, "toListTasks", []))

    @jsii.member(jsii_name="toStartChangeSet")
    def to_start_change_set(self) -> "AwsMarketplaceCatalog":
        '''(experimental) Requests a new change set.

        Access Level: Write

        Possible conditions:

        - .ifCatalogChangeType()

        https://docs.aws.amazon.com/marketplace-catalog/latest/api-reference/API_Operations.htmlAPI_StartChangeSet.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceCatalog", jsii.invoke(self, "toStartChangeSet", []))

    @jsii.member(jsii_name="toUpdateTask")
    def to_update_task(self) -> "AwsMarketplaceCatalog":
        '''(experimental) Update the content of an existing task.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceCatalog", jsii.invoke(self, "toUpdateTask", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class AwsMarketplaceEntitlementService(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.AwsMarketplaceEntitlementService",
):
    '''(experimental) Statement provider for service `aws-marketplace-entitlement-service <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplaceentitlementservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `aws-marketplace-entitlement-service <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplaceentitlementservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(AwsMarketplaceEntitlementService, self, [sid])

    @jsii.member(jsii_name="toGetEntitlements")
    def to_get_entitlements(self) -> "AwsMarketplaceEntitlementService":
        '''(experimental) Retrieves entitlement values for a given product. The results can be filtered based on customer identifier or product dimensions.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceEntitlementService", jsii.invoke(self, "toGetEntitlements", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class AwsMarketplaceImageBuildingService(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.AwsMarketplaceImageBuildingService",
):
    '''(experimental) Statement provider for service `aws-marketplace-image-building-service <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplaceimagebuildingservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `aws-marketplace-image-building-service <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplaceimagebuildingservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(AwsMarketplaceImageBuildingService, self, [sid])

    @jsii.member(jsii_name="toDescribeBuilds")
    def to_describe_builds(self) -> "AwsMarketplaceImageBuildingService":
        '''(experimental) Describes Image Builds identified by a build Id.

        Access Level: Read

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/api-reference.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceImageBuildingService", jsii.invoke(self, "toDescribeBuilds", []))

    @jsii.member(jsii_name="toListBuilds")
    def to_list_builds(self) -> "AwsMarketplaceImageBuildingService":
        '''(experimental) Lists Image Builds.

        Access Level: Read

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/api-reference.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceImageBuildingService", jsii.invoke(self, "toListBuilds", []))

    @jsii.member(jsii_name="toStartBuild")
    def to_start_build(self) -> "AwsMarketplaceImageBuildingService":
        '''(experimental) Starts an Image Build.

        Access Level: Write

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/api-reference.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceImageBuildingService", jsii.invoke(self, "toStartBuild", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class AwsMarketplaceManagement(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.AwsMarketplaceManagement",
):
    '''(experimental) Statement provider for service `aws-marketplace-management <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplacemanagementportal.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `aws-marketplace-management <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplacemanagementportal.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(AwsMarketplaceManagement, self, [sid])

    @jsii.member(jsii_name="toUploadFiles")
    def to_upload_files(self) -> "AwsMarketplaceManagement":
        '''(experimental) Allows access to the File Upload page inside the AWS Marketplace Management Portal.

        Access Level: Write

        https://docs.aws.amazon.com/marketplace/latest/userguide/detailed-management-portal-permissions.html#seller-ammp-permissions

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceManagement", jsii.invoke(self, "toUploadFiles", []))

    @jsii.member(jsii_name="toViewMarketing")
    def to_view_marketing(self) -> "AwsMarketplaceManagement":
        '''(experimental) Allows access to the Marketing page inside the AWS Marketplace Management Portal.

        Access Level: List

        https://docs.aws.amazon.com/marketplace/latest/userguide/detailed-management-portal-permissions.html#seller-ammp-permissions

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceManagement", jsii.invoke(self, "toViewMarketing", []))

    @jsii.member(jsii_name="toViewReports")
    def to_view_reports(self) -> "AwsMarketplaceManagement":
        '''(experimental) Allows access to the Reports page inside the AWS Marketplace Management Portal.

        Access Level: List

        https://docs.aws.amazon.com/marketplace/latest/userguide/detailed-management-portal-permissions.html#seller-ammp-permissions

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceManagement", jsii.invoke(self, "toViewReports", []))

    @jsii.member(jsii_name="toViewSettings")
    def to_view_settings(self) -> "AwsMarketplaceManagement":
        '''(experimental) Allows access to the Settings page inside the AWS Marketplace Management Portal.

        Access Level: List

        https://docs.aws.amazon.com/marketplace/latest/userguide/detailed-management-portal-permissions.html#seller-ammp-permissions

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceManagement", jsii.invoke(self, "toViewSettings", []))

    @jsii.member(jsii_name="toViewSupport")
    def to_view_support(self) -> "AwsMarketplaceManagement":
        '''(experimental) Allows access to the Customer Support Eligibility page inside the AWS Marketplace Management Portal.

        Access Level: List

        https://docs.aws.amazon.com/marketplace/latest/userguide/detailed-management-portal-permissions.html#seller-ammp-permissions

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceManagement", jsii.invoke(self, "toViewSupport", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class AwsMarketplaceMeteringService(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.AwsMarketplaceMeteringService",
):
    '''(experimental) Statement provider for service `aws-marketplace-metering-service <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplacemeteringservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `aws-marketplace-metering-service <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplacemeteringservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(AwsMarketplaceMeteringService, self, [sid])

    @jsii.member(jsii_name="toBatchMeterUsage")
    def to_batch_meter_usage(self) -> "AwsMarketplaceMeteringService":
        '''(experimental) Called from a SaaS application listed on the AWS Marketplace to post metering records for a set of customers.

        Access Level: Write

        https://docs.aws.amazon.com/marketplacemetering/latest/APIReference/API_BatchMeterUsage.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceMeteringService", jsii.invoke(self, "toBatchMeterUsage", []))

    @jsii.member(jsii_name="toMeterUsage")
    def to_meter_usage(self) -> "AwsMarketplaceMeteringService":
        '''(experimental) Emits metering records.

        Access Level: Write

        https://docs.aws.amazon.com/marketplacemetering/latest/APIReference/API_MeterUsage.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceMeteringService", jsii.invoke(self, "toMeterUsage", []))

    @jsii.member(jsii_name="toRegisterUsage")
    def to_register_usage(self) -> "AwsMarketplaceMeteringService":
        '''(experimental) Allows you to verify that the customer running your paid software is subscribed to your product on AWS Marketplace, enabling you to guard against unauthorized use.

        Meters software use per ECS task, per hour, with usage prorated to the second.

        Access Level: Write

        https://docs.aws.amazon.com/marketplacemetering/latest/APIReference/API_RegisterUsage.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceMeteringService", jsii.invoke(self, "toRegisterUsage", []))

    @jsii.member(jsii_name="toResolveCustomer")
    def to_resolve_customer(self) -> "AwsMarketplaceMeteringService":
        '''(experimental) Resolves a registration token to obtain a CustomerIdentifier and product code.

        Access Level: Write

        https://docs.aws.amazon.com/marketplacemetering/latest/APIReference/API_ResolveCustomer.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceMeteringService", jsii.invoke(self, "toResolveCustomer", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class AwsMarketplacePrivate(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.AwsMarketplacePrivate",
):
    '''(experimental) Statement provider for service `aws-marketplace-private <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsprivatemarketplace.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `aws-marketplace-private <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsprivatemarketplace.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(AwsMarketplacePrivate, self, [sid])

    @jsii.member(jsii_name="toAssociateProductsWithPrivateMarketplace")
    def to_associate_products_with_private_marketplace(self) -> "AwsMarketplacePrivate":
        '''(experimental) Adds new approved products to the Private Marketplace.

        Also allows to approve a request for a product to be associated with the Private Marketplace. This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.

        Access Level: Write

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/private-marketplace.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplacePrivate", jsii.invoke(self, "toAssociateProductsWithPrivateMarketplace", []))

    @jsii.member(jsii_name="toCreatePrivateMarketplace")
    def to_create_private_marketplace(self) -> "AwsMarketplacePrivate":
        '''(experimental) Creates a Private Marketplace for the individual account, or for the entire AWS Organization if one exists.

        This action can only be performed by the master account if using an AWS Organization.

        Access Level: Write

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/private-marketplace.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplacePrivate", jsii.invoke(self, "toCreatePrivateMarketplace", []))

    @jsii.member(jsii_name="toCreatePrivateMarketplaceProfile")
    def to_create_private_marketplace_profile(self) -> "AwsMarketplacePrivate":
        '''(experimental) Creates a Private Marketplace Profile that customizes the white label experience on the AWS Marketplace website for the individual account, or for the entire AWS Organization if one exists.

        This action can only be performed by the master account if using an AWS Organization.

        Access Level: Write

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/private-marketplace.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplacePrivate", jsii.invoke(self, "toCreatePrivateMarketplaceProfile", []))

    @jsii.member(jsii_name="toCreatePrivateMarketplaceRequests")
    def to_create_private_marketplace_requests(self) -> "AwsMarketplacePrivate":
        '''(experimental) Creates a new request for a product or products to be associated with the Private Marketplace.

        This action can be performed by any account in an in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.

        Access Level: Write

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/private-marketplace.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplacePrivate", jsii.invoke(self, "toCreatePrivateMarketplaceRequests", []))

    @jsii.member(jsii_name="toDescribePrivateMarketplaceProducts")
    def to_describe_private_marketplace_products(self) -> "AwsMarketplacePrivate":
        '''(experimental) Describes the status of requested products in the Private Marketplace for administrative purposes.

        This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.

        Access Level: List

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/private-marketplace.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplacePrivate", jsii.invoke(self, "toDescribePrivateMarketplaceProducts", []))

    @jsii.member(jsii_name="toDescribePrivateMarketplaceProfile")
    def to_describe_private_marketplace_profile(self) -> "AwsMarketplacePrivate":
        '''(experimental) Describes details about the Private Marketplace Profile for administrative purposes.

        This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.

        Access Level: Read

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/private-marketplace.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplacePrivate", jsii.invoke(self, "toDescribePrivateMarketplaceProfile", []))

    @jsii.member(jsii_name="toDescribePrivateMarketplaceRequests")
    def to_describe_private_marketplace_requests(self) -> "AwsMarketplacePrivate":
        '''(experimental) Describes requests and associated products in the Private Marketplace.

        This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.

        Access Level: List

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/private-marketplace.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplacePrivate", jsii.invoke(self, "toDescribePrivateMarketplaceRequests", []))

    @jsii.member(jsii_name="toDescribePrivateMarketplaceSettings")
    def to_describe_private_marketplace_settings(self) -> "AwsMarketplacePrivate":
        '''(experimental) Describes the Private Marketplace settings.

        This includes setting for enabling requests from end users and preferences for notifications. This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.

        Access Level: Read

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/private-marketplace.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplacePrivate", jsii.invoke(self, "toDescribePrivateMarketplaceSettings", []))

    @jsii.member(jsii_name="toDescribePrivateMarketplaceStatus")
    def to_describe_private_marketplace_status(self) -> "AwsMarketplacePrivate":
        '''(experimental) Describes the status of the Private Marketplace for administrative purposes.

        This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.

        Access Level: Read

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/private-marketplace.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplacePrivate", jsii.invoke(self, "toDescribePrivateMarketplaceStatus", []))

    @jsii.member(jsii_name="toDisassociateProductsFromPrivateMarketplace")
    def to_disassociate_products_from_private_marketplace(
        self,
    ) -> "AwsMarketplacePrivate":
        '''(experimental) Removes approved products from the Private Marketplace.

        Also allows to decline a request for a product to be associated with the Private Marketplace. This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.

        Access Level: Write

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/private-marketplace.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplacePrivate", jsii.invoke(self, "toDisassociateProductsFromPrivateMarketplace", []))

    @jsii.member(jsii_name="toListPrivateMarketplaceProducts")
    def to_list_private_marketplace_products(self) -> "AwsMarketplacePrivate":
        '''(experimental) Queryable list for the products and status of products in the Private Marketplace for administrative purposes.

        This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.

        Access Level: List

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/private-marketplace.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplacePrivate", jsii.invoke(self, "toListPrivateMarketplaceProducts", []))

    @jsii.member(jsii_name="toListPrivateMarketplaceRequests")
    def to_list_private_marketplace_requests(self) -> "AwsMarketplacePrivate":
        '''(experimental) Queryable list for requests and associated products in the Private Marketplace.

        This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.

        Access Level: List

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/private-marketplace.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplacePrivate", jsii.invoke(self, "toListPrivateMarketplaceRequests", []))

    @jsii.member(jsii_name="toStartPrivateMarketplace")
    def to_start_private_marketplace(self) -> "AwsMarketplacePrivate":
        '''(experimental) Starts the Private Marketplace, enabling the customized AWS Marketplace experience, and enabling restrictions on the procurement of products based on what is available in the Private Marketplace.

        This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.

        Access Level: Write

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/private-marketplace.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplacePrivate", jsii.invoke(self, "toStartPrivateMarketplace", []))

    @jsii.member(jsii_name="toStopPrivateMarketplace")
    def to_stop_private_marketplace(self) -> "AwsMarketplacePrivate":
        '''(experimental) Stops the Private Marketplace, disabling the customized AWS Marketplace experience and removing the Private Marketplace procurement restrictions on products.

        This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.

        Access Level: Write

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/private-marketplace.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplacePrivate", jsii.invoke(self, "toStopPrivateMarketplace", []))

    @jsii.member(jsii_name="toUpdatePrivateMarketplaceProfile")
    def to_update_private_marketplace_profile(self) -> "AwsMarketplacePrivate":
        '''(experimental) Updates the Private Marketplace Profile that customizes the white label experience on the AWS Marketplace website for the individual account, or for the entire AWS Organization if one exists.

        This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.

        Access Level: Write

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/private-marketplace.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplacePrivate", jsii.invoke(self, "toUpdatePrivateMarketplaceProfile", []))

    @jsii.member(jsii_name="toUpdatePrivateMarketplaceSettings")
    def to_update_private_marketplace_settings(self) -> "AwsMarketplacePrivate":
        '''(experimental) Updates the Private Marketplace settings.

        This includes setting for enabling requests from end users and preferences for notifications. This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.

        Access Level: Write

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/private-marketplace.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplacePrivate", jsii.invoke(self, "toUpdatePrivateMarketplaceSettings", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class AwsMarketplaceProcurementSystemsIntegration(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.AwsMarketplaceProcurementSystemsIntegration",
):
    '''(experimental) Statement provider for service `aws-marketplace-procurement-systems-integration <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplaceprocurementsystemsintegration.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `aws-marketplace-procurement-systems-integration <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplaceprocurementsystemsintegration.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(AwsMarketplaceProcurementSystemsIntegration, self, [sid])

    @jsii.member(jsii_name="toDescribeProcurementSystemConfiguration")
    def to_describe_procurement_system_configuration(
        self,
    ) -> "AwsMarketplaceProcurementSystemsIntegration":
        '''(experimental) Describes the Procurement System integration configuration (e.g. Coupa) for the individual account, or for the entire AWS Organization if one exists. This action can only be performed by the master account if using an AWS Organization.

        Access Level: Read

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/procurement-systems-integration.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceProcurementSystemsIntegration", jsii.invoke(self, "toDescribeProcurementSystemConfiguration", []))

    @jsii.member(jsii_name="toPutProcurementSystemConfiguration")
    def to_put_procurement_system_configuration(
        self,
    ) -> "AwsMarketplaceProcurementSystemsIntegration":
        '''(experimental) Creates or updates the Procurement System integration configuration (e.g. Coupa) for the individual account, or for the entire AWS Organization if one exists. This action can only be performed by the master account if using an AWS Organization.

        Access Level: Write

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/procurement-systems-integration.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceProcurementSystemsIntegration", jsii.invoke(self, "toPutProcurementSystemConfiguration", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class AwsPortal(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.AwsPortal",
):
    '''(experimental) Statement provider for service `aws-portal <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbilling.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `aws-portal <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbilling.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(AwsPortal, self, [sid])

    @jsii.member(jsii_name="toModifyAccount")
    def to_modify_account(self) -> "AwsPortal":
        '''(experimental) Allow or deny IAM users permission to modify Account Settings.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("AwsPortal", jsii.invoke(self, "toModifyAccount", []))

    @jsii.member(jsii_name="toModifyBilling")
    def to_modify_billing(self) -> "AwsPortal":
        '''(experimental) Allow or deny IAM users permission to modify billing settings.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("AwsPortal", jsii.invoke(self, "toModifyBilling", []))

    @jsii.member(jsii_name="toModifyPaymentMethods")
    def to_modify_payment_methods(self) -> "AwsPortal":
        '''(experimental) Allow or deny IAM users permission to modify payment methods.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("AwsPortal", jsii.invoke(self, "toModifyPaymentMethods", []))

    @jsii.member(jsii_name="toViewAccount")
    def to_view_account(self) -> "AwsPortal":
        '''(experimental) Allow or deny IAM users permission to view account settings.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("AwsPortal", jsii.invoke(self, "toViewAccount", []))

    @jsii.member(jsii_name="toViewBilling")
    def to_view_billing(self) -> "AwsPortal":
        '''(experimental) Allow or deny IAM users permission to view billing pages in the console.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("AwsPortal", jsii.invoke(self, "toViewBilling", []))

    @jsii.member(jsii_name="toViewPaymentMethods")
    def to_view_payment_methods(self) -> "AwsPortal":
        '''(experimental) Allow or deny IAM users permission to view payment methods.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("AwsPortal", jsii.invoke(self, "toViewPaymentMethods", []))

    @jsii.member(jsii_name="toViewUsage")
    def to_view_usage(self) -> "AwsPortal":
        '''(experimental) Allow or deny IAM users permission to view AWS usage reports.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("AwsPortal", jsii.invoke(self, "toViewUsage", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Awsconnector(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Awsconnector",
):
    '''(experimental) Statement provider for service `awsconnector <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsconnectorservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `awsconnector <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsconnectorservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Awsconnector, self, [sid])

    @jsii.member(jsii_name="toGetConnectorHealth")
    def to_get_connector_health(self) -> "Awsconnector":
        '''(experimental) Retrieves all health metrics that were published from the Server Migration Connector.

        Access Level: Read

        https://docs.aws.amazon.com/server-migration-service/latest/userguide/prereqs.html#connector-permissions

        :stability: experimental
        '''
        return typing.cast("Awsconnector", jsii.invoke(self, "toGetConnectorHealth", []))

    @jsii.member(jsii_name="toRegisterConnector")
    def to_register_connector(self) -> "Awsconnector":
        '''(experimental) Registers AWS Connector with AWS Connector Service.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/userguide/prereqs.html#connector-permissions

        :stability: experimental
        '''
        return typing.cast("Awsconnector", jsii.invoke(self, "toRegisterConnector", []))

    @jsii.member(jsii_name="toValidateConnectorId")
    def to_validate_connector_id(self) -> "Awsconnector":
        '''(experimental) Validates Server Migration Connector Id that was registered with AWS Connector Service.

        Access Level: Read

        https://docs.aws.amazon.com/server-migration-service/latest/userguide/prereqs.html#connector-permissions

        :stability: experimental
        '''
        return typing.cast("Awsconnector", jsii.invoke(self, "toValidateConnectorId", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Backup(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Backup"):
    '''(experimental) Statement provider for service `backup <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbackup.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `backup <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbackup.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Backup, self, [sid])

    @jsii.member(jsii_name="ifCopyTargetOrgPaths")
    def if_copy_target_org_paths(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Backup":
        '''(experimental) Filters access by the organization unit.

        https://docs.aws.amazon.com/aws-backup/latest/devguide/access-control.html#amazon-backup-keys

        Applies to actions:

        - .toCopyFromBackupVault()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "ifCopyTargetOrgPaths", [value, operator]))

    @jsii.member(jsii_name="ifCopyTargets")
    def if_copy_targets(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Backup":
        '''(experimental) Filters access by the ARN of an backup vault.

        https://docs.aws.amazon.com/aws-backup/latest/devguide/access-control.html#amazon-backup-keys

        Applies to actions:

        - .toCopyFromBackupVault()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "ifCopyTargets", [value, operator]))

    @jsii.member(jsii_name="onBackupPlan")
    def on_backup_plan(
        self,
        backup_plan_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Backup":
        '''(experimental) Adds a resource of type backupPlan to the statement.

        https://docs.aws.amazon.com/aws-backup/latest/devguide/about-backup-plans.html

        :param backup_plan_id: - Identifier for the backupPlanId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "onBackupPlan", [backup_plan_id, account, region, partition]))

    @jsii.member(jsii_name="onBackupVault")
    def on_backup_vault(
        self,
        backup_vault_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Backup":
        '''(experimental) Adds a resource of type backupVault to the statement.

        https://docs.aws.amazon.com/aws-backup/latest/devguide/vaults.html

        :param backup_vault_name: - Identifier for the backupVaultName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "onBackupVault", [backup_vault_name, account, region, partition]))

    @jsii.member(jsii_name="onRecoveryPoint")
    def on_recovery_point(
        self,
        recovery_point_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Backup":
        '''(experimental) Adds a resource of type recoveryPoint to the statement.

        https://docs.aws.amazon.com/aws-backup/latest/devguide/recovery-points.html

        :param recovery_point_id: - Identifier for the recoveryPointId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "onRecoveryPoint", [recovery_point_id, account, region, partition]))

    @jsii.member(jsii_name="toCopyFromBackupVault")
    def to_copy_from_backup_vault(self) -> "Backup":
        '''(experimental) Grants permission to copy from a backup vault.

        Access Level: Write

        Possible conditions:

        - .ifCopyTargets()
        - .ifCopyTargetOrgPaths()

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_StartCopyJob.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toCopyFromBackupVault", []))

    @jsii.member(jsii_name="toCopyIntoBackupVault")
    def to_copy_into_backup_vault(self) -> "Backup":
        '''(experimental) Grants permission to copy into a backup vault.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_StartCopyJob.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toCopyIntoBackupVault", []))

    @jsii.member(jsii_name="toCreateBackupPlan")
    def to_create_backup_plan(self) -> "Backup":
        '''(experimental) Grants permission to create a new backup plan.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_CreateBackupPlan.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toCreateBackupPlan", []))

    @jsii.member(jsii_name="toCreateBackupSelection")
    def to_create_backup_selection(self) -> "Backup":
        '''(experimental) Grants permission to create a new resource assignment in a backup plan.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_CreateBackupSelection.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toCreateBackupSelection", []))

    @jsii.member(jsii_name="toCreateBackupVault")
    def to_create_backup_vault(self) -> "Backup":
        '''(experimental) Grants permission to create a new backup vault.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_CreateBackupVault.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toCreateBackupVault", []))

    @jsii.member(jsii_name="toDeleteBackupPlan")
    def to_delete_backup_plan(self) -> "Backup":
        '''(experimental) Grants permission to delete a backup plan.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DeleteBackupPlan.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toDeleteBackupPlan", []))

    @jsii.member(jsii_name="toDeleteBackupSelection")
    def to_delete_backup_selection(self) -> "Backup":
        '''(experimental) Grants permission to delete a resource assignment from a backup plan.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DeleteBackupSelection.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toDeleteBackupSelection", []))

    @jsii.member(jsii_name="toDeleteBackupVault")
    def to_delete_backup_vault(self) -> "Backup":
        '''(experimental) Grants permission to delete a backup vault.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DeleteBackupVault.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toDeleteBackupVault", []))

    @jsii.member(jsii_name="toDeleteBackupVaultAccessPolicy")
    def to_delete_backup_vault_access_policy(self) -> "Backup":
        '''(experimental) Grants permission to delete backup vault access policy.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DeleteBackupVaultAccessPolicy.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toDeleteBackupVaultAccessPolicy", []))

    @jsii.member(jsii_name="toDeleteBackupVaultNotifications")
    def to_delete_backup_vault_notifications(self) -> "Backup":
        '''(experimental) Grants permission to remove notifications from backup vault.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DeleteBackupVaultNotifications.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toDeleteBackupVaultNotifications", []))

    @jsii.member(jsii_name="toDeleteRecoveryPoint")
    def to_delete_recovery_point(self) -> "Backup":
        '''(experimental) Grants permission to delete a recovery point from a backup vault.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DeleteRecoveryPoint.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toDeleteRecoveryPoint", []))

    @jsii.member(jsii_name="toDescribeBackupJob")
    def to_describe_backup_job(self) -> "Backup":
        '''(experimental) Grants permission to describe a backup job.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DescribeBackupJob.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toDescribeBackupJob", []))

    @jsii.member(jsii_name="toDescribeBackupVault")
    def to_describe_backup_vault(self) -> "Backup":
        '''(experimental) Grants permission to describe a new backup vault with the specified name.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DescribeBackupVault.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toDescribeBackupVault", []))

    @jsii.member(jsii_name="toDescribeCopyJob")
    def to_describe_copy_job(self) -> "Backup":
        '''(experimental) Grants permission to describe a copy job.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DescribeCopyJob.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toDescribeCopyJob", []))

    @jsii.member(jsii_name="toDescribeGlobalSettings")
    def to_describe_global_settings(self) -> "Backup":
        '''(experimental) Grants permission to describe global settings.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DescribeGlobalSettings.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toDescribeGlobalSettings", []))

    @jsii.member(jsii_name="toDescribeProtectedResource")
    def to_describe_protected_resource(self) -> "Backup":
        '''(experimental) Grants permission to describe a protected resource.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DescribeProtectedResource.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toDescribeProtectedResource", []))

    @jsii.member(jsii_name="toDescribeRecoveryPoint")
    def to_describe_recovery_point(self) -> "Backup":
        '''(experimental) Grants permission to describe a recovery point.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DescribeRecoveryPoint.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toDescribeRecoveryPoint", []))

    @jsii.member(jsii_name="toDescribeRegionSettings")
    def to_describe_region_settings(self) -> "Backup":
        '''(experimental) Grants permission to describe region settings.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DescribeRegionSettings.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toDescribeRegionSettings", []))

    @jsii.member(jsii_name="toDescribeRestoreJob")
    def to_describe_restore_job(self) -> "Backup":
        '''(experimental) Grants permission to describe a restore job.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DescribeRestoreJob.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toDescribeRestoreJob", []))

    @jsii.member(jsii_name="toDisassociateRecoveryPoint")
    def to_disassociate_recovery_point(self) -> "Backup":
        '''(experimental) Grants permission to disassociate a recovery point from a backup vault.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DisassociateRecoveryPoint.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toDisassociateRecoveryPoint", []))

    @jsii.member(jsii_name="toExportBackupPlanTemplate")
    def to_export_backup_plan_template(self) -> "Backup":
        '''(experimental) Grants permission to export a backup plan as a JSON.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_ExportBackupPlanTemplate.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toExportBackupPlanTemplate", []))

    @jsii.member(jsii_name="toGetBackupPlan")
    def to_get_backup_plan(self) -> "Backup":
        '''(experimental) Grants permission to get a backup plan.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_GetBackupPlan.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toGetBackupPlan", []))

    @jsii.member(jsii_name="toGetBackupPlanFromJSON")
    def to_get_backup_plan_from_json(self) -> "Backup":
        '''(experimental) Grants permission to transform a JSON to a backup plan.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_GetBackupPlanFromJSON.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toGetBackupPlanFromJSON", []))

    @jsii.member(jsii_name="toGetBackupPlanFromTemplate")
    def to_get_backup_plan_from_template(self) -> "Backup":
        '''(experimental) Grants permission to transform a template to a backup plan.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_GetBackupPlanFromTemplate.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toGetBackupPlanFromTemplate", []))

    @jsii.member(jsii_name="toGetBackupSelection")
    def to_get_backup_selection(self) -> "Backup":
        '''(experimental) Grants permission to get a backup plan resource assignment.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_GetBackupSelection.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toGetBackupSelection", []))

    @jsii.member(jsii_name="toGetBackupVaultAccessPolicy")
    def to_get_backup_vault_access_policy(self) -> "Backup":
        '''(experimental) Grants permission to get backup vault access policy.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_GetBackupVaultAccessPolicy.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toGetBackupVaultAccessPolicy", []))

    @jsii.member(jsii_name="toGetBackupVaultNotifications")
    def to_get_backup_vault_notifications(self) -> "Backup":
        '''(experimental) Grants permission to get backup vault notifications.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_GetBackupVaultNotifications.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toGetBackupVaultNotifications", []))

    @jsii.member(jsii_name="toGetRecoveryPointRestoreMetadata")
    def to_get_recovery_point_restore_metadata(self) -> "Backup":
        '''(experimental) Grants permission to get recovery point restore metadata.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_GetRecoveryPointRestoreMetadata.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toGetRecoveryPointRestoreMetadata", []))

    @jsii.member(jsii_name="toGetSupportedResourceTypes")
    def to_get_supported_resource_types(self) -> "Backup":
        '''(experimental) Grants permission to get supported resource types.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_GetSupportedResourceTypes.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toGetSupportedResourceTypes", []))

    @jsii.member(jsii_name="toListBackupJobs")
    def to_list_backup_jobs(self) -> "Backup":
        '''(experimental) Grants permission to list backup jobs.

        Access Level: List

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_ListBackupJobs.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toListBackupJobs", []))

    @jsii.member(jsii_name="toListBackupPlans")
    def to_list_backup_plans(self) -> "Backup":
        '''(experimental) Grants permision to list backup plans.

        Access Level: List

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_ListBackupPlans.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toListBackupPlans", []))

    @jsii.member(jsii_name="toListBackupPlanTemplates")
    def to_list_backup_plan_templates(self) -> "Backup":
        '''(experimental) Grants permission to list backup plan templates provided by AWS Backup.

        Access Level: List

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_ListBackupPlanTemplates.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toListBackupPlanTemplates", []))

    @jsii.member(jsii_name="toListBackupPlanVersions")
    def to_list_backup_plan_versions(self) -> "Backup":
        '''(experimental) Grants permission to list backup plan versions.

        Access Level: List

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_ListBackupPlanVersions.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toListBackupPlanVersions", []))

    @jsii.member(jsii_name="toListBackupSelections")
    def to_list_backup_selections(self) -> "Backup":
        '''(experimental) Grants permission to list resource assignments for a specific backup plan.

        Access Level: List

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_ListBackupSelections.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toListBackupSelections", []))

    @jsii.member(jsii_name="toListBackupVaults")
    def to_list_backup_vaults(self) -> "Backup":
        '''(experimental) Grants permission to list backup vaults.

        Access Level: List

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_ListBackupVaults.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toListBackupVaults", []))

    @jsii.member(jsii_name="toListCopyJobs")
    def to_list_copy_jobs(self) -> "Backup":
        '''(experimental) Grants permission to list copy jobs.

        Access Level: List

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_ListCopyJobs.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toListCopyJobs", []))

    @jsii.member(jsii_name="toListProtectedResources")
    def to_list_protected_resources(self) -> "Backup":
        '''(experimental) Grants permission to list protected resources by AWS Backup.

        Access Level: List

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_ListProtectedResources.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toListProtectedResources", []))

    @jsii.member(jsii_name="toListRecoveryPointsByBackupVault")
    def to_list_recovery_points_by_backup_vault(self) -> "Backup":
        '''(experimental) Grants permission to list recovery points inside a backup vault.

        Access Level: List

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_ListRecoveryPointsByBackupVault.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toListRecoveryPointsByBackupVault", []))

    @jsii.member(jsii_name="toListRecoveryPointsByResource")
    def to_list_recovery_points_by_resource(self) -> "Backup":
        '''(experimental) Grants permission to list recovery points for a resource.

        Access Level: List

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_ListRecoveryPointsByResource.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toListRecoveryPointsByResource", []))

    @jsii.member(jsii_name="toListRestoreJobs")
    def to_list_restore_jobs(self) -> "Backup":
        '''(experimental) Grants permission to lists restore jobs.

        Access Level: List

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_ListRestoreJobs.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toListRestoreJobs", []))

    @jsii.member(jsii_name="toListTags")
    def to_list_tags(self) -> "Backup":
        '''(experimental) Grants permission to list tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_ListTags.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toListTags", []))

    @jsii.member(jsii_name="toPutBackupVaultAccessPolicy")
    def to_put_backup_vault_access_policy(self) -> "Backup":
        '''(experimental) Grants permission to add an access policy to the backup vault.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_PutBackupVaultAccessPolicy.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toPutBackupVaultAccessPolicy", []))

    @jsii.member(jsii_name="toPutBackupVaultNotifications")
    def to_put_backup_vault_notifications(self) -> "Backup":
        '''(experimental) Grants permission to add an SNS topic to the backup vault.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_PutBackupVaultNotifications.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toPutBackupVaultNotifications", []))

    @jsii.member(jsii_name="toStartBackupJob")
    def to_start_backup_job(self) -> "Backup":
        '''(experimental) Grants permission to start a new backup job.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_StartBackupJob.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toStartBackupJob", []))

    @jsii.member(jsii_name="toStartCopyJob")
    def to_start_copy_job(self) -> "Backup":
        '''(experimental) Grants permission to copy a backup from a source backup vault to a destination backup vault.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_StartCopyJob.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toStartCopyJob", []))

    @jsii.member(jsii_name="toStartRestoreJob")
    def to_start_restore_job(self) -> "Backup":
        '''(experimental) Grants permission to start a new restore job.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_StartRestoreJob.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toStartRestoreJob", []))

    @jsii.member(jsii_name="toStopBackupJob")
    def to_stop_backup_job(self) -> "Backup":
        '''(experimental) Grants permission to stop a backup job.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_StopBackupJob.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toStopBackupJob", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Backup":
        '''(experimental) Grants permission to tag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Backup":
        '''(experimental) Grants permission to untag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateBackupPlan")
    def to_update_backup_plan(self) -> "Backup":
        '''(experimental) Grants permission to update a backup plan.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_UpdateBackupPlan.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toUpdateBackupPlan", []))

    @jsii.member(jsii_name="toUpdateGlobalSettings")
    def to_update_global_settings(self) -> "Backup":
        '''(experimental) Grants permission to update the current global settings for the AWS Account.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_UpdateGlobalSettings.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toUpdateGlobalSettings", []))

    @jsii.member(jsii_name="toUpdateRecoveryPointLifecycle")
    def to_update_recovery_point_lifecycle(self) -> "Backup":
        '''(experimental) Grants permission to update the lifecycle of the recovery point.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_UpdateRecoveryPointLifecycle.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toUpdateRecoveryPointLifecycle", []))

    @jsii.member(jsii_name="toUpdateRegionSettings")
    def to_update_region_settings(self) -> "Backup":
        '''(experimental) Grants permission to update the current service opt-in settings for the Region.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_UpdateRegionSettings.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toUpdateRegionSettings", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class BackupStorage(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.BackupStorage",
):
    '''(experimental) Statement provider for service `backup-storage <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbackupstorage.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `backup-storage <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbackupstorage.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(BackupStorage, self, [sid])

    @jsii.member(jsii_name="toMountCapsule")
    def to_mount_capsule(self) -> "BackupStorage":
        '''(experimental) Associates a KMS key to a backup vault.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_CreateBackupVault.html

        :stability: experimental
        '''
        return typing.cast("BackupStorage", jsii.invoke(self, "toMountCapsule", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Batch(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Batch"):
    '''(experimental) Statement provider for service `batch <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbatch.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `batch <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbatch.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Batch, self, [sid])

    @jsii.member(jsii_name="ifAWSLogsCreateGroup")
    def if_aws_logs_create_group(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Batch":
        '''(experimental) When this parameter is true, the awslogs-group will be created for the logs.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awsbatch.html#awsbatch-policy-keys

        Applies to actions:

        - .toRegisterJobDefinition()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "ifAWSLogsCreateGroup", [value]))

    @jsii.member(jsii_name="ifAWSLogsGroup")
    def if_aws_logs_group(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Batch":
        '''(experimental) The awslogs group where the logs are located.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awsbatch.html#awsbatch-policy-keys

        Applies to actions:

        - .toRegisterJobDefinition()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "ifAWSLogsGroup", [value, operator]))

    @jsii.member(jsii_name="ifAWSLogsRegion")
    def if_aws_logs_region(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Batch":
        '''(experimental) The region where the logs are sent to.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awsbatch.html#awsbatch-policy-keys

        Applies to actions:

        - .toRegisterJobDefinition()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "ifAWSLogsRegion", [value, operator]))

    @jsii.member(jsii_name="ifAWSLogsStreamPrefix")
    def if_aws_logs_stream_prefix(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Batch":
        '''(experimental) The awslogs log stream prefix.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awsbatch.html#awsbatch-policy-keys

        Applies to actions:

        - .toRegisterJobDefinition()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "ifAWSLogsStreamPrefix", [value, operator]))

    @jsii.member(jsii_name="ifImage")
    def if_image(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Batch":
        '''(experimental) The image used to start a container.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awsbatch.html#awsbatch-policy-keys

        Applies to actions:

        - .toRegisterJobDefinition()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "ifImage", [value, operator]))

    @jsii.member(jsii_name="ifLogDriver")
    def if_log_driver(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Batch":
        '''(experimental) The log driver used for the container.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awsbatch.html#awsbatch-policy-keys

        Applies to actions:

        - .toRegisterJobDefinition()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "ifLogDriver", [value, operator]))

    @jsii.member(jsii_name="ifPrivileged")
    def if_privileged(self, value: typing.Optional[builtins.bool] = None) -> "Batch":
        '''(experimental) When this parameter is true, the container is given elevated privileges on the host container instance (similar to the root user).

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awsbatch.html#awsbatch-policy-keys

        Applies to actions:

        - .toRegisterJobDefinition()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "ifPrivileged", [value]))

    @jsii.member(jsii_name="ifUser")
    def if_user(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Batch":
        '''(experimental) The user name or numeric uid to use inside the container.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awsbatch.html#awsbatch-policy-keys

        Applies to actions:

        - .toRegisterJobDefinition()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "ifUser", [value, operator]))

    @jsii.member(jsii_name="onComputeEnvironment")
    def on_compute_environment(
        self,
        compute_environment_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Batch":
        '''(experimental) Adds a resource of type compute-environment to the statement.

        https://docs.aws.amazon.com/batch/latest/userguide/compute_environments.html

        :param compute_environment_name: - Identifier for the computeEnvironmentName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "onComputeEnvironment", [compute_environment_name, account, region, partition]))

    @jsii.member(jsii_name="onJob")
    def on_job(
        self,
        job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Batch":
        '''(experimental) Adds a resource of type job to the statement.

        https://docs.aws.amazon.com/batch/latest/userguide/jobs.html

        :param job_id: - Identifier for the jobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "onJob", [job_id, account, region, partition]))

    @jsii.member(jsii_name="onJobDefinition")
    def on_job_definition(
        self,
        job_definition_name: builtins.str,
        revision: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Batch":
        '''(experimental) Adds a resource of type job-definition to the statement.

        https://docs.aws.amazon.com/batch/latest/userguide/job_definitions.html

        :param job_definition_name: - Identifier for the jobDefinitionName.
        :param revision: - Identifier for the revision.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "onJobDefinition", [job_definition_name, revision, account, region, partition]))

    @jsii.member(jsii_name="onJobQueue")
    def on_job_queue(
        self,
        job_queue_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Batch":
        '''(experimental) Adds a resource of type job-queue to the statement.

        https://docs.aws.amazon.com/batch/latest/userguide/job_queues.html

        :param job_queue_name: - Identifier for the jobQueueName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "onJobQueue", [job_queue_name, account, region, partition]))

    @jsii.member(jsii_name="toCancelJob")
    def to_cancel_job(self) -> "Batch":
        '''(experimental) Cancels a job in an AWS Batch job queue.

        Access Level: Write

        https://docs.aws.amazon.com/batch/latest/APIReference/API_CancelJob.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toCancelJob", []))

    @jsii.member(jsii_name="toCreateComputeEnvironment")
    def to_create_compute_environment(self) -> "Batch":
        '''(experimental) Creates an AWS Batch compute environment.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/batch/latest/APIReference/API_CreateComputeEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toCreateComputeEnvironment", []))

    @jsii.member(jsii_name="toCreateJobQueue")
    def to_create_job_queue(self) -> "Batch":
        '''(experimental) Creates an AWS Batch job queue.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/batch/latest/APIReference/API_CreateJobQueue.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toCreateJobQueue", []))

    @jsii.member(jsii_name="toDeleteComputeEnvironment")
    def to_delete_compute_environment(self) -> "Batch":
        '''(experimental) Deletes an AWS Batch compute environment.

        Access Level: Write

        https://docs.aws.amazon.com/batch/latest/APIReference/API_DeleteComputeEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toDeleteComputeEnvironment", []))

    @jsii.member(jsii_name="toDeleteJobQueue")
    def to_delete_job_queue(self) -> "Batch":
        '''(experimental) Deletes the specified job queue.

        Access Level: Write

        https://docs.aws.amazon.com/batch/latest/APIReference/API_DeleteJobQueue.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toDeleteJobQueue", []))

    @jsii.member(jsii_name="toDeregisterJobDefinition")
    def to_deregister_job_definition(self) -> "Batch":
        '''(experimental) Deregisters an AWS Batch job definition.

        Access Level: Write

        https://docs.aws.amazon.com/batch/latest/APIReference/API_DeregisterJobDefinition.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toDeregisterJobDefinition", []))

    @jsii.member(jsii_name="toDescribeComputeEnvironments")
    def to_describe_compute_environments(self) -> "Batch":
        '''(experimental) Describes one or more of your compute environments.

        Access Level: Read

        https://docs.aws.amazon.com/batch/latest/APIReference/API_DescribeComputeEnvironments.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toDescribeComputeEnvironments", []))

    @jsii.member(jsii_name="toDescribeJobDefinitions")
    def to_describe_job_definitions(self) -> "Batch":
        '''(experimental) Describes a list of job definitions.

        Access Level: Read

        https://docs.aws.amazon.com/batch/latest/APIReference/API_DescribeJobDefinitions.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toDescribeJobDefinitions", []))

    @jsii.member(jsii_name="toDescribeJobQueues")
    def to_describe_job_queues(self) -> "Batch":
        '''(experimental) Describes one or more of your job queues.

        Access Level: Read

        https://docs.aws.amazon.com/batch/latest/APIReference/API_DescribeJobQueues.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toDescribeJobQueues", []))

    @jsii.member(jsii_name="toDescribeJobs")
    def to_describe_jobs(self) -> "Batch":
        '''(experimental) Describes a list of AWS Batch jobs.

        Access Level: Read

        https://docs.aws.amazon.com/batch/latest/APIReference/API_DescribeJobs.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toDescribeJobs", []))

    @jsii.member(jsii_name="toListJobs")
    def to_list_jobs(self) -> "Batch":
        '''(experimental) Returns a list of task jobs for a specified job queue.

        Access Level: List

        https://docs.aws.amazon.com/batch/latest/APIReference/API_ListJobs.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toListJobs", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Batch":
        '''(experimental) List tags for the specified resource.

        Access Level: List

        https://docs.aws.amazon.com/batch/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toRegisterJobDefinition")
    def to_register_job_definition(self) -> "Batch":
        '''(experimental) Registers an AWS Batch job definition.

        Access Level: Write

        Possible conditions:

        - .ifUser()
        - .ifPrivileged()
        - .ifImage()
        - .ifLogDriver()
        - .ifAWSLogsGroup()
        - .ifAWSLogsRegion()
        - .ifAWSLogsStreamPrefix()
        - .ifAWSLogsCreateGroup()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/batch/latest/APIReference/API_RegisterJobDefinition.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toRegisterJobDefinition", []))

    @jsii.member(jsii_name="toSubmitJob")
    def to_submit_job(self) -> "Batch":
        '''(experimental) Submits an AWS Batch job from a job definition.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/batch/latest/APIReference/API_SubmitJob.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toSubmitJob", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Batch":
        '''(experimental) Tags the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/batch/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTerminateJob")
    def to_terminate_job(self) -> "Batch":
        '''(experimental) Terminates a job in an AWS Batch job queue.

        Access Level: Write

        https://docs.aws.amazon.com/batch/latest/APIReference/API_TerminateJob.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toTerminateJob", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Batch":
        '''(experimental) Untags the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/batch/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateComputeEnvironment")
    def to_update_compute_environment(self) -> "Batch":
        '''(experimental) Updates an AWS Batch compute environment.

        Access Level: Write

        https://docs.aws.amazon.com/batch/latest/APIReference/API_UpdateComputeEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toUpdateComputeEnvironment", []))

    @jsii.member(jsii_name="toUpdateJobQueue")
    def to_update_job_queue(self) -> "Batch":
        '''(experimental) Updates a job queue.

        Access Level: Write

        https://docs.aws.amazon.com/batch/latest/APIReference/API_UpdateJobQueue.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toUpdateJobQueue", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Braket(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Braket"):
    '''(experimental) Statement provider for service `braket <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonbraket.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `braket <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonbraket.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Braket, self, [sid])

    @jsii.member(jsii_name="onQuantumTask")
    def on_quantum_task(
        self,
        random_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Braket":
        '''(experimental) Adds a resource of type quantum-task to the statement.

        https://docs.aws.amazon.com/braket/latest/developerguide/braket-manage-access.html#resources

        :param random_id: - Identifier for the randomId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Braket", jsii.invoke(self, "onQuantumTask", [random_id, account, region, partition]))

    @jsii.member(jsii_name="toCancelQuantumTask")
    def to_cancel_quantum_task(self) -> "Braket":
        '''(experimental) Grants permission to cancel a quantum task.

        Access Level: Write

        https://docs.aws.amazon.com/braket/latest/APIReference/API_CancelQuantumTask.html

        :stability: experimental
        '''
        return typing.cast("Braket", jsii.invoke(self, "toCancelQuantumTask", []))

    @jsii.member(jsii_name="toCreateQuantumTask")
    def to_create_quantum_task(self) -> "Braket":
        '''(experimental) Grants permission to create a quantum task.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/braket/latest/APIReference/API_CreateQuantumTask.html

        :stability: experimental
        '''
        return typing.cast("Braket", jsii.invoke(self, "toCreateQuantumTask", []))

    @jsii.member(jsii_name="toGetDevice")
    def to_get_device(self) -> "Braket":
        '''(experimental) Grants permission to retrieve information about the devices available in Amazon Braket.

        Access Level: Read

        https://docs.aws.amazon.com/braket/latest/APIReference/API_GetDevice.html

        :stability: experimental
        '''
        return typing.cast("Braket", jsii.invoke(self, "toGetDevice", []))

    @jsii.member(jsii_name="toGetQuantumTask")
    def to_get_quantum_task(self) -> "Braket":
        '''(experimental) Grants permission to retrieve quantum tasks.

        Access Level: Read

        https://docs.aws.amazon.com/braket/latest/APIReference/API_GetQuantumTask.html

        :stability: experimental
        '''
        return typing.cast("Braket", jsii.invoke(self, "toGetQuantumTask", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Braket":
        '''(experimental) Lists the tags that have been applied to the quantum task resource.

        Access Level: Read

        https://docs.aws.amazon.com/braket/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Braket", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toSearchDevices")
    def to_search_devices(self) -> "Braket":
        '''(experimental) Grants permission to search for devices available in Amazon Braket.

        Access Level: Read

        https://docs.aws.amazon.com/braket/latest/APIReference/API_SearchDevices.html

        :stability: experimental
        '''
        return typing.cast("Braket", jsii.invoke(self, "toSearchDevices", []))

    @jsii.member(jsii_name="toSearchQuantumTasks")
    def to_search_quantum_tasks(self) -> "Braket":
        '''(experimental) Grants permission to search for quantum tasks.

        Access Level: Read

        https://docs.aws.amazon.com/braket/latest/APIReference/API_SearchQuantumTasks.html

        :stability: experimental
        '''
        return typing.cast("Braket", jsii.invoke(self, "toSearchQuantumTasks", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Braket":
        '''(experimental) Adds one or more tags to a quantum task.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/braket/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Braket", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Braket":
        '''(experimental) Remove one or more tags from a quantum task resource. A tag consists of a key-value pair.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/braket/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Braket", jsii.invoke(self, "toUntagResource", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Budgets(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Budgets"):
    '''(experimental) Statement provider for service `budgets <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbudgetservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `budgets <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbudgetservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Budgets, self, [sid])

    @jsii.member(jsii_name="onBudget")
    def on_budget(
        self,
        budget_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Budgets":
        '''(experimental) Adds a resource of type budget to the statement.

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/budgets-managing-costs.html

        :param budget_name: - Identifier for the budgetName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Budgets", jsii.invoke(self, "onBudget", [budget_name, account, partition]))

    @jsii.member(jsii_name="onBudgetAction")
    def on_budget_action(
        self,
        budget_name: builtins.str,
        action_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Budgets":
        '''(experimental) Adds a resource of type budgetAction to the statement.

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/budgets-managing-costs.html

        :param budget_name: - Identifier for the budgetName.
        :param action_id: - Identifier for the actionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Budgets", jsii.invoke(self, "onBudgetAction", [budget_name, action_id, account, partition]))

    @jsii.member(jsii_name="toCreateBudgetAction")
    def to_create_budget_action(self) -> "Budgets":
        '''(experimental) Grants permissions to create and define a response that you can configure to execute once your budget has exceeded a specific budget threshold.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Budgets", jsii.invoke(self, "toCreateBudgetAction", []))

    @jsii.member(jsii_name="toDeleteBudgetAction")
    def to_delete_budget_action(self) -> "Budgets":
        '''(experimental) Grants permissions to delete an action that is associated with a specific budget.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Budgets", jsii.invoke(self, "toDeleteBudgetAction", []))

    @jsii.member(jsii_name="toDescribeBudgetAction")
    def to_describe_budget_action(self) -> "Budgets":
        '''(experimental) Grants permissions to retrieve the details of specific budget action associated with a budget.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Budgets", jsii.invoke(self, "toDescribeBudgetAction", []))

    @jsii.member(jsii_name="toDescribeBudgetActionHistories")
    def to_describe_budget_action_histories(self) -> "Budgets":
        '''(experimental) Grants permissions to retrieve a historical view of the budget actions statuses associated with a particular budget action.

        These status include statues such as 'Standby', 'Pending' and 'Executed'.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Budgets", jsii.invoke(self, "toDescribeBudgetActionHistories", []))

    @jsii.member(jsii_name="toDescribeBudgetActionsForAccount")
    def to_describe_budget_actions_for_account(self) -> "Budgets":
        '''(experimental) Grants permissions to retrieve the details of all of the budget actions associated with your account.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Budgets", jsii.invoke(self, "toDescribeBudgetActionsForAccount", []))

    @jsii.member(jsii_name="toDescribeBudgetActionsForBudget")
    def to_describe_budget_actions_for_budget(self) -> "Budgets":
        '''(experimental) Grants permissions to retrieve the details of all of the budget actions associated with a budget.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Budgets", jsii.invoke(self, "toDescribeBudgetActionsForBudget", []))

    @jsii.member(jsii_name="toExecuteBudgetAction")
    def to_execute_budget_action(self) -> "Budgets":
        '''(experimental) Grants permissions to initiate a pending budget action as well as reverse a previously executed budget action.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Budgets", jsii.invoke(self, "toExecuteBudgetAction", []))

    @jsii.member(jsii_name="toModifyBudget")
    def to_modify_budget(self) -> "Budgets":
        '''(experimental) Grants permissions to modify budgets and budget details.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Budgets", jsii.invoke(self, "toModifyBudget", []))

    @jsii.member(jsii_name="toUpdateBudgetAction")
    def to_update_budget_action(self) -> "Budgets":
        '''(experimental) Grants permissions to update the details of a specific budget action associated with a budget.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Budgets", jsii.invoke(self, "toUpdateBudgetAction", []))

    @jsii.member(jsii_name="toViewBudget")
    def to_view_budget(self) -> "Budgets":
        '''(experimental) Grants permissions to view budgets and budget details.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Budgets", jsii.invoke(self, "toViewBudget", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Cassandra(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Cassandra",
):
    '''(experimental) Statement provider for service `cassandra <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonkeyspacesforapachecassandra.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `cassandra <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonkeyspacesforapachecassandra.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Cassandra, self, [sid])

    @jsii.member(jsii_name="onKeyspace")
    def on_keyspace(
        self,
        keyspace_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cassandra":
        '''(experimental) Adds a resource of type keyspace to the statement.

        https://docs.aws.amazon.com/keyspaces/latest/devguide/what-is.html

        :param keyspace_name: - Identifier for the keyspaceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Cassandra", jsii.invoke(self, "onKeyspace", [keyspace_name, account, region, partition]))

    @jsii.member(jsii_name="onTable")
    def on_table(
        self,
        keyspace_name: builtins.str,
        table_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cassandra":
        '''(experimental) Adds a resource of type table to the statement.

        https://docs.aws.amazon.com/keyspaces/latest/devguide/what-is.html

        :param keyspace_name: - Identifier for the keyspaceName.
        :param table_name: - Identifier for the tableName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Cassandra", jsii.invoke(self, "onTable", [keyspace_name, table_name, account, region, partition]))

    @jsii.member(jsii_name="toAlter")
    def to_alter(self) -> "Cassandra":
        '''(experimental) Grants permission to alter a keyspace or table.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        :stability: experimental
        '''
        return typing.cast("Cassandra", jsii.invoke(self, "toAlter", []))

    @jsii.member(jsii_name="toCreate")
    def to_create(self) -> "Cassandra":
        '''(experimental) Grants permission to create a keyspace or table.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        :stability: experimental
        '''
        return typing.cast("Cassandra", jsii.invoke(self, "toCreate", []))

    @jsii.member(jsii_name="toDrop")
    def to_drop(self) -> "Cassandra":
        '''(experimental) Grants permission to drop a keyspace or table.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Cassandra", jsii.invoke(self, "toDrop", []))

    @jsii.member(jsii_name="toModify")
    def to_modify(self) -> "Cassandra":
        '''(experimental) Grants permission to INSERT, UPDATE or DELETE data in a table.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Cassandra", jsii.invoke(self, "toModify", []))

    @jsii.member(jsii_name="toRestore")
    def to_restore(self) -> "Cassandra":
        '''(experimental) Grants permission to restore table from a backup.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        :stability: experimental
        '''
        return typing.cast("Cassandra", jsii.invoke(self, "toRestore", []))

    @jsii.member(jsii_name="toSelect")
    def to_select(self) -> "Cassandra":
        '''(experimental) Grants permission to SELECT data from a table.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Cassandra", jsii.invoke(self, "toSelect", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Cassandra":
        '''(experimental) Grants permission to tag a keyspace or table.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        :stability: experimental
        '''
        return typing.cast("Cassandra", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Cassandra":
        '''(experimental) Grants permission to untag a keyspace or table.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        :stability: experimental
        '''
        return typing.cast("Cassandra", jsii.invoke(self, "toUntagResource", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Ce(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Ce"):
    '''(experimental) Statement provider for service `ce <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscostexplorerservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `ce <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscostexplorerservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Ce, self, [sid])

    @jsii.member(jsii_name="toCreateAnomalyMonitor")
    def to_create_anomaly_monitor(self) -> "Ce":
        '''(experimental) Grants permission to create a new Anomaly Monitor.

        Access Level: Write

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_CreateAnomalyMonitor.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toCreateAnomalyMonitor", []))

    @jsii.member(jsii_name="toCreateAnomalySubscription")
    def to_create_anomaly_subscription(self) -> "Ce":
        '''(experimental) Grants permission to create a new Anomaly Subscription.

        Access Level: Write

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_CreateAnomalySubscription.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toCreateAnomalySubscription", []))

    @jsii.member(jsii_name="toCreateCostCategoryDefinition")
    def to_create_cost_category_definition(self) -> "Ce":
        '''(experimental) Grants permission to create a new Cost Category with the requested name and rules.

        Access Level: Write

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_CreateCostCategoryDefinition.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toCreateCostCategoryDefinition", []))

    @jsii.member(jsii_name="toCreateNotificationSubscription")
    def to_create_notification_subscription(self) -> "Ce":
        '''(experimental) Grants permission to create Reservation expiration alerts.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toCreateNotificationSubscription", []))

    @jsii.member(jsii_name="toCreateReport")
    def to_create_report(self) -> "Ce":
        '''(experimental) Grants permission to create Cost Explorer Reports.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toCreateReport", []))

    @jsii.member(jsii_name="toDeleteAnomalyMonitor")
    def to_delete_anomaly_monitor(self) -> "Ce":
        '''(experimental) Grants permission to delete an Anomaly Monitor.

        Access Level: Write

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_DeleteAnomalyMonitor.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toDeleteAnomalyMonitor", []))

    @jsii.member(jsii_name="toDeleteAnomalySubscription")
    def to_delete_anomaly_subscription(self) -> "Ce":
        '''(experimental) Grants permission to delete an Anomaly Subscription.

        Access Level: Write

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_DeleteAnomalySubscription.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toDeleteAnomalySubscription", []))

    @jsii.member(jsii_name="toDeleteCostCategoryDefinition")
    def to_delete_cost_category_definition(self) -> "Ce":
        '''(experimental) Grants permission to delete a Cost Category.

        Access Level: Write

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_DeleteCostCategoryDefinition.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toDeleteCostCategoryDefinition", []))

    @jsii.member(jsii_name="toDeleteNotificationSubscription")
    def to_delete_notification_subscription(self) -> "Ce":
        '''(experimental) Grants permission to delete Reservation expiration alerts.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toDeleteNotificationSubscription", []))

    @jsii.member(jsii_name="toDeleteReport")
    def to_delete_report(self) -> "Ce":
        '''(experimental) Grants permission to delete Cost Explorer Reports.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toDeleteReport", []))

    @jsii.member(jsii_name="toDescribeCostCategoryDefinition")
    def to_describe_cost_category_definition(self) -> "Ce":
        '''(experimental) Grants permission to retrieve descriptions such as the name, ARN, rules, definition, and effective dates of a Cost Category.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_DescribeCostCategoryDefinition.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toDescribeCostCategoryDefinition", []))

    @jsii.member(jsii_name="toDescribeNotificationSubscription")
    def to_describe_notification_subscription(self) -> "Ce":
        '''(experimental) Grants permission to view Reservation expiration alerts.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toDescribeNotificationSubscription", []))

    @jsii.member(jsii_name="toDescribeReport")
    def to_describe_report(self) -> "Ce":
        '''(experimental) Grants permission to view Cost Explorer Reports page.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toDescribeReport", []))

    @jsii.member(jsii_name="toGetAnomalies")
    def to_get_anomalies(self) -> "Ce":
        '''(experimental) Grants permission to retrieve anomalies.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetAnomalies.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetAnomalies", []))

    @jsii.member(jsii_name="toGetAnomalyMonitors")
    def to_get_anomaly_monitors(self) -> "Ce":
        '''(experimental) Grants permission to query Anomaly Monitors.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetAnomalyMonitors.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetAnomalyMonitors", []))

    @jsii.member(jsii_name="toGetAnomalySubscriptions")
    def to_get_anomaly_subscriptions(self) -> "Ce":
        '''(experimental) Grants permission to query Anomaly Subscriptions.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetAnomalySubscriptions.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetAnomalySubscriptions", []))

    @jsii.member(jsii_name="toGetCostAndUsage")
    def to_get_cost_and_usage(self) -> "Ce":
        '''(experimental) Grants permission to retrieve the cost and usage metrics for your account.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetCostAndUsage.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetCostAndUsage", []))

    @jsii.member(jsii_name="toGetCostAndUsageWithResources")
    def to_get_cost_and_usage_with_resources(self) -> "Ce":
        '''(experimental) Grants permission to retrieve the cost and usage metrics with resources for your account.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetCostAndUsageWithResources.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetCostAndUsageWithResources", []))

    @jsii.member(jsii_name="toGetCostCategories")
    def to_get_cost_categories(self) -> "Ce":
        '''(experimental) Grants permission to query Cost Catagory names and values for a specified time period.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetCostCategories.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetCostCategories", []))

    @jsii.member(jsii_name="toGetCostForecast")
    def to_get_cost_forecast(self) -> "Ce":
        '''(experimental) Grants permission to retrieve a cost forecast for a forecast time period.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetCostForecast.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetCostForecast", []))

    @jsii.member(jsii_name="toGetDimensionValues")
    def to_get_dimension_values(self) -> "Ce":
        '''(experimental) Grants permission to retrieve all available filter values for a filter for a period of time.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetDimensionValues.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetDimensionValues", []))

    @jsii.member(jsii_name="toGetPreferences")
    def to_get_preferences(self) -> "Ce":
        '''(experimental) Grants permission to view Cost Explorer Preferences page.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetPreferences", []))

    @jsii.member(jsii_name="toGetReservationCoverage")
    def to_get_reservation_coverage(self) -> "Ce":
        '''(experimental) Grants permission to retrieve the reservation coverage for your account.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetReservationCoverage.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetReservationCoverage", []))

    @jsii.member(jsii_name="toGetReservationPurchaseRecommendation")
    def to_get_reservation_purchase_recommendation(self) -> "Ce":
        '''(experimental) Grants permission to retrieve the reservation recommendations for your account.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetReservationPurchaseRecommendation.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetReservationPurchaseRecommendation", []))

    @jsii.member(jsii_name="toGetReservationUtilization")
    def to_get_reservation_utilization(self) -> "Ce":
        '''(experimental) Grants permission to retrieve the reservation utilization for your account.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetReservationUtilization.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetReservationUtilization", []))

    @jsii.member(jsii_name="toGetRightsizingRecommendation")
    def to_get_rightsizing_recommendation(self) -> "Ce":
        '''(experimental) Grants permission to retrieve the rightsizing recommendations for your account.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetRightsizingRecommendation.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetRightsizingRecommendation", []))

    @jsii.member(jsii_name="toGetSavingsPlansCoverage")
    def to_get_savings_plans_coverage(self) -> "Ce":
        '''(experimental) Grants permission to retrieve the Savings Plans coverage for your account.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetSavingsPlansCoverage.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetSavingsPlansCoverage", []))

    @jsii.member(jsii_name="toGetSavingsPlansPurchaseRecommendation")
    def to_get_savings_plans_purchase_recommendation(self) -> "Ce":
        '''(experimental) Grants permission to retrieve the Savings Plans recommendations for your account.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetSavingsPlansPurchaseRecommendation.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetSavingsPlansPurchaseRecommendation", []))

    @jsii.member(jsii_name="toGetSavingsPlansUtilization")
    def to_get_savings_plans_utilization(self) -> "Ce":
        '''(experimental) Grants permission to retrieve the Savings Plans utilization for your account.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetSavingsPlansUtilization.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetSavingsPlansUtilization", []))

    @jsii.member(jsii_name="toGetSavingsPlansUtilizationDetails")
    def to_get_savings_plans_utilization_details(self) -> "Ce":
        '''(experimental) Grants permission to retrieve the Savings Plans utilization details for your account.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetSavingsPlansUtilizationDetails.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetSavingsPlansUtilizationDetails", []))

    @jsii.member(jsii_name="toGetTags")
    def to_get_tags(self) -> "Ce":
        '''(experimental) Grants permission to query tags for a specified time period.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetTags.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetTags", []))

    @jsii.member(jsii_name="toGetUsageForecast")
    def to_get_usage_forecast(self) -> "Ce":
        '''(experimental) Grants permission to retrieve a usage forecast for a forecast time period.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetUsageForecast.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetUsageForecast", []))

    @jsii.member(jsii_name="toListCostCategoryDefinitions")
    def to_list_cost_category_definitions(self) -> "Ce":
        '''(experimental) Grants permission to retrieve names, ARN, and effective dates for all Cost Categories.

        Access Level: List

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_ListCostCategoryDefinitions.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toListCostCategoryDefinitions", []))

    @jsii.member(jsii_name="toProvideAnomalyFeedback")
    def to_provide_anomaly_feedback(self) -> "Ce":
        '''(experimental) Grants permission to provide feedback on detected anomalies.

        Access Level: Write

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_ProvideAnomalyFeedback.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toProvideAnomalyFeedback", []))

    @jsii.member(jsii_name="toUpdateAnomalyMonitor")
    def to_update_anomaly_monitor(self) -> "Ce":
        '''(experimental) Grants permission to update an existing Anomaly Monitor.

        Access Level: Write

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_UpdateAnomalyMonitor.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toUpdateAnomalyMonitor", []))

    @jsii.member(jsii_name="toUpdateAnomalySubscription")
    def to_update_anomaly_subscription(self) -> "Ce":
        '''(experimental) Grants permission to update an existing Anomaly Subscription.

        Access Level: Write

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_UpdateAnomalySubscription.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toUpdateAnomalySubscription", []))

    @jsii.member(jsii_name="toUpdateCostCategoryDefinition")
    def to_update_cost_category_definition(self) -> "Ce":
        '''(experimental) Grants permission to update an existing Cost Category.

        Access Level: Write

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_UpdateCostCategoryDefinition.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toUpdateCostCategoryDefinition", []))

    @jsii.member(jsii_name="toUpdateNotificationSubscription")
    def to_update_notification_subscription(self) -> "Ce":
        '''(experimental) Grants permission to update Reservation expiration alerts.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toUpdateNotificationSubscription", []))

    @jsii.member(jsii_name="toUpdatePreferences")
    def to_update_preferences(self) -> "Ce":
        '''(experimental) Grants permission to edit Cost Explorer Preferences page.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toUpdatePreferences", []))

    @jsii.member(jsii_name="toUpdateReport")
    def to_update_report(self) -> "Ce":
        '''(experimental) Grants permission to update Cost Explorer Reports.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toUpdateReport", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Chatbot(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Chatbot"):
    '''(experimental) Statement provider for service `chatbot <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awschatbot.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `chatbot <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awschatbot.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Chatbot, self, [sid])

    @jsii.member(jsii_name="onChatbotConfiguration")
    def on_chatbot_configuration(
        self,
        resource_type: builtins.str,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Chatbot":
        '''(experimental) Adds a resource of type ChatbotConfiguration to the statement.

        :param resource_type: - Identifier for the resourceType.
        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "onChatbotConfiguration", [resource_type, resource_name, account, partition]))

    @jsii.member(jsii_name="toCreateChimeWebhookConfiguration")
    def to_create_chime_webhook_configuration(self) -> "Chatbot":
        '''(experimental) Creates an AWS Chatbot Chime Webhook Configuration.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toCreateChimeWebhookConfiguration", []))

    @jsii.member(jsii_name="toCreateSlackChannelConfiguration")
    def to_create_slack_channel_configuration(self) -> "Chatbot":
        '''(experimental) Creates an AWS Chatbot Slack Channel Configuration.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toCreateSlackChannelConfiguration", []))

    @jsii.member(jsii_name="toDeleteChimeWebhookConfiguration")
    def to_delete_chime_webhook_configuration(self) -> "Chatbot":
        '''(experimental) Deletes an AWS Chatbot Chime Webhook Configuration.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toDeleteChimeWebhookConfiguration", []))

    @jsii.member(jsii_name="toDeleteSlackChannelConfiguration")
    def to_delete_slack_channel_configuration(self) -> "Chatbot":
        '''(experimental) Deletes an AWS Chatbot Slack Channel Configuration.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toDeleteSlackChannelConfiguration", []))

    @jsii.member(jsii_name="toDescribeChimeWebhookConfigurations")
    def to_describe_chime_webhook_configurations(self) -> "Chatbot":
        '''(experimental) Lists all AWS Chatbot Chime Webhook Configurations in an AWS Account.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toDescribeChimeWebhookConfigurations", []))

    @jsii.member(jsii_name="toDescribeSlackChannelConfigurations")
    def to_describe_slack_channel_configurations(self) -> "Chatbot":
        '''(experimental) Lists all AWS Chatbot Slack Channel Configurations in an AWS account.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toDescribeSlackChannelConfigurations", []))

    @jsii.member(jsii_name="toDescribeSlackChannels")
    def to_describe_slack_channels(self) -> "Chatbot":
        '''(experimental) Lists all public Slack channels in the Slack workspace connected to the AWS Account onboarded with AWS Chatbot service.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toDescribeSlackChannels", []))

    @jsii.member(jsii_name="toDescribeSlackWorkspaces")
    def to_describe_slack_workspaces(self) -> "Chatbot":
        '''(experimental) Lists all authorized Slack workspaces connected to the AWS Account onboarded with AWS Chatbot service.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toDescribeSlackWorkspaces", []))

    @jsii.member(jsii_name="toGetSlackOauthParameters")
    def to_get_slack_oauth_parameters(self) -> "Chatbot":
        '''(experimental) Generate OAuth parameters to request Slack OAuth code to be used by the AWS Chatbot service.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toGetSlackOauthParameters", []))

    @jsii.member(jsii_name="toRedeemSlackOauthCode")
    def to_redeem_slack_oauth_code(self) -> "Chatbot":
        '''(experimental) Redeem previously generated parameters with Slack API, to acquire OAuth tokens to be used by the AWS Chatbot service.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toRedeemSlackOauthCode", []))

    @jsii.member(jsii_name="toUpdateChimeWebhookConfiguration")
    def to_update_chime_webhook_configuration(self) -> "Chatbot":
        '''(experimental) Updates an AWS Chatbot Chime Webhook Configuration.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toUpdateChimeWebhookConfiguration", []))

    @jsii.member(jsii_name="toUpdateSlackChannelConfiguration")
    def to_update_slack_channel_configuration(self) -> "Chatbot":
        '''(experimental) Updates an AWS Chatbot Slack Channel Configuration.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toUpdateSlackChannelConfiguration", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Chime(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Chime"):
    '''(experimental) Statement provider for service `chime <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonchime.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `chime <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonchime.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Chime, self, [sid])

    @jsii.member(jsii_name="onAppInstance")
    def on_app_instance(
        self,
        app_instance_id: builtins.str,
        account_id: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Chime":
        '''(experimental) Adds a resource of type app-instance to the statement.

        https://docs.aws.amazon.com/chime/latest/APIReference/API_AppInstance.html

        :param app_instance_id: - Identifier for the appInstanceId.
        :param account_id: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "onAppInstance", [app_instance_id, account_id, partition]))

    @jsii.member(jsii_name="onAppInstanceUser")
    def on_app_instance_user(
        self,
        app_instance_id: builtins.str,
        app_instance_user_id: builtins.str,
        account_id: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Chime":
        '''(experimental) Adds a resource of type app-instance-user to the statement.

        https://docs.aws.amazon.com/chime/latest/APIReference/API_AppInstanceUser.html

        :param app_instance_id: - Identifier for the appInstanceId.
        :param app_instance_user_id: - Identifier for the appInstanceUserId.
        :param account_id: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "onAppInstanceUser", [app_instance_id, app_instance_user_id, account_id, partition]))

    @jsii.member(jsii_name="onChannel")
    def on_channel(
        self,
        app_instance_id: builtins.str,
        channel_id: builtins.str,
        account_id: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Chime":
        '''(experimental) Adds a resource of type channel to the statement.

        https://docs.aws.amazon.com/chime/latest/APIReference/API_Channel.html

        :param app_instance_id: - Identifier for the appInstanceId.
        :param channel_id: - Identifier for the channelId.
        :param account_id: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "onChannel", [app_instance_id, channel_id, account_id, partition]))

    @jsii.member(jsii_name="onMeeting")
    def on_meeting(
        self,
        meeting_id: builtins.str,
        account_id: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Chime":
        '''(experimental) Adds a resource of type meeting to the statement.

        https://docs.aws.amazon.com/chime/latest/APIReference/API_Meeting.html

        :param meeting_id: - Identifier for the meetingId.
        :param account_id: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "onMeeting", [meeting_id, account_id, partition]))

    @jsii.member(jsii_name="toAcceptDelegate")
    def to_accept_delegate(self) -> "Chime":
        '''(experimental) Grants permission to accept the delegate invitation to share management of an Amazon Chime account with another AWS Account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toAcceptDelegate", []))

    @jsii.member(jsii_name="toActivateUsers")
    def to_activate_users(self) -> "Chime":
        '''(experimental) Grants permission to activate users in an Amazon Chime Enterprise account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/manage-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toActivateUsers", []))

    @jsii.member(jsii_name="toAddDomain")
    def to_add_domain(self) -> "Chime":
        '''(experimental) Grants permission to add a domain to your Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/claim-domain.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toAddDomain", []))

    @jsii.member(jsii_name="toAddOrUpdateGroups")
    def to_add_or_update_groups(self) -> "Chime":
        '''(experimental) Grants permission to add new or update existing Active Directory or Okta user groups associated with your Amazon Chime Enterprise account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/manage-chime-account.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toAddOrUpdateGroups", []))

    @jsii.member(jsii_name="toAssociatePhoneNumbersWithVoiceConnector")
    def to_associate_phone_numbers_with_voice_connector(self) -> "Chime":
        '''(experimental) Grants permission to associate multiple phone numbers with an Amazon Chime Voice Connector.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_AssociatePhoneNumbersWithVoiceConnector.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toAssociatePhoneNumbersWithVoiceConnector", []))

    @jsii.member(jsii_name="toAssociatePhoneNumbersWithVoiceConnectorGroup")
    def to_associate_phone_numbers_with_voice_connector_group(self) -> "Chime":
        '''(experimental) Grants permission to associate multiple phone numbers with an Amazon Chime Voice Connector Group.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_AssociatePhoneNumbersWithVoiceConnectorGroup.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toAssociatePhoneNumbersWithVoiceConnectorGroup", []))

    @jsii.member(jsii_name="toAssociatePhoneNumberWithUser")
    def to_associate_phone_number_with_user(self) -> "Chime":
        '''(experimental) Grants permission to associate a phone number with an Amazon Chime user.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_AssociatePhoneNumberWithUser.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toAssociatePhoneNumberWithUser", []))

    @jsii.member(jsii_name="toAssociateSigninDelegateGroupsWithAccount")
    def to_associate_signin_delegate_groups_with_account(self) -> "Chime":
        '''(experimental) Grants permission to associate the specified sign-in delegate groups with the specified Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_AssociateSigninDelegateGroupsWithAccount.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toAssociateSigninDelegateGroupsWithAccount", []))

    @jsii.member(jsii_name="toAuthorizeDirectory")
    def to_authorize_directory(self) -> "Chime":
        '''(experimental) Grants permission to authorize an Active Directory for your Amazon Chime Enterprise account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toAuthorizeDirectory", []))

    @jsii.member(jsii_name="toBatchCreateAttendee")
    def to_batch_create_attendee(self) -> "Chime":
        '''(experimental) Grants permission to create new attendees for an active Amazon Chime SDK meeting.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_BatchCreateAttendee.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toBatchCreateAttendee", []))

    @jsii.member(jsii_name="toBatchCreateRoomMembership")
    def to_batch_create_room_membership(self) -> "Chime":
        '''(experimental) Grants permission to batch add room members.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_BatchCreateRoomMembership.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toBatchCreateRoomMembership", []))

    @jsii.member(jsii_name="toBatchDeletePhoneNumber")
    def to_batch_delete_phone_number(self) -> "Chime":
        '''(experimental) Grants permission to move up to 50 phone numbers to the deletion queue.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_BatchDeletePhoneNumber.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toBatchDeletePhoneNumber", []))

    @jsii.member(jsii_name="toBatchSuspendUser")
    def to_batch_suspend_user(self) -> "Chime":
        '''(experimental) Grants permission to suspend up to 50 users from a Team or EnterpriseLWA Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_BatchSuspendUser.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toBatchSuspendUser", []))

    @jsii.member(jsii_name="toBatchUnsuspendUser")
    def to_batch_unsuspend_user(self) -> "Chime":
        '''(experimental) Grants permission to remove the suspension from up to 50 previously suspended users for the specified Amazon Chime EnterpriseLWA account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_BatchUnsuspendUser.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toBatchUnsuspendUser", []))

    @jsii.member(jsii_name="toBatchUpdatePhoneNumber")
    def to_batch_update_phone_number(self) -> "Chime":
        '''(experimental) Grants permission to update phone number details within the UpdatePhoneNumberRequestItem object for up to 50 phone numbers.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_BatchUpdatePhoneNumber.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toBatchUpdatePhoneNumber", []))

    @jsii.member(jsii_name="toBatchUpdateUser")
    def to_batch_update_user(self) -> "Chime":
        '''(experimental) Grants permission to update user details within the UpdateUserRequestItem object for up to 20 users for the specified Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_BatchUpdateUser.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toBatchUpdateUser", []))

    @jsii.member(jsii_name="toConnect")
    def to_connect(self) -> "Chime":
        '''(experimental) Grants permission to establish a web socket connection to the messaging session endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_Connect.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toConnect", []))

    @jsii.member(jsii_name="toConnectDirectory")
    def to_connect_directory(self) -> "Chime":
        '''(experimental) Grants permission to connect an Active Directory to your Amazon Chime Enterprise account.

        Access Level: Write

        Dependent actions:

        - ds:ConnectDirectory

        https://docs.aws.amazon.com/chime/latest/ag/active_directory.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toConnectDirectory", []))

    @jsii.member(jsii_name="toCreateAccount")
    def to_create_account(self) -> "Chime":
        '''(experimental) Grants permission to create an Amazon Chime account under the administrator's AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateAccount.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateAccount", []))

    @jsii.member(jsii_name="toCreateApiKey")
    def to_create_api_key(self) -> "Chime":
        '''(experimental) Grants permission to create a new SCIM access key for your Amazon Chime account and Okta configuration.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/okta_sso.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateApiKey", []))

    @jsii.member(jsii_name="toCreateAppInstance")
    def to_create_app_instance(self) -> "Chime":
        '''(experimental) Grants permission to create an app instance under the AWS account.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateAppInstance.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateAppInstance", []))

    @jsii.member(jsii_name="toCreateAppInstanceAdmin")
    def to_create_app_instance_admin(self) -> "Chime":
        '''(experimental) Grants permission to promote an AppInstanceUser to an AppInstanceAdmin.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateAppInstanceAdmin.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateAppInstanceAdmin", []))

    @jsii.member(jsii_name="toCreateAppInstanceUser")
    def to_create_app_instance_user(self) -> "Chime":
        '''(experimental) Grants permission to create a user under an Amazon Chime AppInstance.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateAppInstanceUser.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateAppInstanceUser", []))

    @jsii.member(jsii_name="toCreateAttendee")
    def to_create_attendee(self) -> "Chime":
        '''(experimental) Grants permission to create a new attendee for an active Amazon Chime SDK meeting.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateAttendee.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateAttendee", []))

    @jsii.member(jsii_name="toCreateBot")
    def to_create_bot(self) -> "Chime":
        '''(experimental) Grants permission to create a bot for an Amazon Chime Enterprise account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateBot.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateBot", []))

    @jsii.member(jsii_name="toCreateBotMembership")
    def to_create_bot_membership(self) -> "Chime":
        '''(experimental) Grants permission to add a bot to a chat room in your Amazon Chime Enterprise account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateBotMembership.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateBotMembership", []))

    @jsii.member(jsii_name="toCreateCDRBucket")
    def to_create_cdr_bucket(self) -> "Chime":
        '''(experimental) Grants permission to create a new Call Detail Record S3 bucket.

        Access Level: Write

        Dependent actions:

        - s3:CreateBucket
        - s3:ListAllMyBuckets

        https://docs.aws.amazon.com/chime/latest/ag/manage-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateCDRBucket", []))

    @jsii.member(jsii_name="toCreateChannel")
    def to_create_channel(self) -> "Chime":
        '''(experimental) Grants permission to create a channel for an app instance under the AWS account.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateChannel.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateChannel", []))

    @jsii.member(jsii_name="toCreateChannelBan")
    def to_create_channel_ban(self) -> "Chime":
        '''(experimental) Grants permission to ban a user from a channel.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateChannelBan.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateChannelBan", []))

    @jsii.member(jsii_name="toCreateChannelMembership")
    def to_create_channel_membership(self) -> "Chime":
        '''(experimental) Grants permission to add a user to a channel.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateChannelMembership.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateChannelMembership", []))

    @jsii.member(jsii_name="toCreateChannelModerator")
    def to_create_channel_moderator(self) -> "Chime":
        '''(experimental) Grants permission to create a channel moderator.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateChannelModerator.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateChannelModerator", []))

    @jsii.member(jsii_name="toCreateMeeting")
    def to_create_meeting(self) -> "Chime":
        '''(experimental) Grants permission to create a new Amazon Chime SDK meeting in the specified media Region, with no initial attendees.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateMeeting.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateMeeting", []))

    @jsii.member(jsii_name="toCreateMeetingDialOut")
    def to_create_meeting_dial_out(self) -> "Chime":
        '''(experimental) Grants permission to call a phone number to join the specified Amazon Chime SDK meeting.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateMeetingDialOut.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateMeetingDialOut", []))

    @jsii.member(jsii_name="toCreateMeetingWithAttendees")
    def to_create_meeting_with_attendees(self) -> "Chime":
        '''(experimental) Grants permission to create a new Amazon Chime SDK meeting in the specified media Region, with a set of attendees.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateMeetingWithAttendees.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateMeetingWithAttendees", []))

    @jsii.member(jsii_name="toCreatePhoneNumberOrder")
    def to_create_phone_number_order(self) -> "Chime":
        '''(experimental) Grants permission to create a phone number order with the Carriers.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreatePhoneNumberOrder.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreatePhoneNumberOrder", []))

    @jsii.member(jsii_name="toCreateProxySession")
    def to_create_proxy_session(self) -> "Chime":
        '''(experimental) Grants permission to create a proxy session for the specified Amazon Chime Voice Connector.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateProxySession.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateProxySession", []))

    @jsii.member(jsii_name="toCreateRoom")
    def to_create_room(self) -> "Chime":
        '''(experimental) Grants permission to create a room.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateRoom.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateRoom", []))

    @jsii.member(jsii_name="toCreateRoomMembership")
    def to_create_room_membership(self) -> "Chime":
        '''(experimental) Grants permission to add a room member.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateRoomMembership.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateRoomMembership", []))

    @jsii.member(jsii_name="toCreateSipMediaApplication")
    def to_create_sip_media_application(self) -> "Chime":
        '''(experimental) Grants permission to create an Amazon Chime SIP media application under the administrator's AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateSipMediaApplication.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateSipMediaApplication", []))

    @jsii.member(jsii_name="toCreateSipMediaApplicationCall")
    def to_create_sip_media_application_call(self) -> "Chime":
        '''(experimental) Grants permission to create outbound call for Amazon Chime SIP media application under the administrator's AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateSipMediaApplicationCall.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateSipMediaApplicationCall", []))

    @jsii.member(jsii_name="toCreateSipRule")
    def to_create_sip_rule(self) -> "Chime":
        '''(experimental) Grants permission to create an Amazon Chime SIP rule under the administrator's AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateSipRule.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateSipRule", []))

    @jsii.member(jsii_name="toCreateUser")
    def to_create_user(self) -> "Chime":
        '''(experimental) Grants permission to create a user under the specified Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateUser.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateUser", []))

    @jsii.member(jsii_name="toCreateVoiceConnector")
    def to_create_voice_connector(self) -> "Chime":
        '''(experimental) Grants permission to create a Amazon Chime Voice Connector under the administrator's AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateVoiceConnector.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateVoiceConnector", []))

    @jsii.member(jsii_name="toCreateVoiceConnectorGroup")
    def to_create_voice_connector_group(self) -> "Chime":
        '''(experimental) Grants permission to create a Amazon Chime Voice Connector Group under the administrator's AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateVoiceConnectorGroup.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateVoiceConnectorGroup", []))

    @jsii.member(jsii_name="toDeleteAccount")
    def to_delete_account(self) -> "Chime":
        '''(experimental) Grants permission to delete the specified Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteAccount.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteAccount", []))

    @jsii.member(jsii_name="toDeleteAccountOpenIdConfig")
    def to_delete_account_open_id_config(self) -> "Chime":
        '''(experimental) Grants permission to delete the OpenIdConfig attributes from your Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/okta_sso.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteAccountOpenIdConfig", []))

    @jsii.member(jsii_name="toDeleteApiKey")
    def to_delete_api_key(self) -> "Chime":
        '''(experimental) Grants permission to delete the specified SCIM access key associated with your Amazon Chime account and Okta configuration.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/okta_sso.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteApiKey", []))

    @jsii.member(jsii_name="toDeleteAppInstance")
    def to_delete_app_instance(self) -> "Chime":
        '''(experimental) Grants permission to delete an AppInstance.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteAppInstance.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteAppInstance", []))

    @jsii.member(jsii_name="toDeleteAppInstanceAdmin")
    def to_delete_app_instance_admin(self) -> "Chime":
        '''(experimental) Grants permission to demote an AppInstanceAdmin to an AppInstanceUser.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteAppInstanceAdmin.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteAppInstanceAdmin", []))

    @jsii.member(jsii_name="toDeleteAppInstanceStreamingConfigurations")
    def to_delete_app_instance_streaming_configurations(self) -> "Chime":
        '''(experimental) Grants permission to disable data streaming for the app instance.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteAppInstanceStreamingConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteAppInstanceStreamingConfigurations", []))

    @jsii.member(jsii_name="toDeleteAppInstanceUser")
    def to_delete_app_instance_user(self) -> "Chime":
        '''(experimental) Grants permission to delete an AppInstanceUser.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteAppInstanceUser.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteAppInstanceUser", []))

    @jsii.member(jsii_name="toDeleteAttendee")
    def to_delete_attendee(self) -> "Chime":
        '''(experimental) Grants permission to delete the specified attendee from an Amazon Chime SDK meeting.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteAttendee.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteAttendee", []))

    @jsii.member(jsii_name="toDeleteCDRBucket")
    def to_delete_cdr_bucket(self) -> "Chime":
        '''(experimental) Grants permission to delete a Call Detail Record S3 bucket from your Amazon Chime account.

        Access Level: Write

        Dependent actions:

        - s3:DeleteBucket

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteCDRBucket", []))

    @jsii.member(jsii_name="toDeleteChannel")
    def to_delete_channel(self) -> "Chime":
        '''(experimental) Grants permission to delete a channel.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteChannel.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteChannel", []))

    @jsii.member(jsii_name="toDeleteChannelBan")
    def to_delete_channel_ban(self) -> "Chime":
        '''(experimental) Grants permission to remove a user from a channel's ban list.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteChannelBan.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteChannelBan", []))

    @jsii.member(jsii_name="toDeleteChannelMembership")
    def to_delete_channel_membership(self) -> "Chime":
        '''(experimental) Grants permission to remove a member from a channel.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteChannelMembership.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteChannelMembership", []))

    @jsii.member(jsii_name="toDeleteChannelMessage")
    def to_delete_channel_message(self) -> "Chime":
        '''(experimental) Grants permission to delete a channel message.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteChannelMessage.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteChannelMessage", []))

    @jsii.member(jsii_name="toDeleteChannelModerator")
    def to_delete_channel_moderator(self) -> "Chime":
        '''(experimental) Grants permission to delete a channel moderator.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteChannelModerator.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteChannelModerator", []))

    @jsii.member(jsii_name="toDeleteDelegate")
    def to_delete_delegate(self) -> "Chime":
        '''(experimental) Grants permission to delete delegated AWS account management from your Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteDelegate", []))

    @jsii.member(jsii_name="toDeleteDomain")
    def to_delete_domain(self) -> "Chime":
        '''(experimental) Grants permission to delete a domain from your Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/claim-domain.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteDomain", []))

    @jsii.member(jsii_name="toDeleteEventsConfiguration")
    def to_delete_events_configuration(self) -> "Chime":
        '''(experimental) Grants permission to delete an events configuration for a bot to receive outgoing events.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteEventsConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteEventsConfiguration", []))

    @jsii.member(jsii_name="toDeleteGroups")
    def to_delete_groups(self) -> "Chime":
        '''(experimental) Grants permission to delete Active Directory or Okta user groups from your Amazon Chime Enterprise account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteGroups", []))

    @jsii.member(jsii_name="toDeleteMeeting")
    def to_delete_meeting(self) -> "Chime":
        '''(experimental) Grants permission to delete the specified Amazon Chime SDK meeting.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteMeeting.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteMeeting", []))

    @jsii.member(jsii_name="toDeletePhoneNumber")
    def to_delete_phone_number(self) -> "Chime":
        '''(experimental) Grants permission to move a phone number to the deletion queue.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeletePhoneNumber.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeletePhoneNumber", []))

    @jsii.member(jsii_name="toDeleteProxySession")
    def to_delete_proxy_session(self) -> "Chime":
        '''(experimental) Grants permission to delete a proxy session for the specified Amazon Chime Voice Connector.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteProxySession.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteProxySession", []))

    @jsii.member(jsii_name="toDeleteRoom")
    def to_delete_room(self) -> "Chime":
        '''(experimental) Grants permission to delete a room.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteRoom.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteRoom", []))

    @jsii.member(jsii_name="toDeleteRoomMembership")
    def to_delete_room_membership(self) -> "Chime":
        '''(experimental) Grants permission to remove a room member.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteRoomMembership.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteRoomMembership", []))

    @jsii.member(jsii_name="toDeleteSipMediaApplication")
    def to_delete_sip_media_application(self) -> "Chime":
        '''(experimental) Grants permission to delete Amazon Chime SIP media application under the administrator's AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteSipMediaApplication.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteSipMediaApplication", []))

    @jsii.member(jsii_name="toDeleteSipRule")
    def to_delete_sip_rule(self) -> "Chime":
        '''(experimental) Grants permission to delete Amazon Chime SIP rule under the administrator's AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteSipRule.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteSipRule", []))

    @jsii.member(jsii_name="toDeleteVoiceConnector")
    def to_delete_voice_connector(self) -> "Chime":
        '''(experimental) Grants permission to delete the specified Amazon Chime Voice Connector.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteVoiceConnector.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteVoiceConnector", []))

    @jsii.member(jsii_name="toDeleteVoiceConnectorEmergencyCallingConfiguration")
    def to_delete_voice_connector_emergency_calling_configuration(self) -> "Chime":
        '''(experimental) Grants permission to delete emergency calling configuration for the specified Amazon Chime Voice Connector.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteVoiceConnectorEmergencyCallingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteVoiceConnectorEmergencyCallingConfiguration", []))

    @jsii.member(jsii_name="toDeleteVoiceConnectorGroup")
    def to_delete_voice_connector_group(self) -> "Chime":
        '''(experimental) Grants permission to delete the specified Amazon Chime Voice Connector Group.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteVoiceConnectorGroup.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteVoiceConnectorGroup", []))

    @jsii.member(jsii_name="toDeleteVoiceConnectorOrigination")
    def to_delete_voice_connector_origination(self) -> "Chime":
        '''(experimental) Grants permission to delete the origination settings for the specified Amazon Chime Voice Connector.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteVoiceConnectorOrigination.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteVoiceConnectorOrigination", []))

    @jsii.member(jsii_name="toDeleteVoiceConnectorProxy")
    def to_delete_voice_connector_proxy(self) -> "Chime":
        '''(experimental) Grants permission to delete proxy configuration for the specified Amazon Chime Voice Connector.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteVoiceConnectorProxy.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteVoiceConnectorProxy", []))

    @jsii.member(jsii_name="toDeleteVoiceConnectorStreamingConfiguration")
    def to_delete_voice_connector_streaming_configuration(self) -> "Chime":
        '''(experimental) Grants permission to delete streaming configuration for the specified Amazon Chime Voice Connector.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteVoiceConnectorStreamingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteVoiceConnectorStreamingConfiguration", []))

    @jsii.member(jsii_name="toDeleteVoiceConnectorTermination")
    def to_delete_voice_connector_termination(self) -> "Chime":
        '''(experimental) Grants permission to delete the termination settings for the specified Amazon Chime Voice Connector.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteVoiceConnectorTermination.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteVoiceConnectorTermination", []))

    @jsii.member(jsii_name="toDeleteVoiceConnectorTerminationCredentials")
    def to_delete_voice_connector_termination_credentials(self) -> "Chime":
        '''(experimental) Grants permission to delete SIP termination credentials for the specified Amazon Chime Voice Connector.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteVoiceConnectorTerminationCredentials.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteVoiceConnectorTerminationCredentials", []))

    @jsii.member(jsii_name="toDescribeAppInstance")
    def to_describe_app_instance(self) -> "Chime":
        '''(experimental) Grants permission to get the full details of an AppInstance.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DescribeAppInstance.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDescribeAppInstance", []))

    @jsii.member(jsii_name="toDescribeAppInstanceAdmin")
    def to_describe_app_instance_admin(self) -> "Chime":
        '''(experimental) Grants permission to get the full details of an AppInstanceAdmin.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DescribeAppInstanceAdmin.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDescribeAppInstanceAdmin", []))

    @jsii.member(jsii_name="toDescribeAppInstanceUser")
    def to_describe_app_instance_user(self) -> "Chime":
        '''(experimental) Grants permission to get the full details of an AppInstanceUser.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DescribeAppInstanceUser.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDescribeAppInstanceUser", []))

    @jsii.member(jsii_name="toDescribeChannel")
    def to_describe_channel(self) -> "Chime":
        '''(experimental) Grants permission to get the full details of a channel.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DescribeChannel.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDescribeChannel", []))

    @jsii.member(jsii_name="toDescribeChannelBan")
    def to_describe_channel_ban(self) -> "Chime":
        '''(experimental) Grants permission to get the full details of a channel ban.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DescribeChannelBan.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDescribeChannelBan", []))

    @jsii.member(jsii_name="toDescribeChannelMembership")
    def to_describe_channel_membership(self) -> "Chime":
        '''(experimental) Grants permission to get the full details of a channel membership.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DescribeChannelMembership.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDescribeChannelMembership", []))

    @jsii.member(jsii_name="toDescribeChannelMembershipForAppInstanceUser")
    def to_describe_channel_membership_for_app_instance_user(self) -> "Chime":
        '''(experimental) Grants permission to get the details of a channel based on the membership of the specified AppInstanceUser.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DescribeChannelMembershipForAppInstanceUser.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDescribeChannelMembershipForAppInstanceUser", []))

    @jsii.member(jsii_name="toDescribeChannelModeratedByAppInstanceUser")
    def to_describe_channel_moderated_by_app_instance_user(self) -> "Chime":
        '''(experimental) Grants permission to get the full details of a channel moderated by the specified AppInstanceUser.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DescribeChannelModeratedByAppInstanceUser.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDescribeChannelModeratedByAppInstanceUser", []))

    @jsii.member(jsii_name="toDescribeChannelModerator")
    def to_describe_channel_moderator(self) -> "Chime":
        '''(experimental) Grants permission to get the full details of a single ChannelModerator.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DescribeChannelModerator.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDescribeChannelModerator", []))

    @jsii.member(jsii_name="toDisassociatePhoneNumberFromUser")
    def to_disassociate_phone_number_from_user(self) -> "Chime":
        '''(experimental) Grants permission to disassociate the primary provisioned number from the specified Amazon Chime user.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DisassociatePhoneNumberFromUser.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDisassociatePhoneNumberFromUser", []))

    @jsii.member(jsii_name="toDisassociatePhoneNumbersFromVoiceConnector")
    def to_disassociate_phone_numbers_from_voice_connector(self) -> "Chime":
        '''(experimental) Grants permission to disassociate multiple phone numbers from the specified Amazon Chime Voice Connector.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DisassociatePhoneNumbersFromVoiceConnector.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDisassociatePhoneNumbersFromVoiceConnector", []))

    @jsii.member(jsii_name="toDisassociatePhoneNumbersFromVoiceConnectorGroup")
    def to_disassociate_phone_numbers_from_voice_connector_group(self) -> "Chime":
        '''(experimental) Grants permission to disassociate multiple phone numbers from the specified Amazon Chime Voice Connector Group.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DisassociatePhoneNumbersFromVoiceConnectorGroup.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDisassociatePhoneNumbersFromVoiceConnectorGroup", []))

    @jsii.member(jsii_name="toDisassociateSigninDelegateGroupsFromAccount")
    def to_disassociate_signin_delegate_groups_from_account(self) -> "Chime":
        '''(experimental) Grants permission to disassociate the specified sign-in delegate groups from the specified Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DisassociateSigninDelegateGroupsFromAccount.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDisassociateSigninDelegateGroupsFromAccount", []))

    @jsii.member(jsii_name="toDisconnectDirectory")
    def to_disconnect_directory(self) -> "Chime":
        '''(experimental) Grants permission to disconnect the Active Directory from your Amazon Chime Enterprise account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDisconnectDirectory", []))

    @jsii.member(jsii_name="toGetAccount")
    def to_get_account(self) -> "Chime":
        '''(experimental) Grants permission to get details for the specified Amazon Chime account.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetAccount.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetAccount", []))

    @jsii.member(jsii_name="toGetAccountResource")
    def to_get_account_resource(self) -> "Chime":
        '''(experimental) Grants permission to get details for the account resource associated with your Amazon Chime account.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetAccountResource", []))

    @jsii.member(jsii_name="toGetAccountSettings")
    def to_get_account_settings(self) -> "Chime":
        '''(experimental) Grants permission to get account settings for the specified Amazon Chime account ID.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetAccountSettings.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetAccountSettings", []))

    @jsii.member(jsii_name="toGetAccountWithOpenIdConfig")
    def to_get_account_with_open_id_config(self) -> "Chime":
        '''(experimental) Grants permission to get the account details and OpenIdConfig attributes for your Amazon Chime account.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/ag/okta_sso.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetAccountWithOpenIdConfig", []))

    @jsii.member(jsii_name="toGetAppInstanceRetentionSettings")
    def to_get_app_instance_retention_settings(self) -> "Chime":
        '''(experimental) Grants permission to get retention settings for an app instance.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetAppInstanceRetentionSettings.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetAppInstanceRetentionSettings", []))

    @jsii.member(jsii_name="toGetAppInstanceStreamingConfigurations")
    def to_get_app_instance_streaming_configurations(self) -> "Chime":
        '''(experimental) Grants permission to get the streaming configurations for an app instance.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetAppInstanceStreamingConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetAppInstanceStreamingConfigurations", []))

    @jsii.member(jsii_name="toGetAttendee")
    def to_get_attendee(self) -> "Chime":
        '''(experimental) Grants permission to get attendee details for a specified meeting ID and attendee ID.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetAttendee.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetAttendee", []))

    @jsii.member(jsii_name="toGetBot")
    def to_get_bot(self) -> "Chime":
        '''(experimental) Grants permission to retrieve details for the specified bot.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetBot.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetBot", []))

    @jsii.member(jsii_name="toGetCDRBucket")
    def to_get_cdr_bucket(self) -> "Chime":
        '''(experimental) Grants permission to get details of a Call Detail Record S3 bucket associated with your Amazon Chime account.

        Access Level: Read

        Dependent actions:

        - s3:GetBucketAcl
        - s3:GetBucketLocation
        - s3:GetBucketLogging
        - s3:GetBucketVersioning
        - s3:GetBucketWebsite

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetCDRBucket", []))

    @jsii.member(jsii_name="toGetChannelMessage")
    def to_get_channel_message(self) -> "Chime":
        '''(experimental) Grants permission to get the full details of a channel message.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetChannelMessage.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetChannelMessage", []))

    @jsii.member(jsii_name="toGetDomain")
    def to_get_domain(self) -> "Chime":
        '''(experimental) Grants permission to get domain details for a domain associated with your Amazon Chime account.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/ag/claim-domain.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetDomain", []))

    @jsii.member(jsii_name="toGetEventsConfiguration")
    def to_get_events_configuration(self) -> "Chime":
        '''(experimental) Grants permission to retrieve details for an events configuration for a bot to receive outgoing events.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetEventsConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetEventsConfiguration", []))

    @jsii.member(jsii_name="toGetGlobalSettings")
    def to_get_global_settings(self) -> "Chime":
        '''(experimental) Grants permission to get global settings related to Amazon Chime for the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetGlobalSettings.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetGlobalSettings", []))

    @jsii.member(jsii_name="toGetMeeting")
    def to_get_meeting(self) -> "Chime":
        '''(experimental) Grants permission to get the meeting record for a specified meeting ID.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetMeeting.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetMeeting", []))

    @jsii.member(jsii_name="toGetMeetingDetail")
    def to_get_meeting_detail(self) -> "Chime":
        '''(experimental) Grants permission to get attendee, connection, and other details for a meeting.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetMeetingDetail", []))

    @jsii.member(jsii_name="toGetMessagingSessionEndpoint")
    def to_get_messaging_session_endpoint(self) -> "Chime":
        '''(experimental) Grants permission to get the endpoint for the messaging session.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetMessagingSessionEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetMessagingSessionEndpoint", []))

    @jsii.member(jsii_name="toGetPhoneNumber")
    def to_get_phone_number(self) -> "Chime":
        '''(experimental) Grants permission to get details for the specified phone number.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetPhoneNumber.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetPhoneNumber", []))

    @jsii.member(jsii_name="toGetPhoneNumberOrder")
    def to_get_phone_number_order(self) -> "Chime":
        '''(experimental) Grants permission to get details for the specified phone number order.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetPhoneNumberOrder.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetPhoneNumberOrder", []))

    @jsii.member(jsii_name="toGetPhoneNumberSettings")
    def to_get_phone_number_settings(self) -> "Chime":
        '''(experimental) Grants permission to get phone number settings related to Amazon Chime for the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetPhoneNumberSettings.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetPhoneNumberSettings", []))

    @jsii.member(jsii_name="toGetProxySession")
    def to_get_proxy_session(self) -> "Chime":
        '''(experimental) Grants permission to get details of the specified proxy session for the specified Amazon Chime Voice Connector.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetProxySession.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetProxySession", []))

    @jsii.member(jsii_name="toGetRetentionSettings")
    def to_get_retention_settings(self) -> "Chime":
        '''(experimental) Gets the retention settings for the specified Amazon Chime account.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetRetentionSettings.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetRetentionSettings", []))

    @jsii.member(jsii_name="toGetRoom")
    def to_get_room(self) -> "Chime":
        '''(experimental) Grants permission to retrieve a room.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetRoom.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetRoom", []))

    @jsii.member(jsii_name="toGetSipMediaApplication")
    def to_get_sip_media_application(self) -> "Chime":
        '''(experimental) Grants permission to get details of Amazon Chime SIP media application under the administrator's AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetSipMediaApplication.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetSipMediaApplication", []))

    @jsii.member(jsii_name="toGetSipMediaApplicationLoggingConfiguration")
    def to_get_sip_media_application_logging_configuration(self) -> "Chime":
        '''(experimental) Grants permission to get logging configuration settings for Amazon Chime SIP media application under the administrator's AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetSipMediaApplicationLoggingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetSipMediaApplicationLoggingConfiguration", []))

    @jsii.member(jsii_name="toGetSipRule")
    def to_get_sip_rule(self) -> "Chime":
        '''(experimental) Grants permission to get details of Amazon Chime SIP rule under the administrator's AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetSipRule.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetSipRule", []))

    @jsii.member(jsii_name="toGetTelephonyLimits")
    def to_get_telephony_limits(self) -> "Chime":
        '''(experimental) Grants permission to get telephony limits for the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/ag/phone-numbers.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetTelephonyLimits", []))

    @jsii.member(jsii_name="toGetUser")
    def to_get_user(self) -> "Chime":
        '''(experimental) Grants permission to get details for the specified user ID.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetUser.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetUser", []))

    @jsii.member(jsii_name="toGetUserActivityReportData")
    def to_get_user_activity_report_data(self) -> "Chime":
        '''(experimental) Grants permission to get a summary of user activity on the user details page.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/ag/user-details.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetUserActivityReportData", []))

    @jsii.member(jsii_name="toGetUserByEmail")
    def to_get_user_by_email(self) -> "Chime":
        '''(experimental) Grants permission to get user details for an Amazon Chime user based on the email address in an Amazon Chime Enterprise or Team account.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/ag/user-details.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetUserByEmail", []))

    @jsii.member(jsii_name="toGetUserSettings")
    def to_get_user_settings(self) -> "Chime":
        '''(experimental) Grants permission to get user settings related to the specified Amazon Chime user.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetUserSettings.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetUserSettings", []))

    @jsii.member(jsii_name="toGetVoiceConnector")
    def to_get_voice_connector(self) -> "Chime":
        '''(experimental) Grants permission to get details for the specified Amazon Chime Voice Connector.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetVoiceConnector.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetVoiceConnector", []))

    @jsii.member(jsii_name="toGetVoiceConnectorEmergencyCallingConfiguration")
    def to_get_voice_connector_emergency_calling_configuration(self) -> "Chime":
        '''(experimental) Grants permission to get details of the emergency calling configuration for the specified Amazon Chime Voice Connector.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetVoiceConnectorEmergencyCallingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetVoiceConnectorEmergencyCallingConfiguration", []))

    @jsii.member(jsii_name="toGetVoiceConnectorGroup")
    def to_get_voice_connector_group(self) -> "Chime":
        '''(experimental) Grants permission to get details for the specified Amazon Chime Voice Connector Group.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetVoiceConnectorGroup.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetVoiceConnectorGroup", []))

    @jsii.member(jsii_name="toGetVoiceConnectorLoggingConfiguration")
    def to_get_voice_connector_logging_configuration(self) -> "Chime":
        '''(experimental) Grants permission to get details of the logging configuration for the specified Amazon Chime Voice Connector.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetVoiceConnectorLoggingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetVoiceConnectorLoggingConfiguration", []))

    @jsii.member(jsii_name="toGetVoiceConnectorOrigination")
    def to_get_voice_connector_origination(self) -> "Chime":
        '''(experimental) Grants permission to get details of the origination settings for the specified Amazon Chime Voice Connector.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetVoiceConnectorOrigination.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetVoiceConnectorOrigination", []))

    @jsii.member(jsii_name="toGetVoiceConnectorProxy")
    def to_get_voice_connector_proxy(self) -> "Chime":
        '''(experimental) Grants permission to get details of the proxy configuration for the specified Amazon Chime Voice Connector.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetVoiceConnectorProxy.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetVoiceConnectorProxy", []))

    @jsii.member(jsii_name="toGetVoiceConnectorStreamingConfiguration")
    def to_get_voice_connector_streaming_configuration(self) -> "Chime":
        '''(experimental) Grants permission to get details of the streaming configuration for the specified Amazon Chime Voice Connector.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetVoiceConnectorStreamingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetVoiceConnectorStreamingConfiguration", []))

    @jsii.member(jsii_name="toGetVoiceConnectorTermination")
    def to_get_voice_connector_termination(self) -> "Chime":
        '''(experimental) Grants permission to get details of the termination settings for the specified Amazon Chime Voice Connector.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetVoiceConnectorTermination.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetVoiceConnectorTermination", []))

    @jsii.member(jsii_name="toGetVoiceConnectorTerminationHealth")
    def to_get_voice_connector_termination_health(self) -> "Chime":
        '''(experimental) Grants permission to get details of the termination health for the specified Amazon Chime Voice Connector.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetVoiceConnectorTerminationHealth.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetVoiceConnectorTerminationHealth", []))

    @jsii.member(jsii_name="toInviteDelegate")
    def to_invite_delegate(self) -> "Chime":
        '''(experimental) Grants permission to send an invitation to accept a request for AWS account delegation for an Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toInviteDelegate", []))

    @jsii.member(jsii_name="toInviteUsers")
    def to_invite_users(self) -> "Chime":
        '''(experimental) Grants permission to invite as many as 50 users to the specified Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_InviteUsers.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toInviteUsers", []))

    @jsii.member(jsii_name="toInviteUsersFromProvider")
    def to_invite_users_from_provider(self) -> "Chime":
        '''(experimental) Grants permission to invite users from a third party provider to your Amazon Chime account.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toInviteUsersFromProvider", []))

    @jsii.member(jsii_name="toListAccounts")
    def to_list_accounts(self) -> "Chime":
        '''(experimental) Grants permission to list the Amazon Chime accounts under the administrator's AWS account.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListAccounts.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListAccounts", []))

    @jsii.member(jsii_name="toListAccountUsageReportData")
    def to_list_account_usage_report_data(self) -> "Chime":
        '''(experimental) Grants permission to list Amazon Chime account usage reporting data.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/ag/view-reports.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListAccountUsageReportData", []))

    @jsii.member(jsii_name="toListApiKeys")
    def to_list_api_keys(self) -> "Chime":
        '''(experimental) Grants permission to list the SCIM access keys defined for your Amazon Chime account and Okta configuration.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/ag/okta_sso.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListApiKeys", []))

    @jsii.member(jsii_name="toListAppInstanceAdmins")
    def to_list_app_instance_admins(self) -> "Chime":
        '''(experimental) Grants permission to list administrators in the app instance.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListAppInstanceAdmins.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListAppInstanceAdmins", []))

    @jsii.member(jsii_name="toListAppInstances")
    def to_list_app_instances(self) -> "Chime":
        '''(experimental) Grants permission to list all Amazon Chime app instances created under a single AWS account.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListAppInstances.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListAppInstances", []))

    @jsii.member(jsii_name="toListAppInstanceUsers")
    def to_list_app_instance_users(self) -> "Chime":
        '''(experimental) Grants permission to list all AppInstanceUsers created under a single app instance.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListAppInstanceUsers.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListAppInstanceUsers", []))

    @jsii.member(jsii_name="toListAttendees")
    def to_list_attendees(self) -> "Chime":
        '''(experimental) Grants permission to list up to 100 attendees for a specified Amazon Chime SDK meeting.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListAttendees.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListAttendees", []))

    @jsii.member(jsii_name="toListAttendeeTags")
    def to_list_attendee_tags(self) -> "Chime":
        '''(experimental) Grants permission to list the tags applied to an Amazon Chime SDK attendee resource.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListAttendeeTags.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListAttendeeTags", []))

    @jsii.member(jsii_name="toListBots")
    def to_list_bots(self) -> "Chime":
        '''(experimental) Grants permission to list the bots associated with the administrator's Amazon Chime Enterprise account.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListBots.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListBots", []))

    @jsii.member(jsii_name="toListCallingRegions")
    def to_list_calling_regions(self) -> "Chime":
        '''(experimental) Grants permission to list the calling regions available for the administrator's AWS account.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/ag/phone-numbers.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListCallingRegions", []))

    @jsii.member(jsii_name="toListCDRBucket")
    def to_list_cdr_bucket(self) -> "Chime":
        '''(experimental) Grants permission to list Call Detail Record S3 buckets.

        Access Level: List

        Dependent actions:

        - s3:ListAllMyBuckets
        - s3:ListBucket

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListCDRBucket", []))

    @jsii.member(jsii_name="toListChannelBans")
    def to_list_channel_bans(self) -> "Chime":
        '''(experimental) Grants permission to list all the users banned from a particular channel.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListChannelBans.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListChannelBans", []))

    @jsii.member(jsii_name="toListChannelMemberships")
    def to_list_channel_memberships(self) -> "Chime":
        '''(experimental) Grants permission to list all channel memberships in a channel.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListChannelMemberships.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListChannelMemberships", []))

    @jsii.member(jsii_name="toListChannelMembershipsForAppInstanceUser")
    def to_list_channel_memberships_for_app_instance_user(self) -> "Chime":
        '''(experimental) Grants permission to list all channels that a particular AppInstanceUser is a part of.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListChannelMembershipsForAppInstanceUser.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListChannelMembershipsForAppInstanceUser", []))

    @jsii.member(jsii_name="toListChannelMessages")
    def to_list_channel_messages(self) -> "Chime":
        '''(experimental) Grants permission to list all the messages in a channel.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListChannelMessages.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListChannelMessages", []))

    @jsii.member(jsii_name="toListChannelModerators")
    def to_list_channel_moderators(self) -> "Chime":
        '''(experimental) Grants permission to list all the moderators for a channel.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListChannelModerators.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListChannelModerators", []))

    @jsii.member(jsii_name="toListChannels")
    def to_list_channels(self) -> "Chime":
        '''(experimental) Grants permission to list all the Channels created under a single Chime AppInstance.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListChannels.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListChannels", []))

    @jsii.member(jsii_name="toListChannelsModeratedByAppInstanceUser")
    def to_list_channels_moderated_by_app_instance_user(self) -> "Chime":
        '''(experimental) Grants permission to list all channels moderated by an app instance user.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListChannelsModeratedByAppInstanceUser.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListChannelsModeratedByAppInstanceUser", []))

    @jsii.member(jsii_name="toListDelegates")
    def to_list_delegates(self) -> "Chime":
        '''(experimental) Grants permission to list account delegate information associated with your Amazon Chime account.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListDelegates", []))

    @jsii.member(jsii_name="toListDirectories")
    def to_list_directories(self) -> "Chime":
        '''(experimental) Grants permission to list active Active Directories hosted in the Directory Service of your AWS account.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListDirectories", []))

    @jsii.member(jsii_name="toListDomains")
    def to_list_domains(self) -> "Chime":
        '''(experimental) Grants permission to list domains associated with your Amazon Chime account.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/ag/claim-domain.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListDomains", []))

    @jsii.member(jsii_name="toListGroups")
    def to_list_groups(self) -> "Chime":
        '''(experimental) Grants permission to list Active Directory or Okta user groups associated with your Amazon Chime Enterprise account.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListGroups", []))

    @jsii.member(jsii_name="toListMeetingEvents")
    def to_list_meeting_events(self) -> "Chime":
        '''(experimental) Grants permission to list all events that occurred for a specified meeting.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/ag/view-reports.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListMeetingEvents", []))

    @jsii.member(jsii_name="toListMeetings")
    def to_list_meetings(self) -> "Chime":
        '''(experimental) Grants permission to list up to 100 active Amazon Chime SDK meetings.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListMeetings.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListMeetings", []))

    @jsii.member(jsii_name="toListMeetingsReportData")
    def to_list_meetings_report_data(self) -> "Chime":
        '''(experimental) Grants permission to list meetings ended during the specified date range.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/ag/view-reports.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListMeetingsReportData", []))

    @jsii.member(jsii_name="toListMeetingTags")
    def to_list_meeting_tags(self) -> "Chime":
        '''(experimental) Grants permission to list the tags applied to an Amazon Chime SDK meeting resource.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListMeetingTags.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListMeetingTags", []))

    @jsii.member(jsii_name="toListPhoneNumberOrders")
    def to_list_phone_number_orders(self) -> "Chime":
        '''(experimental) Grants permission to list the phone number orders under the administrator's AWS account.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListPhoneNumberOrders.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListPhoneNumberOrders", []))

    @jsii.member(jsii_name="toListPhoneNumbers")
    def to_list_phone_numbers(self) -> "Chime":
        '''(experimental) Grants permission to list the phone numbers under the administrator's AWS account.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListPhoneNumbers.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListPhoneNumbers", []))

    @jsii.member(jsii_name="toListProxySessions")
    def to_list_proxy_sessions(self) -> "Chime":
        '''(experimental) Grants permission to list proxy sessions for the specified Amazon Chime Voice Connector.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListProxySessions.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListProxySessions", []))

    @jsii.member(jsii_name="toListRoomMemberships")
    def to_list_room_memberships(self) -> "Chime":
        '''(experimental) Grants permission to list all room members.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListRoomMemberships.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListRoomMemberships", []))

    @jsii.member(jsii_name="toListRooms")
    def to_list_rooms(self) -> "Chime":
        '''(experimental) Grants permission to list rooms.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListRooms.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListRooms", []))

    @jsii.member(jsii_name="toListSipMediaApplications")
    def to_list_sip_media_applications(self) -> "Chime":
        '''(experimental) Grants permission to list all Amazon Chime SIP media applications under the administrator's AWS account.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListSipMediaApplications.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListSipMediaApplications", []))

    @jsii.member(jsii_name="toListSipRules")
    def to_list_sip_rules(self) -> "Chime":
        '''(experimental) Grants permission to list all Amazon Chime SIP rules under the administrator's AWS account.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListSipRules.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListSipRules", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Chime":
        '''(experimental) Grants permission to list the tags applied to an Amazon Chime resource.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListUsers")
    def to_list_users(self) -> "Chime":
        '''(experimental) Grants permission to list the users that belong to the specified Amazon Chime account.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListUsers.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListUsers", []))

    @jsii.member(jsii_name="toListVoiceConnectorGroups")
    def to_list_voice_connector_groups(self) -> "Chime":
        '''(experimental) Grants permission to list the Amazon Chime Voice Connector Groups under the administrator's AWS account.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListVoiceConnectorGroups.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListVoiceConnectorGroups", []))

    @jsii.member(jsii_name="toListVoiceConnectors")
    def to_list_voice_connectors(self) -> "Chime":
        '''(experimental) Grants permission to list the Amazon Chime Voice Connectors under the administrator's AWS account.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListVoiceConnectors.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListVoiceConnectors", []))

    @jsii.member(jsii_name="toListVoiceConnectorTerminationCredentials")
    def to_list_voice_connector_termination_credentials(self) -> "Chime":
        '''(experimental) Grants permission to list the SIP termination credentials for the specified Amazon Chime Voice Connector.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListVoiceConnectorTerminationCredentials.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListVoiceConnectorTerminationCredentials", []))

    @jsii.member(jsii_name="toLogoutUser")
    def to_logout_user(self) -> "Chime":
        '''(experimental) Grants permission to log out the specified user from all of the devices they are currently logged into.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_LogoutUser.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toLogoutUser", []))

    @jsii.member(jsii_name="toPutAppInstanceRetentionSettings")
    def to_put_app_instance_retention_settings(self) -> "Chime":
        '''(experimental) Grants permission to enable data retention for the app instance.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_PutAppInstanceRetentionSettings.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toPutAppInstanceRetentionSettings", []))

    @jsii.member(jsii_name="toPutAppInstanceStreamingConfigurations")
    def to_put_app_instance_streaming_configurations(self) -> "Chime":
        '''(experimental) Grants permission to configure data streaming for the app instance.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_PutAppInstanceStreamingConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toPutAppInstanceStreamingConfigurations", []))

    @jsii.member(jsii_name="toPutEventsConfiguration")
    def to_put_events_configuration(self) -> "Chime":
        '''(experimental) Grants permission to update details for an events configuration for a bot to receive outgoing events.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_PutEventsConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toPutEventsConfiguration", []))

    @jsii.member(jsii_name="toPutRetentionSettings")
    def to_put_retention_settings(self) -> "Chime":
        '''(experimental) Puts retention settings for the specified Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_PutRetentionSettings.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toPutRetentionSettings", []))

    @jsii.member(jsii_name="toPutSipMediaApplicationLoggingConfiguration")
    def to_put_sip_media_application_logging_configuration(self) -> "Chime":
        '''(experimental) Grants permission to update logging configuration settings for Amazon Chime SIP media application under the administrator's AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_PutSipMediaApplicationLoggingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toPutSipMediaApplicationLoggingConfiguration", []))

    @jsii.member(jsii_name="toPutVoiceConnectorEmergencyCallingConfiguration")
    def to_put_voice_connector_emergency_calling_configuration(self) -> "Chime":
        '''(experimental) Grants permission to add emergency calling configuration for the specified Amazon Chime Voice Connector.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_PutVoiceConnectorEmergencyCallingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toPutVoiceConnectorEmergencyCallingConfiguration", []))

    @jsii.member(jsii_name="toPutVoiceConnectorLoggingConfiguration")
    def to_put_voice_connector_logging_configuration(self) -> "Chime":
        '''(experimental) Grants permission to add logging configuration for the specified Amazon Chime Voice Connector.

        Access Level: Write

        Dependent actions:

        - logs:CreateLogDelivery
        - logs:CreateLogGroup
        - logs:DeleteLogDelivery
        - logs:DescribeLogGroups
        - logs:GetLogDelivery
        - logs:ListLogDeliveries

        https://docs.aws.amazon.com/chime/latest/APIReference/API_PutVoiceConnectorLoggingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toPutVoiceConnectorLoggingConfiguration", []))

    @jsii.member(jsii_name="toPutVoiceConnectorOrigination")
    def to_put_voice_connector_origination(self) -> "Chime":
        '''(experimental) Grants permission to update the origination settings for the specified Amazon Chime Voice Connector.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_PutVoiceConnectorOrigination.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toPutVoiceConnectorOrigination", []))

    @jsii.member(jsii_name="toPutVoiceConnectorProxy")
    def to_put_voice_connector_proxy(self) -> "Chime":
        '''(experimental) Grants permission to add proxy configuration for the specified Amazon Chime Voice Connector.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_PutVoiceConnectorProxy.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toPutVoiceConnectorProxy", []))

    @jsii.member(jsii_name="toPutVoiceConnectorStreamingConfiguration")
    def to_put_voice_connector_streaming_configuration(self) -> "Chime":
        '''(experimental) Grants permission to add streaming configuration for the specified Amazon Chime Voice Connector.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_PutVoiceConnectorStreamingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toPutVoiceConnectorStreamingConfiguration", []))

    @jsii.member(jsii_name="toPutVoiceConnectorTermination")
    def to_put_voice_connector_termination(self) -> "Chime":
        '''(experimental) Grants permission to update the termination settings for the specified Amazon Chime Voice Connector.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_PutVoiceConnectorTermination.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toPutVoiceConnectorTermination", []))

    @jsii.member(jsii_name="toPutVoiceConnectorTerminationCredentials")
    def to_put_voice_connector_termination_credentials(self) -> "Chime":
        '''(experimental) Grants permission to add SIP termination credentials for the specified Amazon Chime Voice Connector.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_PutVoiceConnectorTerminationCredentials.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toPutVoiceConnectorTerminationCredentials", []))

    @jsii.member(jsii_name="toRedactChannelMessage")
    def to_redact_channel_message(self) -> "Chime":
        '''(experimental) Grants permission to redact message content.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_RedactChannelMessage.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toRedactChannelMessage", []))

    @jsii.member(jsii_name="toRedactConversationMessage")
    def to_redact_conversation_message(self) -> "Chime":
        '''(experimental) Redacts the specified Chime conversation Message.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_RedactConversationMessage.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toRedactConversationMessage", []))

    @jsii.member(jsii_name="toRedactRoomMessage")
    def to_redact_room_message(self) -> "Chime":
        '''(experimental) Redacts the specified Chime room Message.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_RedactRoomMessage.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toRedactRoomMessage", []))

    @jsii.member(jsii_name="toRegenerateSecurityToken")
    def to_regenerate_security_token(self) -> "Chime":
        '''(experimental) Grants permission to regenerate the security token for the specified bot.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_RegenerateSecurityToken.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toRegenerateSecurityToken", []))

    @jsii.member(jsii_name="toRenameAccount")
    def to_rename_account(self) -> "Chime":
        '''(experimental) Grants permission to modify the account name for your Amazon Chime Enterprise or Team account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/rename-account.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toRenameAccount", []))

    @jsii.member(jsii_name="toRenewDelegate")
    def to_renew_delegate(self) -> "Chime":
        '''(experimental) Grants permission to renew the delegation request associated with an Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toRenewDelegate", []))

    @jsii.member(jsii_name="toResetAccountResource")
    def to_reset_account_resource(self) -> "Chime":
        '''(experimental) Grants permission to reset the account resource in your Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toResetAccountResource", []))

    @jsii.member(jsii_name="toResetPersonalPIN")
    def to_reset_personal_pin(self) -> "Chime":
        '''(experimental) Grants permission to reset the personal meeting PIN for the specified user on an Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ResetPersonalPIN.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toResetPersonalPIN", []))

    @jsii.member(jsii_name="toRestorePhoneNumber")
    def to_restore_phone_number(self) -> "Chime":
        '''(experimental) Grants permission to restore the specified phone number from the deltion queue back to the phone number inventory.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_RestorePhoneNumber.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toRestorePhoneNumber", []))

    @jsii.member(jsii_name="toRetrieveDataExports")
    def to_retrieve_data_exports(self) -> "Chime":
        '''(experimental) Grants permission to download the file containing links to all user attachments returned as part of the "Request attachments" action.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/ag/request-attachments.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toRetrieveDataExports", []))

    @jsii.member(jsii_name="toSearchAvailablePhoneNumbers")
    def to_search_available_phone_numbers(self) -> "Chime":
        '''(experimental) Grants permission to search phone numbers that can be ordered from the carrier.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_SearchAvailablePhoneNumbers.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toSearchAvailablePhoneNumbers", []))

    @jsii.member(jsii_name="toSendChannelMessage")
    def to_send_channel_message(self) -> "Chime":
        '''(experimental) Grants permission to send a message to a particular channel that the member is a part of.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_SendChannelMessage.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toSendChannelMessage", []))

    @jsii.member(jsii_name="toStartDataExport")
    def to_start_data_export(self) -> "Chime":
        '''(experimental) Grants permission to submit the "Request attachments" request.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/request-attachments.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toStartDataExport", []))

    @jsii.member(jsii_name="toSubmitSupportRequest")
    def to_submit_support_request(self) -> "Chime":
        '''(experimental) Grants permission to submit a customer service support request.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/chime-getting-admin-support.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toSubmitSupportRequest", []))

    @jsii.member(jsii_name="toSuspendUsers")
    def to_suspend_users(self) -> "Chime":
        '''(experimental) Grants permission to suspend users from an Amazon Chime Enterprise account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/manage-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toSuspendUsers", []))

    @jsii.member(jsii_name="toTagAttendee")
    def to_tag_attendee(self) -> "Chime":
        '''(experimental) Grants permission to apply the specified tags to the specified Amazon Chime SDK attendee.

        Access Level: Tagging

        https://docs.aws.amazon.com/chime/latest/APIReference/API_TagAttendee.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toTagAttendee", []))

    @jsii.member(jsii_name="toTagMeeting")
    def to_tag_meeting(self) -> "Chime":
        '''(experimental) Grants permission to apply the specified tags to the specified Amazon Chime SDK meeting.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/chime/latest/APIReference/API_TagMeeting.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toTagMeeting", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Chime":
        '''(experimental) Grants permission to apply the specified tags to the specified Amazon Chime resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/chime/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUnauthorizeDirectory")
    def to_unauthorize_directory(self) -> "Chime":
        '''(experimental) Grants permission to unauthorize an Active Directory from your Amazon Chime Enterprise account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUnauthorizeDirectory", []))

    @jsii.member(jsii_name="toUntagAttendee")
    def to_untag_attendee(self) -> "Chime":
        '''(experimental) Grants permission to untag the specified tags from the specified Amazon Chime SDK attendee.

        Access Level: Tagging

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UntagAttendee.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUntagAttendee", []))

    @jsii.member(jsii_name="toUntagMeeting")
    def to_untag_meeting(self) -> "Chime":
        '''(experimental) Grants permission to untag the specified tags from the specified Amazon Chime SDK meeting.

        Access Level: Tagging

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UntagMeeting.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUntagMeeting", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Chime":
        '''(experimental) Grants permission to untag the specified tags from the specified Amazon Chime resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAccount")
    def to_update_account(self) -> "Chime":
        '''(experimental) Grants permission to update account details for the specified Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UpdateAccount.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateAccount", []))

    @jsii.member(jsii_name="toUpdateAccountOpenIdConfig")
    def to_update_account_open_id_config(self) -> "Chime":
        '''(experimental) Grants permission to update the OpenIdConfig attributes for your Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/okta_sso.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateAccountOpenIdConfig", []))

    @jsii.member(jsii_name="toUpdateAccountResource")
    def to_update_account_resource(self) -> "Chime":
        '''(experimental) Grants permission to update the account resource in your Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateAccountResource", []))

    @jsii.member(jsii_name="toUpdateAccountSettings")
    def to_update_account_settings(self) -> "Chime":
        '''(experimental) Grants permission to update the settings for the specified Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UpdateAccountSettings.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateAccountSettings", []))

    @jsii.member(jsii_name="toUpdateAppInstance")
    def to_update_app_instance(self) -> "Chime":
        '''(experimental) Grants permission to update AppInstance metadata.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UpdateAppInstance.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateAppInstance", []))

    @jsii.member(jsii_name="toUpdateAppInstanceUser")
    def to_update_app_instance_user(self) -> "Chime":
        '''(experimental) Grants permission to update the details for an AppInstanceUser.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UpdateAppInstanceUser.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateAppInstanceUser", []))

    @jsii.member(jsii_name="toUpdateBot")
    def to_update_bot(self) -> "Chime":
        '''(experimental) Grants permission to update the status of the specified bot.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UpdateBot.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateBot", []))

    @jsii.member(jsii_name="toUpdateCDRSettings")
    def to_update_cdr_settings(self) -> "Chime":
        '''(experimental) Grants permission to update your Call Detail Record S3 bucket.

        Access Level: Write

        Dependent actions:

        - s3:CreateBucket
        - s3:DeleteBucket
        - s3:ListAllMyBuckets

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateCDRSettings", []))

    @jsii.member(jsii_name="toUpdateChannel")
    def to_update_channel(self) -> "Chime":
        '''(experimental) Grants permission to update a channel's attributes.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UpdateChannel.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateChannel", []))

    @jsii.member(jsii_name="toUpdateChannelMessage")
    def to_update_channel_message(self) -> "Chime":
        '''(experimental) Grants permission to update the content of a message.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UpdateChannelMessage.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateChannelMessage", []))

    @jsii.member(jsii_name="toUpdateChannelReadMarker")
    def to_update_channel_read_marker(self) -> "Chime":
        '''(experimental) Grants permission to set the timestamp to the point when a user last read messages in a channel.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UpdateChannelReadMarker.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateChannelReadMarker", []))

    @jsii.member(jsii_name="toUpdateGlobalSettings")
    def to_update_global_settings(self) -> "Chime":
        '''(experimental) Grants permission to update the global settings related to Amazon Chime for the AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UpdateGlobalSettings.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateGlobalSettings", []))

    @jsii.member(jsii_name="toUpdatePhoneNumber")
    def to_update_phone_number(self) -> "Chime":
        '''(experimental) Grants permission to update phone number details for the specified phone number.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UpdatePhoneNumber.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdatePhoneNumber", []))

    @jsii.member(jsii_name="toUpdatePhoneNumberSettings")
    def to_update_phone_number_settings(self) -> "Chime":
        '''(experimental) Grants permission to update phone number settings related to Amazon Chime for the AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UpdatePhoneNumberSettings.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdatePhoneNumberSettings", []))

    @jsii.member(jsii_name="toUpdateProxySession")
    def to_update_proxy_session(self) -> "Chime":
        '''(experimental) Grants permission to update a proxy session for the specified Amazon Chime Voice Connector.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UpdateProxySession.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateProxySession", []))

    @jsii.member(jsii_name="toUpdateRoom")
    def to_update_room(self) -> "Chime":
        '''(experimental) Grants permission to update a room.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UpdateRoom.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateRoom", []))

    @jsii.member(jsii_name="toUpdateRoomMembership")
    def to_update_room_membership(self) -> "Chime":
        '''(experimental) Grants permission to update room membership role.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UpdateRoomMembership.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateRoomMembership", []))

    @jsii.member(jsii_name="toUpdateSipMediaApplication")
    def to_update_sip_media_application(self) -> "Chime":
        '''(experimental) Grants permission to update properties of Amazon Chime SIP media application under the administrator's AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UpdateSipMediaApplication.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateSipMediaApplication", []))

    @jsii.member(jsii_name="toUpdateSipRule")
    def to_update_sip_rule(self) -> "Chime":
        '''(experimental) Grants permission to update properties of Amazon Chime SIP rule under the administrator's AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UpdateSipRule.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateSipRule", []))

    @jsii.member(jsii_name="toUpdateSupportedLicenses")
    def to_update_supported_licenses(self) -> "Chime":
        '''(experimental) Grants permission to update the supported license tiers available for users in your Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/manage-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateSupportedLicenses", []))

    @jsii.member(jsii_name="toUpdateUser")
    def to_update_user(self) -> "Chime":
        '''(experimental) Grants permission to update user details for a specified user ID.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UpdateUser.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateUser", []))

    @jsii.member(jsii_name="toUpdateUserLicenses")
    def to_update_user_licenses(self) -> "Chime":
        '''(experimental) Grants permission to update the licenses for your Amazon Chime users.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/manage-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateUserLicenses", []))

    @jsii.member(jsii_name="toUpdateUserSettings")
    def to_update_user_settings(self) -> "Chime":
        '''(experimental) Grants permission to update user settings related to the specified Amazon Chime user.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UpdateUserSettings.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateUserSettings", []))

    @jsii.member(jsii_name="toUpdateVoiceConnector")
    def to_update_voice_connector(self) -> "Chime":
        '''(experimental) Grants permission to update Amazon Chime Voice Connector details for the specified Amazon Chime Voice Connector.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UpdateVoiceConnector.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateVoiceConnector", []))

    @jsii.member(jsii_name="toUpdateVoiceConnectorGroup")
    def to_update_voice_connector_group(self) -> "Chime":
        '''(experimental) Grants permission to update Amazon Chime Voice Connector Group details for the specified Amazon Chime Voice Connector Group.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UpdateVoiceConnectorGroup.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateVoiceConnectorGroup", []))

    @jsii.member(jsii_name="toValidateAccountResource")
    def to_validate_account_resource(self) -> "Chime":
        '''(experimental) Grants permission to validate the account resource in your Amazon Chime account.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toValidateAccountResource", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Cloud9(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Cloud9"):
    '''(experimental) Statement provider for service `cloud9 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscloud9.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `cloud9 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscloud9.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Cloud9, self, [sid])

    @jsii.member(jsii_name="ifEnvironmentId")
    def if_environment_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Cloud9":
        '''(experimental) Filters access by the AWS Cloud9 environment ID.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awscloud9.html#awscloud9-cloud9_EnvironmentId

        Applies to actions:

        - .toCreateEnvironmentMembership()
        - .toDescribeEnvironmentMemberships()
        - .toUpdateEnvironmentMembership()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "ifEnvironmentId", [value, operator]))

    @jsii.member(jsii_name="ifEnvironmentName")
    def if_environment_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Cloud9":
        '''(experimental) Filters access by the AWS Cloud9 environment name.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awscloud9.html#awscloud9-cloud9_EnvironmentName

        Applies to actions:

        - .toCreateEnvironmentEC2()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "ifEnvironmentName", [value, operator]))

    @jsii.member(jsii_name="ifInstanceType")
    def if_instance_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Cloud9":
        '''(experimental) Filters access by the instance type of the AWS Cloud9 environment's Amazon EC2 instance.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awscloud9.html#awscloud9-cloud9_InstanceType

        Applies to actions:

        - .toCreateEnvironmentEC2()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "ifInstanceType", [value, operator]))

    @jsii.member(jsii_name="ifPermissions")
    def if_permissions(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Cloud9":
        '''(experimental) Filters access by the type of AWS Cloud9 permissions.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awscloud9.html#awscloud9-cloud9_Permissions

        Applies to actions:

        - .toCreateEnvironmentMembership()
        - .toUpdateEnvironmentMembership()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "ifPermissions", [value, operator]))

    @jsii.member(jsii_name="ifSubnetId")
    def if_subnet_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Cloud9":
        '''(experimental) Filters access by the subnet ID that the AWS Cloud9 environment will be created in.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awscloud9.html#awscloud9-cloud9_SubnetId

        Applies to actions:

        - .toCreateEnvironmentEC2()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "ifSubnetId", [value, operator]))

    @jsii.member(jsii_name="ifUserArn")
    def if_user_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Cloud9":
        '''(experimental) Filters access by the user ARN specified.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awscloud9.html#awscloud9-cloud9_UserArn

        Applies to actions:

        - .toCreateEnvironmentEC2()
        - .toCreateEnvironmentMembership()
        - .toDescribeEnvironmentMemberships()
        - .toUpdateEnvironmentMembership()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "ifUserArn", [value, operator]))

    @jsii.member(jsii_name="onEnvironment")
    def on_environment(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloud9":
        '''(experimental) Adds a resource of type environment to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awscloud9.html#awscloud9-environment

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "onEnvironment", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateEnvironmentEC2")
    def to_create_environment_ec2(self) -> "Cloud9":
        '''(experimental) Grants permission to create an AWS Cloud9 development environment, launches an Amazon Elastic Compute Cloud (Amazon EC2) instance, and then hosts the environment on the instance.

        Access Level: Write

        Possible conditions:

        - .ifEnvironmentName()
        - .ifInstanceType()
        - .ifSubnetId()
        - .ifUserArn()

        Dependent actions:

        - ec2:DescribeSubnets
        - ec2:DescribeVpcs
        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/cloud9/latest/APIReference/API_CreateEnvironmentEC2.html

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toCreateEnvironmentEC2", []))

    @jsii.member(jsii_name="toCreateEnvironmentMembership")
    def to_create_environment_membership(self) -> "Cloud9":
        '''(experimental) Grants permission to add an environment member to an AWS Cloud9 development environment.

        Access Level: Write

        Possible conditions:

        - .ifUserArn()
        - .ifEnvironmentId()
        - .ifPermissions()

        https://docs.aws.amazon.com/cloud9/latest/APIReference/API_CreateEnvironmentMembership.html

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toCreateEnvironmentMembership", []))

    @jsii.member(jsii_name="toDeleteEnvironment")
    def to_delete_environment(self) -> "Cloud9":
        '''(experimental) Grants permission to delete an AWS Cloud9 development environment.

        If the environment is hosted on an Amazon Elastic Compute Cloud (Amazon EC2) instance, also terminates the instance.

        Access Level: Write

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/cloud9/latest/APIReference/API_DeleteEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toDeleteEnvironment", []))

    @jsii.member(jsii_name="toDeleteEnvironmentMembership")
    def to_delete_environment_membership(self) -> "Cloud9":
        '''(experimental) Grants permission to delete an environment member from an AWS Cloud9 development environment.

        Access Level: Write

        https://docs.aws.amazon.com/cloud9/latest/APIReference/API_DeleteEnvironmentMembership.html

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toDeleteEnvironmentMembership", []))

    @jsii.member(jsii_name="toDescribeEnvironmentMemberships")
    def to_describe_environment_memberships(self) -> "Cloud9":
        '''(experimental) Grants permission to get information about environment members for an AWS Cloud9 development environment.

        Access Level: Read

        Possible conditions:

        - .ifUserArn()
        - .ifEnvironmentId()

        https://docs.aws.amazon.com/cloud9/latest/APIReference/API_DescribeEnvironmentMemberships.html

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toDescribeEnvironmentMemberships", []))

    @jsii.member(jsii_name="toDescribeEnvironments")
    def to_describe_environments(self) -> "Cloud9":
        '''(experimental) Grants permission to get information about AWS Cloud9 development environments.

        Access Level: Read

        https://docs.aws.amazon.com/cloud9/latest/APIReference/API_DescribeEnvironments.html

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toDescribeEnvironments", []))

    @jsii.member(jsii_name="toDescribeEnvironmentStatus")
    def to_describe_environment_status(self) -> "Cloud9":
        '''(experimental) Grants permission to get status information for an AWS Cloud9 development environment.

        Access Level: Read

        https://docs.aws.amazon.com/cloud9/latest/APIReference/API_DescribeEnvironmentStatus.html

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toDescribeEnvironmentStatus", []))

    @jsii.member(jsii_name="toGetUserSettings")
    def to_get_user_settings(self) -> "Cloud9":
        '''(experimental) Grants permission to get IDE-specific settings of an AWS Cloud9 user.

        Access Level: Read

        https://docs.aws.amazon.com/cloud9/latest/user-guide/settings-user.html

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toGetUserSettings", []))

    @jsii.member(jsii_name="toListEnvironments")
    def to_list_environments(self) -> "Cloud9":
        '''(experimental) Grants permission to get a list of AWS Cloud9 development environment identifiers.

        Access Level: Read

        https://docs.aws.amazon.com/cloud9/latest/APIReference/API_ListEnvironments.html

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toListEnvironments", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Cloud9":
        '''(experimental) Lists tags for a cloud9 environment.

        Access Level: Read

        https://docs.aws.amazon.com/cloud9/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Cloud9":
        '''(experimental) Adds tags to a cloud9 environment.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cloud9/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Cloud9":
        '''(experimental) Removes tags from a cloud9 environment.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cloud9/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateEnvironment")
    def to_update_environment(self) -> "Cloud9":
        '''(experimental) Grants permission to change the settings of an existing AWS Cloud9 development environment.

        Access Level: Write

        https://docs.aws.amazon.com/cloud9/latest/APIReference/API_UpdateEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toUpdateEnvironment", []))

    @jsii.member(jsii_name="toUpdateEnvironmentMembership")
    def to_update_environment_membership(self) -> "Cloud9":
        '''(experimental) Grants permission to change the settings of an existing environment member for an AWS Cloud9 development environment.

        Access Level: Write

        Possible conditions:

        - .ifUserArn()
        - .ifEnvironmentId()
        - .ifPermissions()

        https://docs.aws.amazon.com/cloud9/latest/APIReference/API_UpdateEnvironmentMembership.html

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toUpdateEnvironmentMembership", []))

    @jsii.member(jsii_name="toUpdateUserSettings")
    def to_update_user_settings(self) -> "Cloud9":
        '''(experimental) Grants permission to update IDE-specific settings of an AWS Cloud9 user.

        Access Level: Write

        https://docs.aws.amazon.com/cloud9/latest/user-guide/settings-user.html

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toUpdateUserSettings", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Clouddirectory(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Clouddirectory",
):
    '''(experimental) Statement provider for service `clouddirectory <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonclouddirectory.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `clouddirectory <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonclouddirectory.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Clouddirectory, self, [sid])

    @jsii.member(jsii_name="onAppliedSchema")
    def on_applied_schema(
        self,
        directory_id: builtins.str,
        schema_name: builtins.str,
        version: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Clouddirectory":
        '''(experimental) Adds a resource of type appliedSchema to the statement.

        https://docs.aws.amazon.com/directoryservice/latest/admin-guide/cd_key_concepts.html#whatisdirectory

        :param directory_id: - Identifier for the directoryId.
        :param schema_name: - Identifier for the schemaName.
        :param version: - Identifier for the version.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "onAppliedSchema", [directory_id, schema_name, version, account, region, partition]))

    @jsii.member(jsii_name="onDevelopmentSchema")
    def on_development_schema(
        self,
        schema_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Clouddirectory":
        '''(experimental) Adds a resource of type developmentSchema to the statement.

        https://docs.aws.amazon.com/directoryservice/latest/admin-guide/cd_key_concepts.html#whatisdirectory

        :param schema_name: - Identifier for the schemaName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "onDevelopmentSchema", [schema_name, account, region, partition]))

    @jsii.member(jsii_name="onDirectory")
    def on_directory(
        self,
        directory_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Clouddirectory":
        '''(experimental) Adds a resource of type directory to the statement.

        https://docs.aws.amazon.com/directoryservice/latest/admin-guide/cd_key_concepts.html#whatisdirectory

        :param directory_id: - Identifier for the directoryId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "onDirectory", [directory_id, account, region, partition]))

    @jsii.member(jsii_name="onPublishedSchema")
    def on_published_schema(
        self,
        schema_name: builtins.str,
        version: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Clouddirectory":
        '''(experimental) Adds a resource of type publishedSchema to the statement.

        https://docs.aws.amazon.com/directoryservice/latest/admin-guide/cd_key_concepts.html#whatisdirectory

        :param schema_name: - Identifier for the schemaName.
        :param version: - Identifier for the version.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "onPublishedSchema", [schema_name, version, account, region, partition]))

    @jsii.member(jsii_name="toAddFacetToObject")
    def to_add_facet_to_object(self) -> "Clouddirectory":
        '''(experimental) Adds a new Facet to an object.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_AddFacetToObject.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toAddFacetToObject", []))

    @jsii.member(jsii_name="toApplySchema")
    def to_apply_schema(self) -> "Clouddirectory":
        '''(experimental) Copies input published schema into Directory with same name and version as that of published schema.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ApplySchema.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toApplySchema", []))

    @jsii.member(jsii_name="toAttachObject")
    def to_attach_object(self) -> "Clouddirectory":
        '''(experimental) Attaches an existing object to another existing object.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_AttachObject.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toAttachObject", []))

    @jsii.member(jsii_name="toAttachPolicy")
    def to_attach_policy(self) -> "Clouddirectory":
        '''(experimental) Attaches a policy object to any other object.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_AttachPolicy.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toAttachPolicy", []))

    @jsii.member(jsii_name="toAttachToIndex")
    def to_attach_to_index(self) -> "Clouddirectory":
        '''(experimental) Attaches the specified object to the specified index.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_AttachToIndex.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toAttachToIndex", []))

    @jsii.member(jsii_name="toAttachTypedLink")
    def to_attach_typed_link(self) -> "Clouddirectory":
        '''(experimental) Attaches a typed link b/w a source & target object reference.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_AttachTypedLink.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toAttachTypedLink", []))

    @jsii.member(jsii_name="toBatchRead")
    def to_batch_read(self) -> "Clouddirectory":
        '''(experimental) Performs all the read operations in a batch. Each individual operation inside BatchRead needs to be granted permissions explicitly.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_BatchRead.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toBatchRead", []))

    @jsii.member(jsii_name="toBatchWrite")
    def to_batch_write(self) -> "Clouddirectory":
        '''(experimental) Performs all the write operations in a batch. Each individual operation inside BatchWrite needs to be granted permissions explicitly.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_BatchWrite.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toBatchWrite", []))

    @jsii.member(jsii_name="toCreateDirectory")
    def to_create_directory(self) -> "Clouddirectory":
        '''(experimental) Creates a Directory by copying the published schema into the directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_CreateDirectory.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toCreateDirectory", []))

    @jsii.member(jsii_name="toCreateFacet")
    def to_create_facet(self) -> "Clouddirectory":
        '''(experimental) Creates a new Facet in a schema.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_CreateFacet.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toCreateFacet", []))

    @jsii.member(jsii_name="toCreateIndex")
    def to_create_index(self) -> "Clouddirectory":
        '''(experimental) Creates an index object.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_CreateIndex.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toCreateIndex", []))

    @jsii.member(jsii_name="toCreateObject")
    def to_create_object(self) -> "Clouddirectory":
        '''(experimental) Creates an object in a Directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_CreateObject.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toCreateObject", []))

    @jsii.member(jsii_name="toCreateSchema")
    def to_create_schema(self) -> "Clouddirectory":
        '''(experimental) Creates a new schema in a development state.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_CreateSchema.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toCreateSchema", []))

    @jsii.member(jsii_name="toCreateTypedLinkFacet")
    def to_create_typed_link_facet(self) -> "Clouddirectory":
        '''(experimental) Creates a new Typed Link facet in a schema.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_CreateTypedLinkFacet.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toCreateTypedLinkFacet", []))

    @jsii.member(jsii_name="toDeleteDirectory")
    def to_delete_directory(self) -> "Clouddirectory":
        '''(experimental) Deletes a directory. Only disabled directories can be deleted.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_DeleteDirectory.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toDeleteDirectory", []))

    @jsii.member(jsii_name="toDeleteFacet")
    def to_delete_facet(self) -> "Clouddirectory":
        '''(experimental) Deletes a given Facet. All attributes and Rules associated with the facet will be deleted.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_DeleteFacet.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toDeleteFacet", []))

    @jsii.member(jsii_name="toDeleteObject")
    def to_delete_object(self) -> "Clouddirectory":
        '''(experimental) Deletes an object and its associated attributes.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_DeleteObject.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toDeleteObject", []))

    @jsii.member(jsii_name="toDeleteSchema")
    def to_delete_schema(self) -> "Clouddirectory":
        '''(experimental) Deletes a given schema.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_DeleteSchema.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toDeleteSchema", []))

    @jsii.member(jsii_name="toDeleteTypedLinkFacet")
    def to_delete_typed_link_facet(self) -> "Clouddirectory":
        '''(experimental) Deletes a given TypedLink Facet. All attributes and Rules associated with the facet will be deleted.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_DeleteTypedLinkFacet.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toDeleteTypedLinkFacet", []))

    @jsii.member(jsii_name="toDetachFromIndex")
    def to_detach_from_index(self) -> "Clouddirectory":
        '''(experimental) Detaches the specified object from the specified index.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_DetachFromIndex.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toDetachFromIndex", []))

    @jsii.member(jsii_name="toDetachObject")
    def to_detach_object(self) -> "Clouddirectory":
        '''(experimental) Detaches a given object from the parent object.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_DetachObject.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toDetachObject", []))

    @jsii.member(jsii_name="toDetachPolicy")
    def to_detach_policy(self) -> "Clouddirectory":
        '''(experimental) Detaches a policy from an object.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_DetachPolicy.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toDetachPolicy", []))

    @jsii.member(jsii_name="toDetachTypedLink")
    def to_detach_typed_link(self) -> "Clouddirectory":
        '''(experimental) Detaches a given typed link b/w given source and target object reference.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_DetachTypedLink.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toDetachTypedLink", []))

    @jsii.member(jsii_name="toDisableDirectory")
    def to_disable_directory(self) -> "Clouddirectory":
        '''(experimental) Disables the specified directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_DisableDirectory.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toDisableDirectory", []))

    @jsii.member(jsii_name="toEnableDirectory")
    def to_enable_directory(self) -> "Clouddirectory":
        '''(experimental) Enables the specified directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_EnableDirectory.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toEnableDirectory", []))

    @jsii.member(jsii_name="toGetDirectory")
    def to_get_directory(self) -> "Clouddirectory":
        '''(experimental) Retrieves metadata about a directory.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_GetDirectory.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toGetDirectory", []))

    @jsii.member(jsii_name="toGetFacet")
    def to_get_facet(self) -> "Clouddirectory":
        '''(experimental) Gets details of the Facet, such as Facet Name, Attributes, Rules, or ObjectType.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_GetFacet.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toGetFacet", []))

    @jsii.member(jsii_name="toGetLinkAttributes")
    def to_get_link_attributes(self) -> "Clouddirectory":
        '''(experimental) Retrieves attributes that are associated with a typed link.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_GetLinkAttributes.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toGetLinkAttributes", []))

    @jsii.member(jsii_name="toGetObjectAttributes")
    def to_get_object_attributes(self) -> "Clouddirectory":
        '''(experimental) Retrieves attributes within a facet that are associated with an object.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_GetObjectAttributes.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toGetObjectAttributes", []))

    @jsii.member(jsii_name="toGetObjectInformation")
    def to_get_object_information(self) -> "Clouddirectory":
        '''(experimental) Retrieves metadata about an object.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_GetObjectInformation.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toGetObjectInformation", []))

    @jsii.member(jsii_name="toGetSchemaAsJson")
    def to_get_schema_as_json(self) -> "Clouddirectory":
        '''(experimental) Retrieves a JSON representation of the schema.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_GetSchemaAsJson.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toGetSchemaAsJson", []))

    @jsii.member(jsii_name="toGetTypedLinkFacetInformation")
    def to_get_typed_link_facet_information(self) -> "Clouddirectory":
        '''(experimental) Returns identity attributes order information associated with a given typed link facet.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_GetTypedLinkFacetInformation.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toGetTypedLinkFacetInformation", []))

    @jsii.member(jsii_name="toListAppliedSchemaArns")
    def to_list_applied_schema_arns(self) -> "Clouddirectory":
        '''(experimental) Lists schemas applied to a directory.

        Access Level: List

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListAppliedSchemaArns.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListAppliedSchemaArns", []))

    @jsii.member(jsii_name="toListAttachedIndices")
    def to_list_attached_indices(self) -> "Clouddirectory":
        '''(experimental) Lists indices attached to an object.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListAttachedIndices.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListAttachedIndices", []))

    @jsii.member(jsii_name="toListDevelopmentSchemaArns")
    def to_list_development_schema_arns(self) -> "Clouddirectory":
        '''(experimental) Retrieves the ARNs of schemas in the development state.

        Access Level: List

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListDevelopmentSchemaArns.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListDevelopmentSchemaArns", []))

    @jsii.member(jsii_name="toListDirectories")
    def to_list_directories(self) -> "Clouddirectory":
        '''(experimental) Lists directories created within an account.

        Access Level: List

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListDirectories.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListDirectories", []))

    @jsii.member(jsii_name="toListFacetAttributes")
    def to_list_facet_attributes(self) -> "Clouddirectory":
        '''(experimental) Retrieves attributes attached to the facet.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListFacetAttributes.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListFacetAttributes", []))

    @jsii.member(jsii_name="toListFacetNames")
    def to_list_facet_names(self) -> "Clouddirectory":
        '''(experimental) Retrieves the names of facets that exist in a schema.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListFacetNames.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListFacetNames", []))

    @jsii.member(jsii_name="toListIncomingTypedLinks")
    def to_list_incoming_typed_links(self) -> "Clouddirectory":
        '''(experimental) Returns a paginated list of all incoming TypedLinks for a given object.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListIncomingTypedLinks.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListIncomingTypedLinks", []))

    @jsii.member(jsii_name="toListIndex")
    def to_list_index(self) -> "Clouddirectory":
        '''(experimental) Lists objects attached to the specified index.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListIndex.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListIndex", []))

    @jsii.member(jsii_name="toListObjectAttributes")
    def to_list_object_attributes(self) -> "Clouddirectory":
        '''(experimental) Lists all attributes associated with an object.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListObjectAttributes.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListObjectAttributes", []))

    @jsii.member(jsii_name="toListObjectChildren")
    def to_list_object_children(self) -> "Clouddirectory":
        '''(experimental) Returns a paginated list of child objects associated with a given object.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListObjectChildren.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListObjectChildren", []))

    @jsii.member(jsii_name="toListObjectParentPaths")
    def to_list_object_parent_paths(self) -> "Clouddirectory":
        '''(experimental) Retrieves all available parent paths for any object type such as node, leaf node, policy node, and index node objects.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListObjectParentPaths.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListObjectParentPaths", []))

    @jsii.member(jsii_name="toListObjectParents")
    def to_list_object_parents(self) -> "Clouddirectory":
        '''(experimental) Lists parent objects associated with a given object in pagination fashion.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListObjectParents.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListObjectParents", []))

    @jsii.member(jsii_name="toListObjectPolicies")
    def to_list_object_policies(self) -> "Clouddirectory":
        '''(experimental) Returns policies attached to an object in pagination fashion.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListObjectPolicies.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListObjectPolicies", []))

    @jsii.member(jsii_name="toListOutgoingTypedLinks")
    def to_list_outgoing_typed_links(self) -> "Clouddirectory":
        '''(experimental) Returns a paginated list of all outgoing TypedLinks for a given object.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListOutgoingTypedLinks.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListOutgoingTypedLinks", []))

    @jsii.member(jsii_name="toListPolicyAttachments")
    def to_list_policy_attachments(self) -> "Clouddirectory":
        '''(experimental) Returns all of the ObjectIdentifiers to which a given policy is attached.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListPolicyAttachments.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListPolicyAttachments", []))

    @jsii.member(jsii_name="toListPublishedSchemaArns")
    def to_list_published_schema_arns(self) -> "Clouddirectory":
        '''(experimental) Retrieves published schema ARNs.

        Access Level: List

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListPublishedSchemaArns.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListPublishedSchemaArns", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Clouddirectory":
        '''(experimental) Returns tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTypedLinkFacetAttributes")
    def to_list_typed_link_facet_attributes(self) -> "Clouddirectory":
        '''(experimental) Returns a paginated list of attributes associated with typed link facet.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListTypedLinkFacetAttributes.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListTypedLinkFacetAttributes", []))

    @jsii.member(jsii_name="toListTypedLinkFacetNames")
    def to_list_typed_link_facet_names(self) -> "Clouddirectory":
        '''(experimental) Returns a paginated list of typed link facet names that exist in a schema.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListTypedLinkFacetNames.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListTypedLinkFacetNames", []))

    @jsii.member(jsii_name="toLookupPolicy")
    def to_lookup_policy(self) -> "Clouddirectory":
        '''(experimental) Lists all policies from the root of the Directory to the object specified.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_LookupPolicy.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toLookupPolicy", []))

    @jsii.member(jsii_name="toPublishSchema")
    def to_publish_schema(self) -> "Clouddirectory":
        '''(experimental) Publishes a development schema with a version.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_PublishSchema.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toPublishSchema", []))

    @jsii.member(jsii_name="toPutSchemaFromJson")
    def to_put_schema_from_json(self) -> "Clouddirectory":
        '''(experimental) Allows a schema to be updated using JSON upload. Only available for development schemas.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_PutSchemaFromJson.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toPutSchemaFromJson", []))

    @jsii.member(jsii_name="toRemoveFacetFromObject")
    def to_remove_facet_from_object(self) -> "Clouddirectory":
        '''(experimental) Removes the specified facet from the specified object.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_RemoveFacetFromObject.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toRemoveFacetFromObject", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Clouddirectory":
        '''(experimental) Adds tags to a resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Clouddirectory":
        '''(experimental) Removes tags from a resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateFacet")
    def to_update_facet(self) -> "Clouddirectory":
        '''(experimental) Adds/Updates/Deletes existing Attributes, Rules, or ObjectType of a Facet.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_UpdateFacet.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toUpdateFacet", []))

    @jsii.member(jsii_name="toUpdateLinkAttributes")
    def to_update_link_attributes(self) -> "Clouddirectory":
        '''(experimental) Updates a given typed link’s attributes.

        Attributes to be updated must not contribute to the typed link’s identity, as defined by its IdentityAttributeOrder.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_UpdateLinkAttributes.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toUpdateLinkAttributes", []))

    @jsii.member(jsii_name="toUpdateObjectAttributes")
    def to_update_object_attributes(self) -> "Clouddirectory":
        '''(experimental) Updates a given object's attributes.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_UpdateObjectAttributes.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toUpdateObjectAttributes", []))

    @jsii.member(jsii_name="toUpdateSchema")
    def to_update_schema(self) -> "Clouddirectory":
        '''(experimental) Updates the schema name with a new name.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_UpdateSchema.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toUpdateSchema", []))

    @jsii.member(jsii_name="toUpdateTypedLinkFacet")
    def to_update_typed_link_facet(self) -> "Clouddirectory":
        '''(experimental) Adds/Updates/Deletes existing Attributes, Rules, identity attribute order of a TypedLink Facet.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_UpdateTypedLinkFacet.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toUpdateTypedLinkFacet", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Cloudformation(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Cloudformation",
):
    '''(experimental) Statement provider for service `cloudformation <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscloudformation.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `cloudformation <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscloudformation.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Cloudformation, self, [sid])

    @jsii.member(jsii_name="ifChangeSetName")
    def if_change_set_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Cloudformation":
        '''(experimental) Filters actions based on an AWS CloudFormation change set name.

        Use to control which change sets IAM users can execute or delete

        https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-template.html#using-iam-template-conditions

        Applies to actions:

        - .toCreateChangeSet()
        - .toDeleteChangeSet()
        - .toDescribeChangeSet()
        - .toExecuteChangeSet()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "ifChangeSetName", [value, operator]))

    @jsii.member(jsii_name="ifImportResourceTypes")
    def if_import_resource_types(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Cloudformation":
        '''(experimental) Filters actions based on the template resource types, such as AWS::EC2::Instance.

        Use to control which resource types IAM users can work with when they want to import a resource into a stack

        https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-template.html#using-iam-template-conditions

        Applies to actions:

        - .toCreateChangeSet()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "ifImportResourceTypes", [value, operator]))

    @jsii.member(jsii_name="ifResourceTypes")
    def if_resource_types(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Cloudformation":
        '''(experimental) Filters actions based on the template resource types, such as AWS::EC2::Instance.

        Use to control which resource types IAM users can work with when they create or update a stack

        https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-template.html#using-iam-template-conditions

        Applies to actions:

        - .toCreateChangeSet()
        - .toCreateStack()
        - .toUpdateStack()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "ifResourceTypes", [value, operator]))

    @jsii.member(jsii_name="ifRoleArn")
    def if_role_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Cloudformation":
        '''(experimental) Filters actions based on the ARN of an IAM service role.

        Use to control which service role IAM users can use to work with stacks or change sets

        https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-template.html#using-iam-template-conditions

        Applies to actions:

        - .toContinueUpdateRollback()
        - .toCreateChangeSet()
        - .toCreateStack()
        - .toCreateStackSet()
        - .toDeleteStack()
        - .toUpdateStack()
        - .toUpdateStackSet()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "ifRoleArn", [value, operator]))

    @jsii.member(jsii_name="ifStackPolicyUrl")
    def if_stack_policy_url(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Cloudformation":
        '''(experimental) Filters actions based on an Amazon S3 stack policy URL.

        Use to control which stack policies IAM users can associate with a stack during a create or update stack action

        https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-template.html#using-iam-template-conditions

        Applies to actions:

        - .toCreateChangeSet()
        - .toCreateStack()
        - .toSetStackPolicy()
        - .toUpdateStack()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "ifStackPolicyUrl", [value, operator]))

    @jsii.member(jsii_name="ifTemplateUrl")
    def if_template_url(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Cloudformation":
        '''(experimental) Filters actions based on an Amazon S3 template URL.

        Use to control which templates IAM users can use when they create or update stacks

        https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-template.html#using-iam-template-conditions

        Applies to actions:

        - .toCreateChangeSet()
        - .toCreateStack()
        - .toCreateStackSet()
        - .toUpdateStack()
        - .toUpdateStackSet()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "ifTemplateUrl", [value, operator]))

    @jsii.member(jsii_name="onChangeset")
    def on_changeset(
        self,
        change_set_name: builtins.str,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudformation":
        '''(experimental) Adds a resource of type changeset to the statement.

        https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-whatis-concepts.html#w2ab1b5c15c11

        :param change_set_name: - Identifier for the changeSetName.
        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "onChangeset", [change_set_name, id, account, region, partition]))

    @jsii.member(jsii_name="onStack")
    def on_stack(
        self,
        stack_name: builtins.str,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudformation":
        '''(experimental) Adds a resource of type stack to the statement.

        https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-whatis-concepts.html#w2ab1b5c15b9

        :param stack_name: - Identifier for the stackName.
        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "onStack", [stack_name, id, account, region, partition]))

    @jsii.member(jsii_name="onStackset")
    def on_stackset(
        self,
        stack_set_name: builtins.str,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudformation":
        '''(experimental) Adds a resource of type stackset to the statement.

        https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-concepts.html#stacksets-concepts-stackset

        :param stack_set_name: - Identifier for the stackSetName.
        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "onStackset", [stack_set_name, id, account, region, partition]))

    @jsii.member(jsii_name="onStacksetTarget")
    def on_stackset_target(
        self,
        stack_set_target: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudformation":
        '''(experimental) Adds a resource of type stackset-target to the statement.

        https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-template.html

        :param stack_set_target: - Identifier for the stackSetTarget.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "onStacksetTarget", [stack_set_target, account, region, partition]))

    @jsii.member(jsii_name="onType")
    def on_type(
        self,
        type: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudformation":
        '''(experimental) Adds a resource of type type to the statement.

        https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-template.html

        :param type: - Identifier for the type.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "onType", [type, account, region, partition]))

    @jsii.member(jsii_name="toCancelUpdateStack")
    def to_cancel_update_stack(self) -> "Cloudformation":
        '''(experimental) Grants permission to cancel an update on the specified stack.

        Access Level: Write

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_CancelUpdateStack.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toCancelUpdateStack", []))

    @jsii.member(jsii_name="toContinueUpdateRollback")
    def to_continue_update_rollback(self) -> "Cloudformation":
        '''(experimental) Grants permission to continue rolling back a stack that is in the UPDATE_ROLLBACK_FAILED state to the UPDATE_ROLLBACK_COMPLETE state.

        Access Level: Write

        Possible conditions:

        - .ifRoleArn()

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ContinueUpdateRollback.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toContinueUpdateRollback", []))

    @jsii.member(jsii_name="toCreateChangeSet")
    def to_create_change_set(self) -> "Cloudformation":
        '''(experimental) Grants permission to create a list of changes for a stack.

        Access Level: Write

        Possible conditions:

        - .ifChangeSetName()
        - .ifResourceTypes()
        - .ifImportResourceTypes()
        - .ifRoleArn()
        - .ifStackPolicyUrl()
        - .ifTemplateUrl()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_CreateChangeSet.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toCreateChangeSet", []))

    @jsii.member(jsii_name="toCreateStack")
    def to_create_stack(self) -> "Cloudformation":
        '''(experimental) Grants permission to create a stack as specified in the template.

        Access Level: Write

        Possible conditions:

        - .ifResourceTypes()
        - .ifRoleArn()
        - .ifStackPolicyUrl()
        - .ifTemplateUrl()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_CreateStack.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toCreateStack", []))

    @jsii.member(jsii_name="toCreateStackInstances")
    def to_create_stack_instances(self) -> "Cloudformation":
        '''(experimental) Grants permission to create stack instances for the specified accounts, within the specified regions.

        Access Level: Write

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_CreateStackInstances.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toCreateStackInstances", []))

    @jsii.member(jsii_name="toCreateStackSet")
    def to_create_stack_set(self) -> "Cloudformation":
        '''(experimental) Grants permission to create a stackset as specified in the template.

        Access Level: Write

        Possible conditions:

        - .ifRoleArn()
        - .ifTemplateUrl()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_CreateStackSet.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toCreateStackSet", []))

    @jsii.member(jsii_name="toCreateUploadBucket")
    def to_create_upload_bucket(self) -> "Cloudformation":
        '''(experimental) Grants permission to upload templates to Amazon S3 buckets.

        Used only by the AWS CloudFormation console and is not documented in the API reference

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toCreateUploadBucket", []))

    @jsii.member(jsii_name="toDeleteChangeSet")
    def to_delete_change_set(self) -> "Cloudformation":
        '''(experimental) Grants permission to delete the specified change set.

        Deleting change sets ensures that no one executes the wrong change set

        Access Level: Write

        Possible conditions:

        - .ifChangeSetName()

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DeleteChangeSet.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDeleteChangeSet", []))

    @jsii.member(jsii_name="toDeleteStack")
    def to_delete_stack(self) -> "Cloudformation":
        '''(experimental) Grants permission to delete a specified stack.

        Access Level: Write

        Possible conditions:

        - .ifRoleArn()

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DeleteStack.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDeleteStack", []))

    @jsii.member(jsii_name="toDeleteStackInstances")
    def to_delete_stack_instances(self) -> "Cloudformation":
        '''(experimental) Grants permission to delete stack instances for the specified accounts, in the specified regions.

        Access Level: Write

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DeleteStackInstances.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDeleteStackInstances", []))

    @jsii.member(jsii_name="toDeleteStackSet")
    def to_delete_stack_set(self) -> "Cloudformation":
        '''(experimental) Grants permission to delete a specified stackset.

        Access Level: Write

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DeleteStackSet.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDeleteStackSet", []))

    @jsii.member(jsii_name="toDeregisterType")
    def to_deregister_type(self) -> "Cloudformation":
        '''(experimental) Grants permission to deregister an existing CloudFormation type or type version.

        Access Level: Write

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DeregisterType.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDeregisterType", []))

    @jsii.member(jsii_name="toDescribeAccountLimits")
    def to_describe_account_limits(self) -> "Cloudformation":
        '''(experimental) Grants permission to retrieve your account's AWS CloudFormation limits.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeAccountLimits.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDescribeAccountLimits", []))

    @jsii.member(jsii_name="toDescribeChangeSet")
    def to_describe_change_set(self) -> "Cloudformation":
        '''(experimental) Grants permission to return the description for the specified change set.

        Access Level: Read

        Possible conditions:

        - .ifChangeSetName()

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeChangeSet.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDescribeChangeSet", []))

    @jsii.member(jsii_name="toDescribeStackDriftDetectionStatus")
    def to_describe_stack_drift_detection_status(self) -> "Cloudformation":
        '''(experimental) Grants permission to return information about a stack drift detection operation.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeStackDriftDetectionStatus.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDescribeStackDriftDetectionStatus", []))

    @jsii.member(jsii_name="toDescribeStackEvents")
    def to_describe_stack_events(self) -> "Cloudformation":
        '''(experimental) Grants permission to return all stack related events for a specified stack.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeStackEvents.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDescribeStackEvents", []))

    @jsii.member(jsii_name="toDescribeStackInstance")
    def to_describe_stack_instance(self) -> "Cloudformation":
        '''(experimental) Grants permission to return the stack instance that's associated with the specified stack set, AWS account, and region.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeStackInstance.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDescribeStackInstance", []))

    @jsii.member(jsii_name="toDescribeStackResource")
    def to_describe_stack_resource(self) -> "Cloudformation":
        '''(experimental) Grants permission to return a description of the specified resource in the specified stack.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeStackResource.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDescribeStackResource", []))

    @jsii.member(jsii_name="toDescribeStackResourceDrifts")
    def to_describe_stack_resource_drifts(self) -> "Cloudformation":
        '''(experimental) Grants permission to return drift information for the resources that have been checked for drift in the specified stack.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeStackResourceDrifts.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDescribeStackResourceDrifts", []))

    @jsii.member(jsii_name="toDescribeStackResources")
    def to_describe_stack_resources(self) -> "Cloudformation":
        '''(experimental) Grants permission to return AWS resource descriptions for running and deleted stacks.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeStackResources.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDescribeStackResources", []))

    @jsii.member(jsii_name="toDescribeStacks")
    def to_describe_stacks(self) -> "Cloudformation":
        '''(experimental) Grants permission to return the description for the specified stack.

        Access Level: List

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeStacks.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDescribeStacks", []))

    @jsii.member(jsii_name="toDescribeStackSet")
    def to_describe_stack_set(self) -> "Cloudformation":
        '''(experimental) Grants permission to return the description of the specified stack set.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeStackSet.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDescribeStackSet", []))

    @jsii.member(jsii_name="toDescribeStackSetOperation")
    def to_describe_stack_set_operation(self) -> "Cloudformation":
        '''(experimental) Grants permission to return the description of the specified stack set operation.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeStackSetOperation.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDescribeStackSetOperation", []))

    @jsii.member(jsii_name="toDescribeType")
    def to_describe_type(self) -> "Cloudformation":
        '''(experimental) Grants permission to return information about the CloudFormation type requested.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeType.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDescribeType", []))

    @jsii.member(jsii_name="toDescribeTypeRegistration")
    def to_describe_type_registration(self) -> "Cloudformation":
        '''(experimental) Grants permission to return information about the registration process for a CloudFormation type.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeTypeRegistration.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDescribeTypeRegistration", []))

    @jsii.member(jsii_name="toDetectStackDrift")
    def to_detect_stack_drift(self) -> "Cloudformation":
        '''(experimental) Grants permission to detects whether a stack's actual configuration differs, or has drifted, from it's expected configuration, as defined in the stack template and any values specified as template parameters.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DetectStackDrift.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDetectStackDrift", []))

    @jsii.member(jsii_name="toDetectStackResourceDrift")
    def to_detect_stack_resource_drift(self) -> "Cloudformation":
        '''(experimental) Grants permission to return information about whether a resource's actual configuration differs, or has drifted, from it's expected configuration, as defined in the stack template and any values specified as template parameters.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DetectStackResourceDrift.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDetectStackResourceDrift", []))

    @jsii.member(jsii_name="toDetectStackSetDrift")
    def to_detect_stack_set_drift(self) -> "Cloudformation":
        '''(experimental) Grants permission to enable users to detect drift on a stack set and the stack instances that belong to that stack set.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DetectStackSetDrift.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDetectStackSetDrift", []))

    @jsii.member(jsii_name="toEstimateTemplateCost")
    def to_estimate_template_cost(self) -> "Cloudformation":
        '''(experimental) Grants permission to return the estimated monthly cost of a template.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_EstimateTemplateCost.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toEstimateTemplateCost", []))

    @jsii.member(jsii_name="toExecuteChangeSet")
    def to_execute_change_set(self) -> "Cloudformation":
        '''(experimental) Grants permission to update a stack using the input information that was provided when the specified change set was created.

        Access Level: Write

        Possible conditions:

        - .ifChangeSetName()

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ExecuteChangeSet.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toExecuteChangeSet", []))

    @jsii.member(jsii_name="toGetStackPolicy")
    def to_get_stack_policy(self) -> "Cloudformation":
        '''(experimental) Grants permission to return the stack policy for a specified stack.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_GetStackPolicy.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toGetStackPolicy", []))

    @jsii.member(jsii_name="toGetTemplate")
    def to_get_template(self) -> "Cloudformation":
        '''(experimental) Grants permission to return the template body for a specified stack.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_GetTemplate.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toGetTemplate", []))

    @jsii.member(jsii_name="toGetTemplateSummary")
    def to_get_template_summary(self) -> "Cloudformation":
        '''(experimental) Grants permission to return information about a new or existing template.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_GetTemplateSummary.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toGetTemplateSummary", []))

    @jsii.member(jsii_name="toListChangeSets")
    def to_list_change_sets(self) -> "Cloudformation":
        '''(experimental) Grants permission to return the ID and status of each active change set for a stack.

        For example, AWS CloudFormation lists change sets that are in the CREATE_IN_PROGRESS or CREATE_PENDING state

        Access Level: List

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ListChangeSets.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toListChangeSets", []))

    @jsii.member(jsii_name="toListExports")
    def to_list_exports(self) -> "Cloudformation":
        '''(experimental) Grants permission to list all exported output values in the account and region in which you call this action.

        Access Level: List

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ListExports.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toListExports", []))

    @jsii.member(jsii_name="toListImports")
    def to_list_imports(self) -> "Cloudformation":
        '''(experimental) Grants permission to list all stacks that are importing an exported output value.

        Access Level: List

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ListImports.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toListImports", []))

    @jsii.member(jsii_name="toListStackInstances")
    def to_list_stack_instances(self) -> "Cloudformation":
        '''(experimental) Grants permission to return summary information about stack instances that are associated with the specified stack set.

        Access Level: List

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ListStackSets.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toListStackInstances", []))

    @jsii.member(jsii_name="toListStackResources")
    def to_list_stack_resources(self) -> "Cloudformation":
        '''(experimental) Grants permission to return descriptions of all resources of the specified stack.

        Access Level: List

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ListStackResources.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toListStackResources", []))

    @jsii.member(jsii_name="toListStacks")
    def to_list_stacks(self) -> "Cloudformation":
        '''(experimental) Grants permission to return the summary information for stacks whose status matches the specified StackStatusFilter.

        Access Level: List

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ListStacks.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toListStacks", []))

    @jsii.member(jsii_name="toListStackSetOperationResults")
    def to_list_stack_set_operation_results(self) -> "Cloudformation":
        '''(experimental) Grants permission to return summary information about the results of a stack set operation.

        Access Level: List

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ListStackSetOperationResults.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toListStackSetOperationResults", []))

    @jsii.member(jsii_name="toListStackSetOperations")
    def to_list_stack_set_operations(self) -> "Cloudformation":
        '''(experimental) Grants permission to return summary information about operations performed on a stack set.

        Access Level: List

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ListStackSetOperations.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toListStackSetOperations", []))

    @jsii.member(jsii_name="toListStackSets")
    def to_list_stack_sets(self) -> "Cloudformation":
        '''(experimental) Grants permission to return summary information about stack sets that are associated with the user.

        Access Level: List

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ListStackSets.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toListStackSets", []))

    @jsii.member(jsii_name="toListTypeRegistrations")
    def to_list_type_registrations(self) -> "Cloudformation":
        '''(experimental) Grants permission to list CloudFormation type registration attempts.

        Access Level: List

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ListTypeRegistrations.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toListTypeRegistrations", []))

    @jsii.member(jsii_name="toListTypes")
    def to_list_types(self) -> "Cloudformation":
        '''(experimental) Grants permission to list available CloudFormation types.

        Access Level: List

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ListTypes.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toListTypes", []))

    @jsii.member(jsii_name="toListTypeVersions")
    def to_list_type_versions(self) -> "Cloudformation":
        '''(experimental) Grants permission to list versions of a particular CloudFormation type.

        Access Level: List

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ListTypeVersions.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toListTypeVersions", []))

    @jsii.member(jsii_name="toRegisterType")
    def to_register_type(self) -> "Cloudformation":
        '''(experimental) Grants permission to register a new CloudFormation type.

        Access Level: Write

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_RegisterType.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toRegisterType", []))

    @jsii.member(jsii_name="toSetStackPolicy")
    def to_set_stack_policy(self) -> "Cloudformation":
        '''(experimental) Grants permission to set a stack policy for a specified stack.

        Access Level: Permissions management

        Possible conditions:

        - .ifStackPolicyUrl()

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_SetStackPolicy.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toSetStackPolicy", []))

    @jsii.member(jsii_name="toSetTypeDefaultVersion")
    def to_set_type_default_version(self) -> "Cloudformation":
        '''(experimental) Grants permission to set which version of a CloudFormation type applies to CloudFormation operations.

        Access Level: Write

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_SetTypeDefaultVersion.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toSetTypeDefaultVersion", []))

    @jsii.member(jsii_name="toSignalResource")
    def to_signal_resource(self) -> "Cloudformation":
        '''(experimental) Grants permission to send a signal to the specified resource with a success or failure status.

        Access Level: Write

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_SignalResource.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toSignalResource", []))

    @jsii.member(jsii_name="toStopStackSetOperation")
    def to_stop_stack_set_operation(self) -> "Cloudformation":
        '''(experimental) Grants permission to stop an in-progress operation on a stack set and its associated stack instances.

        Access Level: Write

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_StopStackSetOperation.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toStopStackSetOperation", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Cloudformation":
        '''(experimental) Grants permission to tag cloudformation resources.

        Access Level: Tagging

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Cloudformation":
        '''(experimental) Grants permission to untag cloudformation resources.

        Access Level: Tagging

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateStack")
    def to_update_stack(self) -> "Cloudformation":
        '''(experimental) Grants permission to update a stack as specified in the template.

        Access Level: Write

        Possible conditions:

        - .ifResourceTypes()
        - .ifRoleArn()
        - .ifStackPolicyUrl()
        - .ifTemplateUrl()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_UpdateStack.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toUpdateStack", []))

    @jsii.member(jsii_name="toUpdateStackInstances")
    def to_update_stack_instances(self) -> "Cloudformation":
        '''(experimental) Grants permission to update the parameter values for stack instances for the specified accounts, within the specified regions.

        Access Level: Write

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_UpdateStackInstances.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toUpdateStackInstances", []))

    @jsii.member(jsii_name="toUpdateStackSet")
    def to_update_stack_set(self) -> "Cloudformation":
        '''(experimental) Grants permission to update a stackset as specified in the template.

        Access Level: Write

        Possible conditions:

        - .ifRoleArn()
        - .ifTemplateUrl()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_UpdateStackSet.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toUpdateStackSet", []))

    @jsii.member(jsii_name="toUpdateTerminationProtection")
    def to_update_termination_protection(self) -> "Cloudformation":
        '''(experimental) Grants permission to update termination protection for the specified stack.

        Access Level: Write

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_UpdateTerminationProtection.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toUpdateTerminationProtection", []))

    @jsii.member(jsii_name="toValidateTemplate")
    def to_validate_template(self) -> "Cloudformation":
        '''(experimental) Grants permission to validate a specified template.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ValidateTemplate.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toValidateTemplate", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Cloudfront(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Cloudfront",
):
    '''(experimental) Statement provider for service `cloudfront <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudfront.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `cloudfront <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudfront.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Cloudfront, self, [sid])

    @jsii.member(jsii_name="onCachePolicy")
    def on_cache_policy(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudfront":
        '''(experimental) Adds a resource of type cache-policy to the statement.

        https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/working-with-policies.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "onCachePolicy", [id, account, partition]))

    @jsii.member(jsii_name="onDistribution")
    def on_distribution(
        self,
        distribution_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudfront":
        '''(experimental) Adds a resource of type distribution to the statement.

        https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-working-with.html

        :param distribution_id: - Identifier for the distributionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "onDistribution", [distribution_id, account, partition]))

    @jsii.member(jsii_name="onFieldLevelEncryption")
    def on_field_level_encryption(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudfront":
        '''(experimental) Adds a resource of type field-level-encryption to the statement.

        https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/field-level-encryption.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "onFieldLevelEncryption", [id, account, partition]))

    @jsii.member(jsii_name="onFieldLevelEncryptionProfile")
    def on_field_level_encryption_profile(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudfront":
        '''(experimental) Adds a resource of type field-level-encryption-profile to the statement.

        https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/field-level-encryption.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "onFieldLevelEncryptionProfile", [id, account, partition]))

    @jsii.member(jsii_name="onOriginAccessIdentity")
    def on_origin_access_identity(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudfront":
        '''(experimental) Adds a resource of type origin-access-identity to the statement.

        https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html#private-content-restricting-access-to-s3-overview

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "onOriginAccessIdentity", [id, account, partition]))

    @jsii.member(jsii_name="onOriginRequestPolicy")
    def on_origin_request_policy(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudfront":
        '''(experimental) Adds a resource of type origin-request-policy to the statement.

        https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/working-with-policies.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "onOriginRequestPolicy", [id, account, partition]))

    @jsii.member(jsii_name="onStreamingDistribution")
    def on_streaming_distribution(
        self,
        distribution_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudfront":
        '''(experimental) Adds a resource of type streaming-distribution to the statement.

        https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-working-with.html

        :param distribution_id: - Identifier for the distributionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "onStreamingDistribution", [distribution_id, account, partition]))

    @jsii.member(jsii_name="toCreateCachePolicy")
    def to_create_cache_policy(self) -> "Cloudfront":
        '''(experimental) This action adds a new cache policy to CloudFront.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateCachePolicy.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toCreateCachePolicy", []))

    @jsii.member(jsii_name="toCreateCloudFrontOriginAccessIdentity")
    def to_create_cloud_front_origin_access_identity(self) -> "Cloudfront":
        '''(experimental) This action creates a new CloudFront origin access identity.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateCloudFrontOriginAccessIdentity.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toCreateCloudFrontOriginAccessIdentity", []))

    @jsii.member(jsii_name="toCreateDistribution")
    def to_create_distribution(self) -> "Cloudfront":
        '''(experimental) This action creates a new web distribution.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateDistribution.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toCreateDistribution", []))

    @jsii.member(jsii_name="toCreateDistributionWithTags")
    def to_create_distribution_with_tags(self) -> "Cloudfront":
        '''(experimental) This action creates a new web distribution with tags.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateDistributionWithTags.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toCreateDistributionWithTags", []))

    @jsii.member(jsii_name="toCreateFieldLevelEncryptionConfig")
    def to_create_field_level_encryption_config(self) -> "Cloudfront":
        '''(experimental) This action creates a new field-level encryption configuration.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateFieldLevelEncryptionConfig.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toCreateFieldLevelEncryptionConfig", []))

    @jsii.member(jsii_name="toCreateFieldLevelEncryptionProfile")
    def to_create_field_level_encryption_profile(self) -> "Cloudfront":
        '''(experimental) This action creates a field-level encryption profile.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateFieldLevelEncryptionProfile.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toCreateFieldLevelEncryptionProfile", []))

    @jsii.member(jsii_name="toCreateInvalidation")
    def to_create_invalidation(self) -> "Cloudfront":
        '''(experimental) This action creates a new invalidation batch request.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateInvalidation.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toCreateInvalidation", []))

    @jsii.member(jsii_name="toCreateOriginRequestPolicy")
    def to_create_origin_request_policy(self) -> "Cloudfront":
        '''(experimental) This action adds a new origin request policy to CloudFront.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateOriginRequestPolicy.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toCreateOriginRequestPolicy", []))

    @jsii.member(jsii_name="toCreatePublicKey")
    def to_create_public_key(self) -> "Cloudfront":
        '''(experimental) This action adds a new public key to CloudFront.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreatePublicKey.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toCreatePublicKey", []))

    @jsii.member(jsii_name="toCreateStreamingDistribution")
    def to_create_streaming_distribution(self) -> "Cloudfront":
        '''(experimental) This action creates a new RTMP distribution.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateStreamingDistribution.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toCreateStreamingDistribution", []))

    @jsii.member(jsii_name="toCreateStreamingDistributionWithTags")
    def to_create_streaming_distribution_with_tags(self) -> "Cloudfront":
        '''(experimental) This action creates a new RTMP distribution with tags.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateStreamingDistributionWithTags.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toCreateStreamingDistributionWithTags", []))

    @jsii.member(jsii_name="toDeleteCachePolicy")
    def to_delete_cache_policy(self) -> "Cloudfront":
        '''(experimental) This action deletes a cache policy.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_DeleteCachePolicy.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toDeleteCachePolicy", []))

    @jsii.member(jsii_name="toDeleteCloudFrontOriginAccessIdentity")
    def to_delete_cloud_front_origin_access_identity(self) -> "Cloudfront":
        '''(experimental) This action deletes a CloudFront origin access identity.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_DeleteCloudFrontOriginAccessIdentity.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toDeleteCloudFrontOriginAccessIdentity", []))

    @jsii.member(jsii_name="toDeleteDistribution")
    def to_delete_distribution(self) -> "Cloudfront":
        '''(experimental) This action deletes a web distribution.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_DeleteDistribution.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toDeleteDistribution", []))

    @jsii.member(jsii_name="toDeleteFieldLevelEncryptionConfig")
    def to_delete_field_level_encryption_config(self) -> "Cloudfront":
        '''(experimental) This action deletes a field-level encryption configuration.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_DeleteFieldLevelEncryptionConfig.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toDeleteFieldLevelEncryptionConfig", []))

    @jsii.member(jsii_name="toDeleteFieldLevelEncryptionProfile")
    def to_delete_field_level_encryption_profile(self) -> "Cloudfront":
        '''(experimental) This action deletes a field-level encryption profile.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_DeleteFieldLevelEncryptionProfile.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toDeleteFieldLevelEncryptionProfile", []))

    @jsii.member(jsii_name="toDeleteOriginRequestPolicy")
    def to_delete_origin_request_policy(self) -> "Cloudfront":
        '''(experimental) This action deletes an origin request policy.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_DeleteOriginRequestPolicy.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toDeleteOriginRequestPolicy", []))

    @jsii.member(jsii_name="toDeletePublicKey")
    def to_delete_public_key(self) -> "Cloudfront":
        '''(experimental) This action deletes a public key from CloudFront.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_DeletePublicKey.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toDeletePublicKey", []))

    @jsii.member(jsii_name="toDeleteStreamingDistribution")
    def to_delete_streaming_distribution(self) -> "Cloudfront":
        '''(experimental) This action deletes an RTMP distribution.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_DeleteStreamingDistribution.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toDeleteStreamingDistribution", []))

    @jsii.member(jsii_name="toGetCachePolicy")
    def to_get_cache_policy(self) -> "Cloudfront":
        '''(experimental) Get the cache policy.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetCachePolicy.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetCachePolicy", []))

    @jsii.member(jsii_name="toGetCachePolicyConfig")
    def to_get_cache_policy_config(self) -> "Cloudfront":
        '''(experimental) Get the cache policy configuration.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetCachePolicyConfig.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetCachePolicyConfig", []))

    @jsii.member(jsii_name="toGetCloudFrontOriginAccessIdentity")
    def to_get_cloud_front_origin_access_identity(self) -> "Cloudfront":
        '''(experimental) Get the information about a CloudFront origin access identity.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetCloudFrontOriginAccessIdentity.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetCloudFrontOriginAccessIdentity", []))

    @jsii.member(jsii_name="toGetCloudFrontOriginAccessIdentityConfig")
    def to_get_cloud_front_origin_access_identity_config(self) -> "Cloudfront":
        '''(experimental) Get the configuration information about a Cloudfront origin access identity.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetCloudFrontOriginAccessIdentityConfig.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetCloudFrontOriginAccessIdentityConfig", []))

    @jsii.member(jsii_name="toGetDistribution")
    def to_get_distribution(self) -> "Cloudfront":
        '''(experimental) Get the information about a web distribution.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetDistribution.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetDistribution", []))

    @jsii.member(jsii_name="toGetDistributionConfig")
    def to_get_distribution_config(self) -> "Cloudfront":
        '''(experimental) Get the configuration information about a distribution.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetDistributionConfig.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetDistributionConfig", []))

    @jsii.member(jsii_name="toGetFieldLevelEncryption")
    def to_get_field_level_encryption(self) -> "Cloudfront":
        '''(experimental) Get the field-level encryption configuration information.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetFieldLevelEncryption.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetFieldLevelEncryption", []))

    @jsii.member(jsii_name="toGetFieldLevelEncryptionConfig")
    def to_get_field_level_encryption_config(self) -> "Cloudfront":
        '''(experimental) Get the field-level encryption configuration information.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetFieldLevelEncryptionConfig.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetFieldLevelEncryptionConfig", []))

    @jsii.member(jsii_name="toGetFieldLevelEncryptionProfile")
    def to_get_field_level_encryption_profile(self) -> "Cloudfront":
        '''(experimental) Get the field-level encryption configuration information.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetFieldLevelEncryptionProfile.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetFieldLevelEncryptionProfile", []))

    @jsii.member(jsii_name="toGetFieldLevelEncryptionProfileConfig")
    def to_get_field_level_encryption_profile_config(self) -> "Cloudfront":
        '''(experimental) Get the field-level encryption profile configuration information.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetFieldLevelEncryptionProfileConfig.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetFieldLevelEncryptionProfileConfig", []))

    @jsii.member(jsii_name="toGetInvalidation")
    def to_get_invalidation(self) -> "Cloudfront":
        '''(experimental) Get the information about an invalidation.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetInvalidation.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetInvalidation", []))

    @jsii.member(jsii_name="toGetOriginRequestPolicy")
    def to_get_origin_request_policy(self) -> "Cloudfront":
        '''(experimental) Get the origin request policy.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetOriginRequestPolicy.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetOriginRequestPolicy", []))

    @jsii.member(jsii_name="toGetOriginRequestPolicyConfig")
    def to_get_origin_request_policy_config(self) -> "Cloudfront":
        '''(experimental) Get the origin request policy configuration.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetOriginRequestPolicyConfig.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetOriginRequestPolicyConfig", []))

    @jsii.member(jsii_name="toGetPublicKey")
    def to_get_public_key(self) -> "Cloudfront":
        '''(experimental) Get the public key information.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetPublicKey.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetPublicKey", []))

    @jsii.member(jsii_name="toGetPublicKeyConfig")
    def to_get_public_key_config(self) -> "Cloudfront":
        '''(experimental) Get the public key configuration information.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetPublicKeyConfig.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetPublicKeyConfig", []))

    @jsii.member(jsii_name="toGetStreamingDistribution")
    def to_get_streaming_distribution(self) -> "Cloudfront":
        '''(experimental) Get the information about an RTMP distribution.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetStreamingDistribution.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetStreamingDistribution", []))

    @jsii.member(jsii_name="toGetStreamingDistributionConfig")
    def to_get_streaming_distribution_config(self) -> "Cloudfront":
        '''(experimental) Get the configuration information about a streaming distribution.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetStreamingDistributionConfig.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetStreamingDistributionConfig", []))

    @jsii.member(jsii_name="toListCachePolicies")
    def to_list_cache_policies(self) -> "Cloudfront":
        '''(experimental) List all cache policies that have been created in CloudFront for this account.

        Access Level: List

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListCachePolicies.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListCachePolicies", []))

    @jsii.member(jsii_name="toListCloudFrontOriginAccessIdentities")
    def to_list_cloud_front_origin_access_identities(self) -> "Cloudfront":
        '''(experimental) List your CloudFront origin access identities.

        Access Level: List

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListCloudFrontOriginAccessIdentities.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListCloudFrontOriginAccessIdentities", []))

    @jsii.member(jsii_name="toListDistributions")
    def to_list_distributions(self) -> "Cloudfront":
        '''(experimental) List the distributions associated with your AWS account.

        Access Level: List

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListDistributions.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListDistributions", []))

    @jsii.member(jsii_name="toListDistributionsByCachePolicyId")
    def to_list_distributions_by_cache_policy_id(self) -> "Cloudfront":
        '''(experimental) List distribution IDs for distributions that have a cache behavior that's associated with the specified cache policy.

        Access Level: List

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListDistributionsByCachePolicyId.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListDistributionsByCachePolicyId", []))

    @jsii.member(jsii_name="toListDistributionsByOriginRequestPolicyId")
    def to_list_distributions_by_origin_request_policy_id(self) -> "Cloudfront":
        '''(experimental) List distribution IDs for distributions that have a cache behavior that's associated with the specified origin request policy.

        Access Level: List

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListDistributionsByOriginRequestPolicyId.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListDistributionsByOriginRequestPolicyId", []))

    @jsii.member(jsii_name="toListDistributionsByWebACLId")
    def to_list_distributions_by_web_acl_id(self) -> "Cloudfront":
        '''(experimental) List the distributions associated with your AWS account with given AWS WAF web ACL.

        Access Level: List

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListDistributionsByWebACLId.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListDistributionsByWebACLId", []))

    @jsii.member(jsii_name="toListFieldLevelEncryptionConfigs")
    def to_list_field_level_encryption_configs(self) -> "Cloudfront":
        '''(experimental) List all field-level encryption configurations that have been created in CloudFront for this account.

        Access Level: List

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListFieldLevelEncryptionConfigs.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListFieldLevelEncryptionConfigs", []))

    @jsii.member(jsii_name="toListFieldLevelEncryptionProfiles")
    def to_list_field_level_encryption_profiles(self) -> "Cloudfront":
        '''(experimental) List all field-level encryption profiles that have been created in CloudFront for this account.

        Access Level: List

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListFieldLevelEncryptionProfiles.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListFieldLevelEncryptionProfiles", []))

    @jsii.member(jsii_name="toListInvalidations")
    def to_list_invalidations(self) -> "Cloudfront":
        '''(experimental) List your invalidation batches.

        Access Level: List

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListInvalidations.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListInvalidations", []))

    @jsii.member(jsii_name="toListOriginRequestPolicies")
    def to_list_origin_request_policies(self) -> "Cloudfront":
        '''(experimental) List all origin request policies that have been created in CloudFront for this account.

        Access Level: List

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListOriginRequestPolicies.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListOriginRequestPolicies", []))

    @jsii.member(jsii_name="toListPublicKeys")
    def to_list_public_keys(self) -> "Cloudfront":
        '''(experimental) List all public keys that have been added to CloudFront for this account.

        Access Level: List

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListPublicKeys.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListPublicKeys", []))

    @jsii.member(jsii_name="toListStreamingDistributions")
    def to_list_streaming_distributions(self) -> "Cloudfront":
        '''(experimental) List your RTMP distributions.

        Access Level: List

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListStreamingDistributions.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListStreamingDistributions", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Cloudfront":
        '''(experimental) List tags for a CloudFront resource.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Cloudfront":
        '''(experimental) Add tags to a CloudFront resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Cloudfront":
        '''(experimental) Remove tags from a CloudFront resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateCachePolicy")
    def to_update_cache_policy(self) -> "Cloudfront":
        '''(experimental) This action updates a cache policy.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UpdateCachePolicy.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toUpdateCachePolicy", []))

    @jsii.member(jsii_name="toUpdateCloudFrontOriginAccessIdentity")
    def to_update_cloud_front_origin_access_identity(self) -> "Cloudfront":
        '''(experimental) This action sets the configuration for a CloudFront origin access identity.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UpdateCloudFrontOriginAccessIdentity.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toUpdateCloudFrontOriginAccessIdentity", []))

    @jsii.member(jsii_name="toUpdateDistribution")
    def to_update_distribution(self) -> "Cloudfront":
        '''(experimental) This action updates the configuration for a web distribution.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UpdateDistribution.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toUpdateDistribution", []))

    @jsii.member(jsii_name="toUpdateFieldLevelEncryptionConfig")
    def to_update_field_level_encryption_config(self) -> "Cloudfront":
        '''(experimental) This action updates a field-level encryption configuration.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UpdateFieldLevelEncryptionConfig.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toUpdateFieldLevelEncryptionConfig", []))

    @jsii.member(jsii_name="toUpdateFieldLevelEncryptionProfile")
    def to_update_field_level_encryption_profile(self) -> "Cloudfront":
        '''(experimental) This action updates a field-level encryption profile.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UpdateFieldLevelEncryptionProfile.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toUpdateFieldLevelEncryptionProfile", []))

    @jsii.member(jsii_name="toUpdateOriginRequestPolicy")
    def to_update_origin_request_policy(self) -> "Cloudfront":
        '''(experimental) This action updates an origin request policy.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UpdateOriginRequestPolicy.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toUpdateOriginRequestPolicy", []))

    @jsii.member(jsii_name="toUpdatePublicKey")
    def to_update_public_key(self) -> "Cloudfront":
        '''(experimental) This action updates public key information.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UpdatePublicKey.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toUpdatePublicKey", []))

    @jsii.member(jsii_name="toUpdateStreamingDistribution")
    def to_update_streaming_distribution(self) -> "Cloudfront":
        '''(experimental) This action updates the configuration for an RTMP distribution.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UpdateStreamingDistribution.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toUpdateStreamingDistribution", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Cloudhsm(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Cloudhsm",
):
    '''(experimental) Statement provider for service `cloudhsm <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscloudhsm.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `cloudhsm <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscloudhsm.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Cloudhsm, self, [sid])

    @jsii.member(jsii_name="onBackup")
    def on_backup(
        self,
        cloud_hsm_backup_instance_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudhsm":
        '''(experimental) Adds a resource of type backup to the statement.

        https://docs.aws.amazon.com/cloudhsm/latest/userguide/backups.html

        :param cloud_hsm_backup_instance_name: - Identifier for the cloudHsmBackupInstanceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "onBackup", [cloud_hsm_backup_instance_name, account, region, partition]))

    @jsii.member(jsii_name="onCluster")
    def on_cluster(
        self,
        cloud_hsm_cluster_instance_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudhsm":
        '''(experimental) Adds a resource of type cluster to the statement.

        https://docs.aws.amazon.com/cloudhsm/latest/userguide/clusters.html

        :param cloud_hsm_cluster_instance_name: - Identifier for the cloudHsmClusterInstanceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "onCluster", [cloud_hsm_cluster_instance_name, account, region, partition]))

    @jsii.member(jsii_name="toAddTagsToResource")
    def to_add_tags_to_resource(self) -> "Cloudhsm":
        '''(experimental) Adds or overwrites one or more tags for the specified AWS CloudHSM resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/cloudhsm/classic/APIReference/API_AddTagsToResource.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toAddTagsToResource", []))

    @jsii.member(jsii_name="toCopyBackupToRegion")
    def to_copy_backup_to_region(self) -> "Cloudhsm":
        '''(experimental) Creates a copy of a backup in the specified region.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_CopyBackupToRegion.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toCopyBackupToRegion", []))

    @jsii.member(jsii_name="toCreateCluster")
    def to_create_cluster(self) -> "Cloudhsm":
        '''(experimental) Creates a new AWS CloudHSM cluster.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_CreateCluster.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toCreateCluster", []))

    @jsii.member(jsii_name="toCreateHapg")
    def to_create_hapg(self) -> "Cloudhsm":
        '''(experimental) Creates a high-availability partition group.

        Access Level: Write

        https://docs.aws.amazon.com/cloudhsm/classic/APIReference/API_CreateHapg.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toCreateHapg", []))

    @jsii.member(jsii_name="toCreateHsm")
    def to_create_hsm(self) -> "Cloudhsm":
        '''(experimental) Creates a new hardware security module (HSM) in the specified AWS CloudHSM cluster.

        Access Level: Write

        https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_CreateHsm.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toCreateHsm", []))

    @jsii.member(jsii_name="toCreateLunaClient")
    def to_create_luna_client(self) -> "Cloudhsm":
        '''(experimental) Creates an HSM client.

        Access Level: Write

        https://docs.aws.amazon.com/cloudhsm/classic/APIReference/API_CreateLunaClient.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toCreateLunaClient", []))

    @jsii.member(jsii_name="toDeleteBackup")
    def to_delete_backup(self) -> "Cloudhsm":
        '''(experimental) Deletes the specified CloudHSM backup.

        Access Level: Write

        https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DeleteBackup.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toDeleteBackup", []))

    @jsii.member(jsii_name="toDeleteCluster")
    def to_delete_cluster(self) -> "Cloudhsm":
        '''(experimental) Deletes the specified AWS CloudHSM cluster.

        Access Level: Write

        https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DeleteCluster.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toDeleteCluster", []))

    @jsii.member(jsii_name="toDeleteHapg")
    def to_delete_hapg(self) -> "Cloudhsm":
        '''(experimental) Deletes a high-availability partition group.

        Access Level: Write

        https://docs.aws.amazon.com/cloudhsm/classic/APIReference/API_DeleteHapg.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toDeleteHapg", []))

    @jsii.member(jsii_name="toDeleteHsm")
    def to_delete_hsm(self) -> "Cloudhsm":
        '''(experimental) Deletes the specified HSM.

        Access Level: Write

        https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DeleteHsm.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toDeleteHsm", []))

    @jsii.member(jsii_name="toDeleteLunaClient")
    def to_delete_luna_client(self) -> "Cloudhsm":
        '''(experimental) Deletes a client.

        Access Level: Write

        https://docs.aws.amazon.com/cloudhsm/classic/APIReference/API_DeleteLunaClient.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toDeleteLunaClient", []))

    @jsii.member(jsii_name="toDescribeBackups")
    def to_describe_backups(self) -> "Cloudhsm":
        '''(experimental) Gets information about backups of AWS CloudHSM clusters.

        Access Level: Read

        https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DescribeBackups.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toDescribeBackups", []))

    @jsii.member(jsii_name="toDescribeClusters")
    def to_describe_clusters(self) -> "Cloudhsm":
        '''(experimental) Gets information about AWS CloudHSM clusters.

        Access Level: Read

        https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DescribeClusters.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toDescribeClusters", []))

    @jsii.member(jsii_name="toDescribeHapg")
    def to_describe_hapg(self) -> "Cloudhsm":
        '''(experimental) Retrieves information about a high-availability partition group.

        Access Level: Read

        https://docs.aws.amazon.com/cloudhsm/classic/APIReference/API_DescribeHapg.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toDescribeHapg", []))

    @jsii.member(jsii_name="toDescribeHsm")
    def to_describe_hsm(self) -> "Cloudhsm":
        '''(experimental) Retrieves information about an HSM. You can identify the HSM by its ARN or its serial number.

        Access Level: Read

        https://docs.aws.amazon.com/cloudhsm/classic/APIReference/API_DescribeHsm.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toDescribeHsm", []))

    @jsii.member(jsii_name="toDescribeLunaClient")
    def to_describe_luna_client(self) -> "Cloudhsm":
        '''(experimental) Retrieves information about an HSM client.

        Access Level: Read

        https://docs.aws.amazon.com/cloudhsm/classic/APIReference/API_DescribeLunaClient.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toDescribeLunaClient", []))

    @jsii.member(jsii_name="toGetConfig")
    def to_get_config(self) -> "Cloudhsm":
        '''(experimental) Gets the configuration files necessary to connect to all high availability partition groups the client is associated with.

        Access Level: Read

        https://docs.aws.amazon.com/cloudhsm/classic/APIReference/API_GetConfig.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toGetConfig", []))

    @jsii.member(jsii_name="toInitializeCluster")
    def to_initialize_cluster(self) -> "Cloudhsm":
        '''(experimental) Claims an AWS CloudHSM cluster.

        Access Level: Write

        https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_InitializeCluster.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toInitializeCluster", []))

    @jsii.member(jsii_name="toListAvailableZones")
    def to_list_available_zones(self) -> "Cloudhsm":
        '''(experimental) Lists the Availability Zones that have available AWS CloudHSM capacity.

        Access Level: List

        https://docs.aws.amazon.com/cloudhsm/classic/APIReference/API_ListAvailableZones.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toListAvailableZones", []))

    @jsii.member(jsii_name="toListHapgs")
    def to_list_hapgs(self) -> "Cloudhsm":
        '''(experimental) Lists the high-availability partition groups for the account.

        Access Level: List

        https://docs.aws.amazon.com/cloudhsm/classic/APIReference/API_ListHapgs.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toListHapgs", []))

    @jsii.member(jsii_name="toListHsms")
    def to_list_hsms(self) -> "Cloudhsm":
        '''(experimental) Retrieves the identifiers of all of the HSMs provisioned for the current customer.

        Access Level: List

        https://docs.aws.amazon.com/cloudhsm/classic/APIReference/API_ListHsms.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toListHsms", []))

    @jsii.member(jsii_name="toListLunaClients")
    def to_list_luna_clients(self) -> "Cloudhsm":
        '''(experimental) Lists all of the clients.

        Access Level: List

        https://docs.aws.amazon.com/cloudhsm/classic/APIReference/API_ListLunaClients.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toListLunaClients", []))

    @jsii.member(jsii_name="toListTags")
    def to_list_tags(self) -> "Cloudhsm":
        '''(experimental) Gets a list of tags for the specified AWS CloudHSM cluster.

        Access Level: Read

        https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_ListTags.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toListTags", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Cloudhsm":
        '''(experimental) Returns a list of all tags for the specified AWS CloudHSM resource.

        Access Level: Read

        https://docs.aws.amazon.com/cloudhsm/classic/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toModifyHapg")
    def to_modify_hapg(self) -> "Cloudhsm":
        '''(experimental) Modifies an existing high-availability partition group.

        Access Level: Write

        https://docs.aws.amazon.com/cloudhsm/classic/APIReference/API_ModifyHapg.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toModifyHapg", []))

    @jsii.member(jsii_name="toModifyHsm")
    def to_modify_hsm(self) -> "Cloudhsm":
        '''(experimental) Modifies an HSM.

        Access Level: Write

        https://docs.aws.amazon.com/cloudhsm/classic/APIReference/API_ModifyHsm.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toModifyHsm", []))

    @jsii.member(jsii_name="toModifyLunaClient")
    def to_modify_luna_client(self) -> "Cloudhsm":
        '''(experimental) Modifies the certificate used by the client.

        Access Level: Write

        https://docs.aws.amazon.com/cloudhsm/classic/APIReference/API_ModifyLunaClient.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toModifyLunaClient", []))

    @jsii.member(jsii_name="toRemoveTagsFromResource")
    def to_remove_tags_from_resource(self) -> "Cloudhsm":
        '''(experimental) Removes one or more tags from the specified AWS CloudHSM resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/cloudhsm/classic/APIReference/API_RemoveTagsFromResource.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toRemoveTagsFromResource", []))

    @jsii.member(jsii_name="toRestoreBackup")
    def to_restore_backup(self) -> "Cloudhsm":
        '''(experimental) Restores the specified CloudHSM backup.

        Access Level: Write

        https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_RestoreBackup.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toRestoreBackup", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Cloudhsm":
        '''(experimental) Adds or overwrites one or more tags for the specified AWS CloudHSM cluster.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Cloudhsm":
        '''(experimental) Removes the specified tag or tags from the specified AWS CloudHSM cluster.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toUntagResource", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Cloudsearch(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Cloudsearch",
):
    '''(experimental) Statement provider for service `cloudsearch <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudsearch.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `cloudsearch <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudsearch.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Cloudsearch, self, [sid])

    @jsii.member(jsii_name="onDomain")
    def on_domain(
        self,
        domain_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudsearch":
        '''(experimental) Adds a resource of type domain to the statement.

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/creating-domains.html

        :param domain_name: - Identifier for the domainName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "onDomain", [domain_name, account, region, partition]))

    @jsii.member(jsii_name="toAddTags")
    def to_add_tags(self) -> "Cloudsearch":
        '''(experimental) Attaches resource tags to an Amazon CloudSearch domain.

        Access Level: Tagging

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_AddTags.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toAddTags", []))

    @jsii.member(jsii_name="toBuildSuggesters")
    def to_build_suggesters(self) -> "Cloudsearch":
        '''(experimental) Indexes the search suggestions.

        Access Level: Write

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_BuildSuggesters.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toBuildSuggesters", []))

    @jsii.member(jsii_name="toCreateDomain")
    def to_create_domain(self) -> "Cloudsearch":
        '''(experimental) Creates a new search domain.

        Access Level: Write

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_CreateDomain.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toCreateDomain", []))

    @jsii.member(jsii_name="toDefineAnalysisScheme")
    def to_define_analysis_scheme(self) -> "Cloudsearch":
        '''(experimental) Configures an analysis scheme that can be applied to a text or text-array field to define language-specific text processing options.

        Access Level: Write

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DefineAnalysisScheme.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDefineAnalysisScheme", []))

    @jsii.member(jsii_name="toDefineExpression")
    def to_define_expression(self) -> "Cloudsearch":
        '''(experimental) Configures an Expression for the search domain.

        Access Level: Write

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DefineExpression.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDefineExpression", []))

    @jsii.member(jsii_name="toDefineIndexField")
    def to_define_index_field(self) -> "Cloudsearch":
        '''(experimental) Configures an IndexField for the search domain.

        Access Level: Write

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DefineIndexField.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDefineIndexField", []))

    @jsii.member(jsii_name="toDefineSuggester")
    def to_define_suggester(self) -> "Cloudsearch":
        '''(experimental) Configures a suggester for a domain.

        Access Level: Write

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DefineSuggester.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDefineSuggester", []))

    @jsii.member(jsii_name="toDeleteAnalysisScheme")
    def to_delete_analysis_scheme(self) -> "Cloudsearch":
        '''(experimental) Deletes an analysis scheme.

        Access Level: Write

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DeleteAnalysisScheme.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDeleteAnalysisScheme", []))

    @jsii.member(jsii_name="toDeleteDomain")
    def to_delete_domain(self) -> "Cloudsearch":
        '''(experimental) Permanently deletes a search domain and all of its data.

        Access Level: Write

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DeleteDomain.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDeleteDomain", []))

    @jsii.member(jsii_name="toDeleteExpression")
    def to_delete_expression(self) -> "Cloudsearch":
        '''(experimental) Removes an Expression from the search domain.

        Access Level: Write

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DeleteExpression.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDeleteExpression", []))

    @jsii.member(jsii_name="toDeleteIndexField")
    def to_delete_index_field(self) -> "Cloudsearch":
        '''(experimental) Removes an IndexField from the search domain.

        Access Level: Write

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DeleteIndexField.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDeleteIndexField", []))

    @jsii.member(jsii_name="toDeleteSuggester")
    def to_delete_suggester(self) -> "Cloudsearch":
        '''(experimental) Deletes a suggester.

        Access Level: Write

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DeleteSuggester.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDeleteSuggester", []))

    @jsii.member(jsii_name="toDescribeAnalysisSchemes")
    def to_describe_analysis_schemes(self) -> "Cloudsearch":
        '''(experimental) Gets the analysis schemes configured for a domain.

        Access Level: Read

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DescribeAnalysisSchemes.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDescribeAnalysisSchemes", []))

    @jsii.member(jsii_name="toDescribeAvailabilityOptions")
    def to_describe_availability_options(self) -> "Cloudsearch":
        '''(experimental) Gets the availability options configured for a domain.

        Access Level: Read

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DescribeAvailabilityOptions.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDescribeAvailabilityOptions", []))

    @jsii.member(jsii_name="toDescribeDomainEndpointOptions")
    def to_describe_domain_endpoint_options(self) -> "Cloudsearch":
        '''(experimental) Gets the domain endpoint options configured for a domain.

        Access Level: Read

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DescribeDomainEndpointOptions.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDescribeDomainEndpointOptions", []))

    @jsii.member(jsii_name="toDescribeDomains")
    def to_describe_domains(self) -> "Cloudsearch":
        '''(experimental) Gets information about the search domains owned by this account.

        Access Level: List

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DescribeDomains.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDescribeDomains", []))

    @jsii.member(jsii_name="toDescribeExpressions")
    def to_describe_expressions(self) -> "Cloudsearch":
        '''(experimental) Gets the expressions configured for the search domain.

        Access Level: Read

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DescribeExpressions.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDescribeExpressions", []))

    @jsii.member(jsii_name="toDescribeIndexFields")
    def to_describe_index_fields(self) -> "Cloudsearch":
        '''(experimental) Gets information about the index fields configured for the search domain.

        Access Level: Read

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DescribeIndexFields.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDescribeIndexFields", []))

    @jsii.member(jsii_name="toDescribeScalingParameters")
    def to_describe_scaling_parameters(self) -> "Cloudsearch":
        '''(experimental) Gets the scaling parameters configured for a domain.

        Access Level: Read

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DescribeScalingParameters.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDescribeScalingParameters", []))

    @jsii.member(jsii_name="toDescribeServiceAccessPolicies")
    def to_describe_service_access_policies(self) -> "Cloudsearch":
        '''(experimental) Gets information about the access policies that control access to the domain's document and search endpoints.

        Access Level: Read

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DescribeServiceAccessPolicies.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDescribeServiceAccessPolicies", []))

    @jsii.member(jsii_name="toDescribeSuggesters")
    def to_describe_suggesters(self) -> "Cloudsearch":
        '''(experimental) Gets the suggesters configured for a domain.

        Access Level: Read

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DescribeSuggesters.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDescribeSuggesters", []))

    @jsii.member(jsii_name="toDocument")
    def to_document(self) -> "Cloudsearch":
        '''(experimental) Allows access to the document service operations.

        Access Level: Write

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/configuring-access.html#cloudsearch-actions

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDocument", []))

    @jsii.member(jsii_name="toIndexDocuments")
    def to_index_documents(self) -> "Cloudsearch":
        '''(experimental) Tells the search domain to start indexing its documents using the latest indexing options.

        Access Level: Write

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_IndexDocuments.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toIndexDocuments", []))

    @jsii.member(jsii_name="toListDomainNames")
    def to_list_domain_names(self) -> "Cloudsearch":
        '''(experimental) Lists all search domains owned by an account.

        Access Level: List

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_ListDomainNames.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toListDomainNames", []))

    @jsii.member(jsii_name="toListTags")
    def to_list_tags(self) -> "Cloudsearch":
        '''(experimental) Displays all of the resource tags for an Amazon CloudSearch domain.

        Access Level: Read

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_ListTags.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toListTags", []))

    @jsii.member(jsii_name="toRemoveTags")
    def to_remove_tags(self) -> "Cloudsearch":
        '''(experimental) Removes the specified resource tags from an Amazon ES domain.

        Access Level: Tagging

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_RemoveTags.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toRemoveTags", []))

    @jsii.member(jsii_name="toSearch")
    def to_search(self) -> "Cloudsearch":
        '''(experimental) Allows access to the search operations.

        Access Level: Read

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/configuring-access.html#cloudsearch-actions

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toSearch", []))

    @jsii.member(jsii_name="toSuggest")
    def to_suggest(self) -> "Cloudsearch":
        '''(experimental) Allows access to the suggest operations.

        Access Level: Read

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/configuring-access.html#cloudsearch-actions

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toSuggest", []))

    @jsii.member(jsii_name="toUpdateAvailabilityOptions")
    def to_update_availability_options(self) -> "Cloudsearch":
        '''(experimental) Configures the availability options for a domain.

        Access Level: Write

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_UpdateAvailabilityOptions.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toUpdateAvailabilityOptions", []))

    @jsii.member(jsii_name="toUpdateDomainEndpointOptions")
    def to_update_domain_endpoint_options(self) -> "Cloudsearch":
        '''(experimental) Configures the domain endpoint options for a domain.

        Access Level: Write

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_UpdateDomainEndpointOptions.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toUpdateDomainEndpointOptions", []))

    @jsii.member(jsii_name="toUpdateScalingParameters")
    def to_update_scaling_parameters(self) -> "Cloudsearch":
        '''(experimental) Configures scaling parameters for a domain.

        Access Level: Write

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_UpdateScalingParameters.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toUpdateScalingParameters", []))

    @jsii.member(jsii_name="toUpdateServiceAccessPolicies")
    def to_update_service_access_policies(self) -> "Cloudsearch":
        '''(experimental) Configures the access rules that control access to the domain's document and search endpoints.

        Access Level: Permissions management

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_UpdateServiceAccessPolicies.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toUpdateServiceAccessPolicies", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Cloudshell(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Cloudshell",
):
    '''(experimental) Statement provider for service `cloudshell <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscloudshell.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `cloudshell <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscloudshell.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Cloudshell, self, [sid])

    @jsii.member(jsii_name="onEnvironment")
    def on_environment(
        self,
        environment_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudshell":
        '''(experimental) Adds a resource of type Environment to the statement.

        https://docs.aws.amazon.com/cloudshell/latest/userguide/sec-auth-with-identities.html#Environment

        :param environment_id: - Identifier for the environmentId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Cloudshell", jsii.invoke(self, "onEnvironment", [environment_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateEnvironment")
    def to_create_environment(self) -> "Cloudshell":
        '''(experimental) Grants permissions to create a CloudShell environment.

        Access Level: Write

        https://docs.aws.amazon.com/cloudshell/latest/userguide/sec-auth-with-identities.html#CreateEnvironment

        :stability: experimental
        '''
        return typing.cast("Cloudshell", jsii.invoke(self, "toCreateEnvironment", []))

    @jsii.member(jsii_name="toCreateSession")
    def to_create_session(self) -> "Cloudshell":
        '''(experimental) Grants permissions to connect to a CloudShell environment from the AWS Console.

        Access Level: Write

        https://docs.aws.amazon.com/cloudshell/latest/userguide/sec-auth-with-identities.html#CreateSession

        :stability: experimental
        '''
        return typing.cast("Cloudshell", jsii.invoke(self, "toCreateSession", []))

    @jsii.member(jsii_name="toDeleteEnvironment")
    def to_delete_environment(self) -> "Cloudshell":
        '''(experimental) Grants permission to delete a CloudShell environment.

        Access Level: Write

        https://docs.aws.amazon.com/cloudshell/latest/userguide/sec-auth-with-identities.html#DeleteEnvironment

        :stability: experimental
        '''
        return typing.cast("Cloudshell", jsii.invoke(self, "toDeleteEnvironment", []))

    @jsii.member(jsii_name="toGetEnvironmentStatus")
    def to_get_environment_status(self) -> "Cloudshell":
        '''(experimental) Grants permission to read a CloudShell environment status.

        Access Level: Read

        https://docs.aws.amazon.com/cloudshell/latest/userguide/sec-auth-with-identities.html#GetEnvironmentStatus

        :stability: experimental
        '''
        return typing.cast("Cloudshell", jsii.invoke(self, "toGetEnvironmentStatus", []))

    @jsii.member(jsii_name="toGetFileDownloadUrls")
    def to_get_file_download_urls(self) -> "Cloudshell":
        '''(experimental) Grants permissions to download files from a CloudShell environment.

        Access Level: Write

        https://docs.aws.amazon.com/cloudshell/latest/userguide/sec-auth-with-identities.html#GetFileDownloadUrls

        :stability: experimental
        '''
        return typing.cast("Cloudshell", jsii.invoke(self, "toGetFileDownloadUrls", []))

    @jsii.member(jsii_name="toGetFileUploadUrls")
    def to_get_file_upload_urls(self) -> "Cloudshell":
        '''(experimental) Grants permissions to upload files to a CloudShell environment.

        Access Level: Write

        https://docs.aws.amazon.com/cloudshell/latest/userguide/sec-auth-with-identities.html#GetFileUploadUrls

        :stability: experimental
        '''
        return typing.cast("Cloudshell", jsii.invoke(self, "toGetFileUploadUrls", []))

    @jsii.member(jsii_name="toPutCredentials")
    def to_put_credentials(self) -> "Cloudshell":
        '''(experimental) Grants permissions to forward console credentials to the environment.

        Access Level: Write

        https://docs.aws.amazon.com/cloudshell/latest/userguide/sec-auth-with-identities.html#PutCredentials

        :stability: experimental
        '''
        return typing.cast("Cloudshell", jsii.invoke(self, "toPutCredentials", []))

    @jsii.member(jsii_name="toStartEnvironment")
    def to_start_environment(self) -> "Cloudshell":
        '''(experimental) Grants permission to start a stopped CloudShell environment.

        Access Level: Write

        https://docs.aws.amazon.com/cloudshell/latest/userguide/sec-auth-with-identities.html#StartEnvironment

        :stability: experimental
        '''
        return typing.cast("Cloudshell", jsii.invoke(self, "toStartEnvironment", []))

    @jsii.member(jsii_name="toStopEnvironment")
    def to_stop_environment(self) -> "Cloudshell":
        '''(experimental) Grants permission to stop a running CloudShell environment.

        Access Level: Write

        https://docs.aws.amazon.com/cloudshell/latest/userguide/sec-auth-with-identities.html#StopEnvironment

        :stability: experimental
        '''
        return typing.cast("Cloudshell", jsii.invoke(self, "toStopEnvironment", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Cloudtrail(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Cloudtrail",
):
    '''(experimental) Statement provider for service `cloudtrail <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscloudtrail.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `cloudtrail <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscloudtrail.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Cloudtrail, self, [sid])

    @jsii.member(jsii_name="onTrail")
    def on_trail(
        self,
        trail_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudtrail":
        '''(experimental) Adds a resource of type trail to the statement.

        https://docs.aws.amazon.com/awscloudtrail/latest/userguide/how-cloudtrail-works.html

        :param trail_name: - Identifier for the trailName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "onTrail", [trail_name, account, region, partition]))

    @jsii.member(jsii_name="toAddTags")
    def to_add_tags(self) -> "Cloudtrail":
        '''(experimental) Grants permission to add one or more tags to a trail, up to a limit of 10.

        Access Level: Tagging

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_AddTags.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toAddTags", []))

    @jsii.member(jsii_name="toCreateTrail")
    def to_create_trail(self) -> "Cloudtrail":
        '''(experimental) Grants permission to create a trail that specifies the settings for delivery of log data to an Amazon S3 bucket.

        Access Level: Write

        Dependent actions:

        - s3:PutObject

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_CreateTrail.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toCreateTrail", []))

    @jsii.member(jsii_name="toDeleteTrail")
    def to_delete_trail(self) -> "Cloudtrail":
        '''(experimental) Grants permission to delete a trail.

        Access Level: Write

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_DeleteTrail.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toDeleteTrail", []))

    @jsii.member(jsii_name="toDescribeTrails")
    def to_describe_trails(self) -> "Cloudtrail":
        '''(experimental) Grants permission to list settings for the trails associated with the current region for your account.

        Access Level: Read

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_DescribeTrails.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toDescribeTrails", []))

    @jsii.member(jsii_name="toGetEventSelectors")
    def to_get_event_selectors(self) -> "Cloudtrail":
        '''(experimental) Grants permission to list settings for event selectors configured for a trail.

        Access Level: Read

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_GetEventSelectors.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toGetEventSelectors", []))

    @jsii.member(jsii_name="toGetInsightSelectors")
    def to_get_insight_selectors(self) -> "Cloudtrail":
        '''(experimental) Grants permission to list CloudTrail Insights selectors that are configured for a trail.

        Access Level: Read

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_GetInsightSelectors.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toGetInsightSelectors", []))

    @jsii.member(jsii_name="toGetTrail")
    def to_get_trail(self) -> "Cloudtrail":
        '''(experimental) Grants permission to list settings for the trail.

        Access Level: Read

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_GetTrail.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toGetTrail", []))

    @jsii.member(jsii_name="toGetTrailStatus")
    def to_get_trail_status(self) -> "Cloudtrail":
        '''(experimental) Grants permission to retrieve a JSON-formatted list of information about the specified trail.

        Access Level: Read

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_GetTrailStatus.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toGetTrailStatus", []))

    @jsii.member(jsii_name="toListPublicKeys")
    def to_list_public_keys(self) -> "Cloudtrail":
        '''(experimental) Grants permission to list the public keys whose private keys were used to sign trail digest files within a specified time range.

        Access Level: Read

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_ListPublicKeys.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toListPublicKeys", []))

    @jsii.member(jsii_name="toListTags")
    def to_list_tags(self) -> "Cloudtrail":
        '''(experimental) Grants permission to list the tags for trails in the current region.

        Access Level: Read

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_ListTags.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toListTags", []))

    @jsii.member(jsii_name="toListTrails")
    def to_list_trails(self) -> "Cloudtrail":
        '''(experimental) Grants permission to list trails associated with the current region for your account.

        Access Level: List

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_ListTrails.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toListTrails", []))

    @jsii.member(jsii_name="toLookupEvents")
    def to_lookup_events(self) -> "Cloudtrail":
        '''(experimental) Grants permission to look up API activity events captured by CloudTrail that create, update, or delete resources in your account.

        Access Level: Read

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_LookupEvents.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toLookupEvents", []))

    @jsii.member(jsii_name="toPutEventSelectors")
    def to_put_event_selectors(self) -> "Cloudtrail":
        '''(experimental) Grants permission to create and update event selectors for a trail.

        Access Level: Write

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_PutEventSelectors.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toPutEventSelectors", []))

    @jsii.member(jsii_name="toPutInsightSelectors")
    def to_put_insight_selectors(self) -> "Cloudtrail":
        '''(experimental) Grants permission to create and update CloudTrail Insights selectors for a trail.

        Access Level: Write

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_PutInsightSelectors.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toPutInsightSelectors", []))

    @jsii.member(jsii_name="toRemoveTags")
    def to_remove_tags(self) -> "Cloudtrail":
        '''(experimental) Grants permission to remove tags from a trail.

        Access Level: Tagging

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_RemoveTags.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toRemoveTags", []))

    @jsii.member(jsii_name="toStartLogging")
    def to_start_logging(self) -> "Cloudtrail":
        '''(experimental) Grants permission to start the recording of AWS API calls and log file delivery for a trail.

        Access Level: Write

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_StartLogging.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toStartLogging", []))

    @jsii.member(jsii_name="toStopLogging")
    def to_stop_logging(self) -> "Cloudtrail":
        '''(experimental) Grants permission to stop the recording of AWS API calls and log file delivery for a trail.

        Access Level: Write

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_StopLogging.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toStopLogging", []))

    @jsii.member(jsii_name="toUpdateTrail")
    def to_update_trail(self) -> "Cloudtrail":
        '''(experimental) Grants permission to update the settings that specify delivery of log files.

        Access Level: Write

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_UpdateTrail.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toUpdateTrail", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Cloudwatch(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Cloudwatch",
):
    '''(experimental) Statement provider for service `cloudwatch <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudwatch.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `cloudwatch <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudwatch.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Cloudwatch, self, [sid])

    @jsii.member(jsii_name="ifNamespace")
    def if_namespace(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Cloudwatch":
        '''(experimental) Filters actions based on the presence of optional namespace values.

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/iam-cw-condition-keys-namespace.html

        Applies to actions:

        - .toPutMetricData()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "ifNamespace", [value, operator]))

    @jsii.member(jsii_name="onAlarm")
    def on_alarm(
        self,
        alarm_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudwatch":
        '''(experimental) Adds a resource of type alarm to the statement.

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/auth-and-access-control-cw.html

        :param alarm_name: - Identifier for the alarmName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "onAlarm", [alarm_name, account, region, partition]))

    @jsii.member(jsii_name="onDashboard")
    def on_dashboard(
        self,
        dashboard_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudwatch":
        '''(experimental) Adds a resource of type dashboard to the statement.

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/auth-and-access-control-cw.html

        :param dashboard_name: - Identifier for the dashboardName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "onDashboard", [dashboard_name, account, partition]))

    @jsii.member(jsii_name="onInsightRule")
    def on_insight_rule(
        self,
        insight_rule_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudwatch":
        '''(experimental) Adds a resource of type insight-rule to the statement.

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/auth-and-access-control-cw.html

        :param insight_rule_name: - Identifier for the insightRuleName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "onInsightRule", [insight_rule_name, account, region, partition]))

    @jsii.member(jsii_name="onMetricStream")
    def on_metric_stream(
        self,
        metric_stream_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudwatch":
        '''(experimental) Adds a resource of type metric-stream to the statement.

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/auth-and-access-control-cw.html

        :param metric_stream_name: - Identifier for the metricStreamName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "onMetricStream", [metric_stream_name, account, region, partition]))

    @jsii.member(jsii_name="toDeleteAlarms")
    def to_delete_alarms(self) -> "Cloudwatch":
        '''(experimental) Grants permission to delete a collection of alarms.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DeleteAlarms.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toDeleteAlarms", []))

    @jsii.member(jsii_name="toDeleteAnomalyDetector")
    def to_delete_anomaly_detector(self) -> "Cloudwatch":
        '''(experimental) Grants permission to delete the specified anomaly detection model from your account.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DeleteAnomalyDetector.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toDeleteAnomalyDetector", []))

    @jsii.member(jsii_name="toDeleteDashboards")
    def to_delete_dashboards(self) -> "Cloudwatch":
        '''(experimental) Grants permission to delete all CloudWatch dashboards that you specify.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DeleteDashboards.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toDeleteDashboards", []))

    @jsii.member(jsii_name="toDeleteInsightRules")
    def to_delete_insight_rules(self) -> "Cloudwatch":
        '''(experimental) Grants permission to delete a collection of insight rules.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DeleteInsightRules.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toDeleteInsightRules", []))

    @jsii.member(jsii_name="toDeleteMetricStream")
    def to_delete_metric_stream(self) -> "Cloudwatch":
        '''(experimental) Grants permission to delete the CloudWatch metric stream that you specify.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DeleteMetricStream.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toDeleteMetricStream", []))

    @jsii.member(jsii_name="toDescribeAlarmHistory")
    def to_describe_alarm_history(self) -> "Cloudwatch":
        '''(experimental) Grants permission to retrieve the history for the specified alarm.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DescribeAlarmHistory.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toDescribeAlarmHistory", []))

    @jsii.member(jsii_name="toDescribeAlarms")
    def to_describe_alarms(self) -> "Cloudwatch":
        '''(experimental) Grants permission to describe all alarms, currently owned by the user's account.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DescribeAlarms.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toDescribeAlarms", []))

    @jsii.member(jsii_name="toDescribeAlarmsForMetric")
    def to_describe_alarms_for_metric(self) -> "Cloudwatch":
        '''(experimental) Grants permission to describe all alarms configured on the specified metric, currently owned by the user's account.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DescribeAlarmsForMetric.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toDescribeAlarmsForMetric", []))

    @jsii.member(jsii_name="toDescribeAnomalyDetectors")
    def to_describe_anomaly_detectors(self) -> "Cloudwatch":
        '''(experimental) Grants permission to list the anomaly detection models that you have created in your account.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DescribeAnomalyDetectors.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toDescribeAnomalyDetectors", []))

    @jsii.member(jsii_name="toDescribeInsightRules")
    def to_describe_insight_rules(self) -> "Cloudwatch":
        '''(experimental) Grants permission to describe all insight rules, currently owned by the user's account.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DescribeInsightRules.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toDescribeInsightRules", []))

    @jsii.member(jsii_name="toDisableAlarmActions")
    def to_disable_alarm_actions(self) -> "Cloudwatch":
        '''(experimental) Grants permission to disable actions for a collection of alarms.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DisableAlarmActions.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toDisableAlarmActions", []))

    @jsii.member(jsii_name="toDisableInsightRules")
    def to_disable_insight_rules(self) -> "Cloudwatch":
        '''(experimental) Grants permission to disable a collection of insight rules.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DisableInsightRules.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toDisableInsightRules", []))

    @jsii.member(jsii_name="toEnableAlarmActions")
    def to_enable_alarm_actions(self) -> "Cloudwatch":
        '''(experimental) Grants permission to enable actions for a collection of alarms.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_EnableAlarmActions.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toEnableAlarmActions", []))

    @jsii.member(jsii_name="toEnableInsightRules")
    def to_enable_insight_rules(self) -> "Cloudwatch":
        '''(experimental) Grants permission to enable a collection of insight rules.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_EnableInsightRules.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toEnableInsightRules", []))

    @jsii.member(jsii_name="toGetDashboard")
    def to_get_dashboard(self) -> "Cloudwatch":
        '''(experimental) Grants permission to display the details of the CloudWatch dashboard you specify.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetDashboard.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toGetDashboard", []))

    @jsii.member(jsii_name="toGetInsightRuleReport")
    def to_get_insight_rule_report(self) -> "Cloudwatch":
        '''(experimental) Grants permission to return the top-N report of unique contributors over a time range for a given insight rule.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetInsightRuleReport.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toGetInsightRuleReport", []))

    @jsii.member(jsii_name="toGetMetricData")
    def to_get_metric_data(self) -> "Cloudwatch":
        '''(experimental) Grants permission to retrieve batch amounts of CloudWatch metric data and perform metric math on retrieved data.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetMetricData.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toGetMetricData", []))

    @jsii.member(jsii_name="toGetMetricStatistics")
    def to_get_metric_statistics(self) -> "Cloudwatch":
        '''(experimental) Grants permission to retrieve statistics for the specified metric.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetMetricStatistics.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toGetMetricStatistics", []))

    @jsii.member(jsii_name="toGetMetricStream")
    def to_get_metric_stream(self) -> "Cloudwatch":
        '''(experimental) Grants permission to return the details of a CloudWatch metric stream.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetMetricStream.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toGetMetricStream", []))

    @jsii.member(jsii_name="toGetMetricWidgetImage")
    def to_get_metric_widget_image(self) -> "Cloudwatch":
        '''(experimental) Grants permission to retrieve snapshots of metric widgets.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetMetricWidgetImage.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toGetMetricWidgetImage", []))

    @jsii.member(jsii_name="toListDashboards")
    def to_list_dashboards(self) -> "Cloudwatch":
        '''(experimental) Grants permission to return a list of all CloudWatch dashboards in your account.

        Access Level: List

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_ListDashboards.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toListDashboards", []))

    @jsii.member(jsii_name="toListMetrics")
    def to_list_metrics(self) -> "Cloudwatch":
        '''(experimental) Grants permission to retrieve a list of valid metrics stored for the AWS account owner.

        Access Level: List

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_ListMetrics.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toListMetrics", []))

    @jsii.member(jsii_name="toListMetricStreams")
    def to_list_metric_streams(self) -> "Cloudwatch":
        '''(experimental) Grants permission to return a list of all CloudWatch metric streams in your account.

        Access Level: List

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_ListMetricStreams.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toListMetricStreams", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Cloudwatch":
        '''(experimental) Grants permission to list tags for an Amazon CloudWatch resource.

        Access Level: List

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutAnomalyDetector")
    def to_put_anomaly_detector(self) -> "Cloudwatch":
        '''(experimental) Grants permission to create or update an anomaly detection model for a CloudWatch metric.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_PutAnomalyDetector.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toPutAnomalyDetector", []))

    @jsii.member(jsii_name="toPutCompositeAlarm")
    def to_put_composite_alarm(self) -> "Cloudwatch":
        '''(experimental) Grants permission to create or update a composite alarm.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_PutCompositeAlarm.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toPutCompositeAlarm", []))

    @jsii.member(jsii_name="toPutDashboard")
    def to_put_dashboard(self) -> "Cloudwatch":
        '''(experimental) Grants permission to create a CloudWatch dashboard, or update an existing dashboard if it already exists.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_PutDashboard.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toPutDashboard", []))

    @jsii.member(jsii_name="toPutInsightRule")
    def to_put_insight_rule(self) -> "Cloudwatch":
        '''(experimental) Grants permission to create a new insight rule or replace an existing insight rule.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_PutInsightRule.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toPutInsightRule", []))

    @jsii.member(jsii_name="toPutMetricAlarm")
    def to_put_metric_alarm(self) -> "Cloudwatch":
        '''(experimental) Grants permission to create or update an alarm and associates it with the specified Amazon CloudWatch metric.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_PutMetricAlarm.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toPutMetricAlarm", []))

    @jsii.member(jsii_name="toPutMetricData")
    def to_put_metric_data(self) -> "Cloudwatch":
        '''(experimental) Grants permission to publish metric data points to Amazon CloudWatch.

        Access Level: Write

        Possible conditions:

        - .ifNamespace()

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_PutMetricData.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toPutMetricData", []))

    @jsii.member(jsii_name="toPutMetricStream")
    def to_put_metric_stream(self) -> "Cloudwatch":
        '''(experimental) Grants permission to create a CloudWatch metric stream, or update an existing metric stream if it already exists.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_PutMetricStream.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toPutMetricStream", []))

    @jsii.member(jsii_name="toSetAlarmState")
    def to_set_alarm_state(self) -> "Cloudwatch":
        '''(experimental) Grants permission to temporarily set the state of an alarm for testing purposes.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_SetAlarmState.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toSetAlarmState", []))

    @jsii.member(jsii_name="toStartMetricStreams")
    def to_start_metric_streams(self) -> "Cloudwatch":
        '''(experimental) Grants permission to start all CloudWatch metric streams that you specify.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_StartMetricStreams.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toStartMetricStreams", []))

    @jsii.member(jsii_name="toStopMetricStreams")
    def to_stop_metric_streams(self) -> "Cloudwatch":
        '''(experimental) Grants permission to stop all CloudWatch metric streams that you specify.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_StopMetricStreams.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toStopMetricStreams", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Cloudwatch":
        '''(experimental) Grants permission to add tags to an Amazon CloudWatch resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Cloudwatch":
        '''(experimental) Grants permission to remove a tag from an Amazon CloudWatch resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toUntagResource", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Codeartifact(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Codeartifact",
):
    '''(experimental) Statement provider for service `codeartifact <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscodeartifact.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `codeartifact <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscodeartifact.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Codeartifact, self, [sid])

    @jsii.member(jsii_name="onDomain")
    def on_domain(
        self,
        domain_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codeartifact":
        '''(experimental) Adds a resource of type domain to the statement.

        https://docs.aws.amazon.com/codeartifact/latest/userguide/auth-and-access-control-iam-access-control-identity-based.html#arn-formats

        :param domain_name: - Identifier for the domainName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "onDomain", [domain_name, account, region, partition]))

    @jsii.member(jsii_name="onPackage")
    def on_package(
        self,
        domain_name: builtins.str,
        repository_name: builtins.str,
        package_format: builtins.str,
        package_namespace: builtins.str,
        package_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codeartifact":
        '''(experimental) Adds a resource of type package to the statement.

        https://docs.aws.amazon.com/codeartifact/latest/userguide/repo-policies.html

        :param domain_name: - Identifier for the domainName.
        :param repository_name: - Identifier for the repositoryName.
        :param package_format: - Identifier for the packageFormat.
        :param package_namespace: - Identifier for the packageNamespace.
        :param package_name: - Identifier for the packageName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "onPackage", [domain_name, repository_name, package_format, package_namespace, package_name, account, region, partition]))

    @jsii.member(jsii_name="onRepository")
    def on_repository(
        self,
        domain_name: builtins.str,
        repository_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codeartifact":
        '''(experimental) Adds a resource of type repository to the statement.

        https://docs.aws.amazon.com/codeartifact/latest/userguide/repo-policies.html

        :param domain_name: - Identifier for the domainName.
        :param repository_name: - Identifier for the repositoryName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "onRepository", [domain_name, repository_name, account, region, partition]))

    @jsii.member(jsii_name="toAssociateExternalConnection")
    def to_associate_external_connection(self) -> "Codeartifact":
        '''(experimental) Grants permission to add an external connection to a repository.

        Access Level: Write

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_AssociateExternalConnection.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toAssociateExternalConnection", []))

    @jsii.member(jsii_name="toAssociateWithDownstreamRepository")
    def to_associate_with_downstream_repository(self) -> "Codeartifact":
        '''(experimental) Grants permission to associate an existing repository as an upstream repository to another repository.

        Access Level: Write

        https://docs.aws.amazon.com/codeartifact/latest/userguide/repos-upstream.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toAssociateWithDownstreamRepository", []))

    @jsii.member(jsii_name="toCopyPackageVersions")
    def to_copy_package_versions(self) -> "Codeartifact":
        '''(experimental) Grants permission to copy package versions from one repository to another repository in the same domain.

        Access Level: Write

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_CopyPackageVersions.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toCopyPackageVersions", []))

    @jsii.member(jsii_name="toCreateDomain")
    def to_create_domain(self) -> "Codeartifact":
        '''(experimental) Grants permission to create a new domain.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_CreateDomain.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toCreateDomain", []))

    @jsii.member(jsii_name="toCreateRepository")
    def to_create_repository(self) -> "Codeartifact":
        '''(experimental) Grants permission to create a new repository.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_CreateRepository.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toCreateRepository", []))

    @jsii.member(jsii_name="toDeleteDomain")
    def to_delete_domain(self) -> "Codeartifact":
        '''(experimental) Grants permission to delete a domain.

        Access Level: Write

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_DeleteDomain.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toDeleteDomain", []))

    @jsii.member(jsii_name="toDeleteDomainPermissionsPolicy")
    def to_delete_domain_permissions_policy(self) -> "Codeartifact":
        '''(experimental) Grants permission to delete the resource policy set on a domain.

        Access Level: Permissions management

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_DeleteDomainPermissionsPolicy.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toDeleteDomainPermissionsPolicy", []))

    @jsii.member(jsii_name="toDeletePackageVersions")
    def to_delete_package_versions(self) -> "Codeartifact":
        '''(experimental) Grants permission to delete package versions.

        Access Level: Write

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_DeletePackageVersions.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toDeletePackageVersions", []))

    @jsii.member(jsii_name="toDeleteRepository")
    def to_delete_repository(self) -> "Codeartifact":
        '''(experimental) Grants permission to delete a repository.

        Access Level: Write

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_DeleteRepository.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toDeleteRepository", []))

    @jsii.member(jsii_name="toDeleteRepositoryPermissionsPolicy")
    def to_delete_repository_permissions_policy(self) -> "Codeartifact":
        '''(experimental) Grants permission to delete the resource policy set on a repository.

        Access Level: Permissions management

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_DeleteRepositoryPermissionsPolicy.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toDeleteRepositoryPermissionsPolicy", []))

    @jsii.member(jsii_name="toDescribeDomain")
    def to_describe_domain(self) -> "Codeartifact":
        '''(experimental) Grants permission to return information about a domain.

        Access Level: Read

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_DescribeDomain.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toDescribeDomain", []))

    @jsii.member(jsii_name="toDescribePackageVersion")
    def to_describe_package_version(self) -> "Codeartifact":
        '''(experimental) Grants permission to return information about a package version.

        Access Level: Read

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_DescribePackageVersion.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toDescribePackageVersion", []))

    @jsii.member(jsii_name="toDescribeRepository")
    def to_describe_repository(self) -> "Codeartifact":
        '''(experimental) Grants permission to return detailed information about a repository.

        Access Level: Read

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_DescribeRepository.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toDescribeRepository", []))

    @jsii.member(jsii_name="toDisassociateExternalConnection")
    def to_disassociate_external_connection(self) -> "Codeartifact":
        '''(experimental) Grants permission to disassociate an external connection from a repository.

        Access Level: Write

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_DisassociateExternalConnection.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toDisassociateExternalConnection", []))

    @jsii.member(jsii_name="toDisposePackageVersions")
    def to_dispose_package_versions(self) -> "Codeartifact":
        '''(experimental) Grants permission to set the status of package versions to Disposed and delete their assets.

        Access Level: Write

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_DisposePackageVersions.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toDisposePackageVersions", []))

    @jsii.member(jsii_name="toGetAuthorizationToken")
    def to_get_authorization_token(self) -> "Codeartifact":
        '''(experimental) Grants permission to generate a temporary authentication token for accessing repositories in a domain.

        Access Level: Read

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_GetAuthorizationToken.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toGetAuthorizationToken", []))

    @jsii.member(jsii_name="toGetDomainPermissionsPolicy")
    def to_get_domain_permissions_policy(self) -> "Codeartifact":
        '''(experimental) Grants permission to return a domain's resource policy.

        Access Level: Read

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_GetDomainPermissionsPolicy.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toGetDomainPermissionsPolicy", []))

    @jsii.member(jsii_name="toGetPackageVersionAsset")
    def to_get_package_version_asset(self) -> "Codeartifact":
        '''(experimental) Grants permission to return an asset (or file) that is part of a package version.

        Access Level: Read

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_GetPackageVersionAsset.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toGetPackageVersionAsset", []))

    @jsii.member(jsii_name="toGetPackageVersionReadme")
    def to_get_package_version_readme(self) -> "Codeartifact":
        '''(experimental) Grants permission to return a package version's readme file.

        Access Level: Read

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_GetPackageVersionReadme.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toGetPackageVersionReadme", []))

    @jsii.member(jsii_name="toGetRepositoryEndpoint")
    def to_get_repository_endpoint(self) -> "Codeartifact":
        '''(experimental) Grants permission to return an endpoint for a repository.

        Access Level: Read

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_GetRepositoryEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toGetRepositoryEndpoint", []))

    @jsii.member(jsii_name="toGetRepositoryPermissionsPolicy")
    def to_get_repository_permissions_policy(self) -> "Codeartifact":
        '''(experimental) Grants permission to return a repository's resource policy.

        Access Level: Read

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_GetRepositoryPermissionsPolicy.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toGetRepositoryPermissionsPolicy", []))

    @jsii.member(jsii_name="toListDomains")
    def to_list_domains(self) -> "Codeartifact":
        '''(experimental) Grants permission to list the domains in the current user's AWS account.

        Access Level: List

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_ListDomains.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toListDomains", []))

    @jsii.member(jsii_name="toListPackages")
    def to_list_packages(self) -> "Codeartifact":
        '''(experimental) Grants permission to list the packages in a repository.

        Access Level: List

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_ListPackages.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toListPackages", []))

    @jsii.member(jsii_name="toListPackageVersionAssets")
    def to_list_package_version_assets(self) -> "Codeartifact":
        '''(experimental) Grants permission to list a package version's assets.

        Access Level: List

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_ListPackageVersionAssets.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toListPackageVersionAssets", []))

    @jsii.member(jsii_name="toListPackageVersionDependencies")
    def to_list_package_version_dependencies(self) -> "Codeartifact":
        '''(experimental) Grants permission to list the direct dependencies of a package version.

        Access Level: List

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_ListPackageVersionDependencies.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toListPackageVersionDependencies", []))

    @jsii.member(jsii_name="toListPackageVersions")
    def to_list_package_versions(self) -> "Codeartifact":
        '''(experimental) Grants permission to list a package's versions.

        Access Level: List

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_ListPackageVersions.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toListPackageVersions", []))

    @jsii.member(jsii_name="toListRepositories")
    def to_list_repositories(self) -> "Codeartifact":
        '''(experimental) Grants permission to list the repositories administered by the calling account.

        Access Level: List

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_ListRepositories.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toListRepositories", []))

    @jsii.member(jsii_name="toListRepositoriesInDomain")
    def to_list_repositories_in_domain(self) -> "Codeartifact":
        '''(experimental) Grants permission to list the repositories in a domain.

        Access Level: List

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_ListRepositoriesInDomain.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toListRepositoriesInDomain", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Codeartifact":
        '''(experimental) Grants permission to list tags for a CodeArtifact resource.

        Access Level: List

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPublishPackageVersion")
    def to_publish_package_version(self) -> "Codeartifact":
        '''(experimental) Grants permission to publish assets and metadata to a repository endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/codeartifact/latest/userguide/repo-policies.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toPublishPackageVersion", []))

    @jsii.member(jsii_name="toPutDomainPermissionsPolicy")
    def to_put_domain_permissions_policy(self) -> "Codeartifact":
        '''(experimental) Grants permission to attach a resource policy to a domain.

        Access Level: Write

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_PutDomainPermissionsPolicy.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toPutDomainPermissionsPolicy", []))

    @jsii.member(jsii_name="toPutPackageMetadata")
    def to_put_package_metadata(self) -> "Codeartifact":
        '''(experimental) Grants permission to add, modify or remove package metadata using a repository endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/codeartifact/latest/userguide/repo-policies.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toPutPackageMetadata", []))

    @jsii.member(jsii_name="toPutRepositoryPermissionsPolicy")
    def to_put_repository_permissions_policy(self) -> "Codeartifact":
        '''(experimental) Grants permission to attach a resource policy to a repository.

        Access Level: Write

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_PutRepositoryPermissionsPolicy.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toPutRepositoryPermissionsPolicy", []))

    @jsii.member(jsii_name="toReadFromRepository")
    def to_read_from_repository(self) -> "Codeartifact":
        '''(experimental) Grants permission to return package assets and metadata from a repository endpoint.

        Access Level: Read

        https://docs.aws.amazon.com/codeartifact/latest/userguide/repo-policies.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toReadFromRepository", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Codeartifact":
        '''(experimental) Grants permission to tag a CodeArtifact resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Codeartifact":
        '''(experimental) Grants permission to remove a tag from a CodeArtifact resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdatePackageVersionsStatus")
    def to_update_package_versions_status(self) -> "Codeartifact":
        '''(experimental) Grants permission to modify the status of one or more versions of a package.

        Access Level: Write

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_UpdatePackageVersionsStatus.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toUpdatePackageVersionsStatus", []))

    @jsii.member(jsii_name="toUpdateRepository")
    def to_update_repository(self) -> "Codeartifact":
        '''(experimental) Grants permission to modify the properties of a repository.

        Access Level: Write

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_UpdateRepository.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toUpdateRepository", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Codebuild(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Codebuild",
):
    '''(experimental) Statement provider for service `codebuild <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscodebuild.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `codebuild <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscodebuild.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Codebuild, self, [sid])

    @jsii.member(jsii_name="onBuild")
    def on_build(
        self,
        build_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codebuild":
        '''(experimental) Adds a resource of type build to the statement.

        https://docs.aws.amazon.com/codebuild/latest/userguide/auth-and-access-control-iam-access-control-identity-based.html#arn-formats

        :param build_id: - Identifier for the buildId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "onBuild", [build_id, account, region, partition]))

    @jsii.member(jsii_name="onBuildBatch")
    def on_build_batch(
        self,
        build_batch_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codebuild":
        '''(experimental) Adds a resource of type build-batch to the statement.

        https://docs.aws.amazon.com/codebuild/latest/userguide/auth-and-access-control-iam-access-control-identity-based.html#arn-formats

        :param build_batch_id: - Identifier for the buildBatchId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "onBuildBatch", [build_batch_id, account, region, partition]))

    @jsii.member(jsii_name="onProject")
    def on_project(
        self,
        project_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codebuild":
        '''(experimental) Adds a resource of type project to the statement.

        https://docs.aws.amazon.com/codebuild/latest/userguide/auth-and-access-control-iam-access-control-identity-based.html#arn-formats

        :param project_name: - Identifier for the projectName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "onProject", [project_name, account, region, partition]))

    @jsii.member(jsii_name="onReport")
    def on_report(
        self,
        report_group_name: builtins.str,
        report_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codebuild":
        '''(experimental) Adds a resource of type report to the statement.

        https://docs.aws.amazon.com/codebuild/latest/userguide/auth-and-access-control-iam-access-control-identity-based.html#arn-formats

        :param report_group_name: - Identifier for the reportGroupName.
        :param report_id: - Identifier for the reportId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "onReport", [report_group_name, report_id, account, region, partition]))

    @jsii.member(jsii_name="onReportGroup")
    def on_report_group(
        self,
        report_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codebuild":
        '''(experimental) Adds a resource of type report-group to the statement.

        https://docs.aws.amazon.com/codebuild/latest/userguide/auth-and-access-control-iam-access-control-identity-based.html#arn-formats

        :param report_group_name: - Identifier for the reportGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "onReportGroup", [report_group_name, account, region, partition]))

    @jsii.member(jsii_name="toBatchDeleteBuilds")
    def to_batch_delete_builds(self) -> "Codebuild":
        '''(experimental) Deletes one or more builds.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_BatchDeleteBuilds.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toBatchDeleteBuilds", []))

    @jsii.member(jsii_name="toBatchGetBuildBatches")
    def to_batch_get_build_batches(self) -> "Codebuild":
        '''(experimental) Gets information about one or more build batches.

        Access Level: Read

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_BatchGetBuildBatches.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toBatchGetBuildBatches", []))

    @jsii.member(jsii_name="toBatchGetBuilds")
    def to_batch_get_builds(self) -> "Codebuild":
        '''(experimental) Gets information about one or more builds.

        Access Level: Read

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_BatchGetBuilds.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toBatchGetBuilds", []))

    @jsii.member(jsii_name="toBatchGetProjects")
    def to_batch_get_projects(self) -> "Codebuild":
        '''(experimental) Gets information about one or more build projects.

        Access Level: Read

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_BatchGetProjects.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toBatchGetProjects", []))

    @jsii.member(jsii_name="toBatchGetReportGroups")
    def to_batch_get_report_groups(self) -> "Codebuild":
        '''(experimental) Returns an array of ReportGroup objects that are specified by the input reportGroupArns parameter.

        Access Level: Read

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_BatchGetReportGroups.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toBatchGetReportGroups", []))

    @jsii.member(jsii_name="toBatchGetReports")
    def to_batch_get_reports(self) -> "Codebuild":
        '''(experimental) Returns an array of the Report objects specified by the input reportArns parameter.

        Access Level: Read

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_BatchGetReports.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toBatchGetReports", []))

    @jsii.member(jsii_name="toBatchPutCodeCoverages")
    def to_batch_put_code_coverages(self) -> "Codebuild":
        '''(experimental) Adds or updates information about a report.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/userguide/auth-and-access-control-iam-identity-based-access-control.html#console-policies

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toBatchPutCodeCoverages", []))

    @jsii.member(jsii_name="toBatchPutTestCases")
    def to_batch_put_test_cases(self) -> "Codebuild":
        '''(experimental) Adds or updates information about a report.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/userguide/auth-and-access-control-iam-identity-based-access-control.html#console-policies

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toBatchPutTestCases", []))

    @jsii.member(jsii_name="toCreateProject")
    def to_create_project(self) -> "Codebuild":
        '''(experimental) Creates a build project.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_CreateProject.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toCreateProject", []))

    @jsii.member(jsii_name="toCreateReport")
    def to_create_report(self) -> "Codebuild":
        '''(experimental) Creates a report.

        A report is created when tests specified in the buildspec file for a report groups run during the build of a project.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/userguide/auth-and-access-control-iam-identity-based-access-control.html#console-policies

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toCreateReport", []))

    @jsii.member(jsii_name="toCreateReportGroup")
    def to_create_report_group(self) -> "Codebuild":
        '''(experimental) Creates a report group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_CreateReportGroup.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toCreateReportGroup", []))

    @jsii.member(jsii_name="toCreateWebhook")
    def to_create_webhook(self) -> "Codebuild":
        '''(experimental) For an existing AWS CodeBuild build project that has its source code stored in a GitHub or Bitbucket repository, enables AWS CodeBuild to start rebuilding the source code every time a code change is pushed to the repository.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_CreateWebhook.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toCreateWebhook", []))

    @jsii.member(jsii_name="toDeleteBuildBatch")
    def to_delete_build_batch(self) -> "Codebuild":
        '''(experimental) Deletes a build batch.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_DeleteBuildBatch.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toDeleteBuildBatch", []))

    @jsii.member(jsii_name="toDeleteOAuthToken")
    def to_delete_o_auth_token(self) -> "Codebuild":
        '''(experimental) Deletes an OAuth token from a connected third-party OAuth provider. Only used in the AWS CodeBuild console.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/userguide/auth-and-access-control-iam-identity-based-access-control.html#console-policies

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toDeleteOAuthToken", []))

    @jsii.member(jsii_name="toDeleteProject")
    def to_delete_project(self) -> "Codebuild":
        '''(experimental) Deletes a build project.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_DeleteProject.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toDeleteProject", []))

    @jsii.member(jsii_name="toDeleteReport")
    def to_delete_report(self) -> "Codebuild":
        '''(experimental) Deletes a report.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_DeleteReport.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toDeleteReport", []))

    @jsii.member(jsii_name="toDeleteReportGroup")
    def to_delete_report_group(self) -> "Codebuild":
        '''(experimental) Deletes a report group.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_DeleteReportGroup.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toDeleteReportGroup", []))

    @jsii.member(jsii_name="toDeleteResourcePolicy")
    def to_delete_resource_policy(self) -> "Codebuild":
        '''(experimental) Deletes a resource policy for the associated project or report group.

        Access Level: Permissions management

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_DeleteResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toDeleteResourcePolicy", []))

    @jsii.member(jsii_name="toDeleteSourceCredentials")
    def to_delete_source_credentials(self) -> "Codebuild":
        '''(experimental) Deletes a set of GitHub, GitHub Enterprise, or Bitbucket source credentials.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_DeleteSourceCredentials.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toDeleteSourceCredentials", []))

    @jsii.member(jsii_name="toDeleteWebhook")
    def to_delete_webhook(self) -> "Codebuild":
        '''(experimental) For an existing AWS CodeBuild build project that has its source code stored in a GitHub or Bitbucket repository, stops AWS CodeBuild from rebuilding the source code every time a code change is pushed to the repository.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_DeleteWebhook.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toDeleteWebhook", []))

    @jsii.member(jsii_name="toDescribeCodeCoverages")
    def to_describe_code_coverages(self) -> "Codebuild":
        '''(experimental) Returns an array of CodeCoverage objects.

        Access Level: Read

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_DescribeCodeCoverages.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toDescribeCodeCoverages", []))

    @jsii.member(jsii_name="toDescribeTestCases")
    def to_describe_test_cases(self) -> "Codebuild":
        '''(experimental) Returns an array of TestCase objects.

        Access Level: Read

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_DescribeTestCases.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toDescribeTestCases", []))

    @jsii.member(jsii_name="toGetResourcePolicy")
    def to_get_resource_policy(self) -> "Codebuild":
        '''(experimental) Returns a resource policy for the specified project or report group.

        Access Level: Read

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_GetResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toGetResourcePolicy", []))

    @jsii.member(jsii_name="toImportSourceCredentials")
    def to_import_source_credentials(self) -> "Codebuild":
        '''(experimental) Imports the source repository credentials for an AWS CodeBuild project that has its source code stored in a GitHub, GitHub Enterprise, or Bitbucket repository.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_ImportSourceCredentials.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toImportSourceCredentials", []))

    @jsii.member(jsii_name="toInvalidateProjectCache")
    def to_invalidate_project_cache(self) -> "Codebuild":
        '''(experimental) Resets the cache for a project.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_InvalidateProjectCache.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toInvalidateProjectCache", []))

    @jsii.member(jsii_name="toListBuildBatches")
    def to_list_build_batches(self) -> "Codebuild":
        '''(experimental) Gets a list of build batch IDs, with each build batch ID representing a single build batch.

        Access Level: List

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_ListBuildBatches.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toListBuildBatches", []))

    @jsii.member(jsii_name="toListBuildBatchesForProject")
    def to_list_build_batches_for_project(self) -> "Codebuild":
        '''(experimental) Gets a list of build batch IDs for the specified build project, with each build batch ID representing a single build batch.

        Access Level: List

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_ListBuildBatchesForProject.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toListBuildBatchesForProject", []))

    @jsii.member(jsii_name="toListBuilds")
    def to_list_builds(self) -> "Codebuild":
        '''(experimental) Gets a list of build IDs, with each build ID representing a single build.

        Access Level: List

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_ListBuilds.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toListBuilds", []))

    @jsii.member(jsii_name="toListBuildsForProject")
    def to_list_builds_for_project(self) -> "Codebuild":
        '''(experimental) Gets a list of build IDs for the specified build project, with each build ID representing a single build.

        Access Level: List

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_ListBuildsForProject.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toListBuildsForProject", []))

    @jsii.member(jsii_name="toListConnectedOAuthAccounts")
    def to_list_connected_o_auth_accounts(self) -> "Codebuild":
        '''(experimental) Lists connected third-party OAuth providers. Only used in the AWS CodeBuild console.

        Access Level: List

        https://docs.aws.amazon.com/codebuild/latest/userguide/auth-and-access-control-iam-identity-based-access-control.html#console-policies

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toListConnectedOAuthAccounts", []))

    @jsii.member(jsii_name="toListCuratedEnvironmentImages")
    def to_list_curated_environment_images(self) -> "Codebuild":
        '''(experimental) Gets information about Docker images that are managed by AWS CodeBuild.

        Access Level: List

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_ListCuratedEnvironmentImages.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toListCuratedEnvironmentImages", []))

    @jsii.member(jsii_name="toListProjects")
    def to_list_projects(self) -> "Codebuild":
        '''(experimental) Gets a list of build project names, with each build project name representing a single build project.

        Access Level: List

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_ListProjects.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toListProjects", []))

    @jsii.member(jsii_name="toListReportGroups")
    def to_list_report_groups(self) -> "Codebuild":
        '''(experimental) Returns a list of report group ARNs. Each report group ARN represents one report group.

        Access Level: List

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_ListReportGroups.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toListReportGroups", []))

    @jsii.member(jsii_name="toListReports")
    def to_list_reports(self) -> "Codebuild":
        '''(experimental) Returns a list of report ARNs. Each report ARN representing one report.

        Access Level: List

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_ListReports.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toListReports", []))

    @jsii.member(jsii_name="toListReportsForReportGroup")
    def to_list_reports_for_report_group(self) -> "Codebuild":
        '''(experimental) Returns a list of report ARNs that belong to the specified report group. Each report ARN represents one report.

        Access Level: List

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_ListReportsForReportGroup.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toListReportsForReportGroup", []))

    @jsii.member(jsii_name="toListRepositories")
    def to_list_repositories(self) -> "Codebuild":
        '''(experimental) Lists source code repositories from a connected third-party OAuth provider. Only used in the AWS CodeBuild console.

        Access Level: List

        https://docs.aws.amazon.com/codebuild/latest/userguide/auth-and-access-control-iam-identity-based-access-control.html#console-policies

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toListRepositories", []))

    @jsii.member(jsii_name="toListSharedProjects")
    def to_list_shared_projects(self) -> "Codebuild":
        '''(experimental) Returns a list of project ARNs that have been shared with the requester. Each project ARN represents one project.

        Access Level: List

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_ListSharedProjects.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toListSharedProjects", []))

    @jsii.member(jsii_name="toListSharedReportGroups")
    def to_list_shared_report_groups(self) -> "Codebuild":
        '''(experimental) Returns a list of report group ARNs that have been shared with the requester.

        Each report group ARN represents one report group.

        Access Level: List

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_ListSharedReportGroups.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toListSharedReportGroups", []))

    @jsii.member(jsii_name="toListSourceCredentials")
    def to_list_source_credentials(self) -> "Codebuild":
        '''(experimental) Returns a list of SourceCredentialsInfo objects.

        Access Level: List

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_ListSourceCredentials.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toListSourceCredentials", []))

    @jsii.member(jsii_name="toPersistOAuthToken")
    def to_persist_o_auth_token(self) -> "Codebuild":
        '''(experimental) Saves an OAuth token from a connected third-party OAuth provider. Only used in the AWS CodeBuild console.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/userguide/auth-and-access-control-iam-identity-based-access-control.html#console-policies

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toPersistOAuthToken", []))

    @jsii.member(jsii_name="toPutResourcePolicy")
    def to_put_resource_policy(self) -> "Codebuild":
        '''(experimental) Creates a resource policy for the associated project or report group.

        Access Level: Permissions management

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_PutResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toPutResourcePolicy", []))

    @jsii.member(jsii_name="toRetryBuild")
    def to_retry_build(self) -> "Codebuild":
        '''(experimental) Retries a build.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_RetryBuild.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toRetryBuild", []))

    @jsii.member(jsii_name="toRetryBuildBatch")
    def to_retry_build_batch(self) -> "Codebuild":
        '''(experimental) Retries a build batch.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_RetryBuildBatch.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toRetryBuildBatch", []))

    @jsii.member(jsii_name="toStartBuild")
    def to_start_build(self) -> "Codebuild":
        '''(experimental) Starts running a build.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_StartBuild.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toStartBuild", []))

    @jsii.member(jsii_name="toStartBuildBatch")
    def to_start_build_batch(self) -> "Codebuild":
        '''(experimental) Starts running a build batch.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_StartBuildBatch.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toStartBuildBatch", []))

    @jsii.member(jsii_name="toStopBuild")
    def to_stop_build(self) -> "Codebuild":
        '''(experimental) Attempts to stop running a build.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_StopBuild.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toStopBuild", []))

    @jsii.member(jsii_name="toStopBuildBatch")
    def to_stop_build_batch(self) -> "Codebuild":
        '''(experimental) Attempts to stop running a build batch.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_StopBuildBatch.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toStopBuildBatch", []))

    @jsii.member(jsii_name="toUpdateProject")
    def to_update_project(self) -> "Codebuild":
        '''(experimental) Changes the settings of an existing build project.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_UpdateProject.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toUpdateProject", []))

    @jsii.member(jsii_name="toUpdateReport")
    def to_update_report(self) -> "Codebuild":
        '''(experimental) Updates information about a report.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/userguide/auth-and-access-control-iam-identity-based-access-control.html#console-policies

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toUpdateReport", []))

    @jsii.member(jsii_name="toUpdateReportGroup")
    def to_update_report_group(self) -> "Codebuild":
        '''(experimental) Changes the settings of an existing report group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_UpdateReportGroup.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toUpdateReportGroup", []))

    @jsii.member(jsii_name="toUpdateWebhook")
    def to_update_webhook(self) -> "Codebuild":
        '''(experimental) Updates the webhook associated with an AWS CodeBuild build project.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_UpdateWebhook.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toUpdateWebhook", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Codecommit(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Codecommit",
):
    '''(experimental) Statement provider for service `codecommit <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscodecommit.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `codecommit <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscodecommit.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Codecommit, self, [sid])

    @jsii.member(jsii_name="ifReferences")
    def if_references(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Codecommit":
        '''(experimental) Filters access by Git reference to specified AWS CodeCommit actions.

        https://docs.aws.amazon.com/codecommit/latest/userguide/how-to-conditional-branch.html

        Applies to actions:

        - .toCreateBranch()
        - .toCreateCommit()
        - .toCreateUnreferencedMergeCommit()
        - .toDeleteBranch()
        - .toDeleteFile()
        - .toGetMergeCommit()
        - .toGitPush()
        - .toMergeBranchesByFastForward()
        - .toMergeBranchesBySquash()
        - .toMergeBranchesByThreeWay()
        - .toMergePullRequestByFastForward()
        - .toMergePullRequestBySquash()
        - .toMergePullRequestByThreeWay()
        - .toPutFile()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "ifReferences", [value, operator]))

    @jsii.member(jsii_name="onRepository")
    def on_repository(
        self,
        repository_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codecommit":
        '''(experimental) Adds a resource of type repository to the statement.

        https://docs.aws.amazon.com/codecommit/latest/userguide/auth-and-access-control-iam-access-control-identity-based.html#arn-formats

        :param repository_name: - Identifier for the repositoryName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "onRepository", [repository_name, account, region, partition]))

    @jsii.member(jsii_name="toAssociateApprovalRuleTemplateWithRepository")
    def to_associate_approval_rule_template_with_repository(self) -> "Codecommit":
        '''(experimental) Grants permission to associate an approval rule template with a repository.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_AssociateApprovalRuleTemplateWithRepository.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toAssociateApprovalRuleTemplateWithRepository", []))

    @jsii.member(jsii_name="toBatchAssociateApprovalRuleTemplateWithRepositories")
    def to_batch_associate_approval_rule_template_with_repositories(
        self,
    ) -> "Codecommit":
        '''(experimental) Grants permission to associate an approval rule template with multiple repositories in a single operation.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_BatchAssociateApprovalRuleTemplateWithRepositories.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toBatchAssociateApprovalRuleTemplateWithRepositories", []))

    @jsii.member(jsii_name="toBatchDescribeMergeConflicts")
    def to_batch_describe_merge_conflicts(self) -> "Codecommit":
        '''(experimental) Grants permission to get information about multiple merge conflicts when attempting to merge two commits using either the three-way merge or the squash merge option.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_BatchDescribeMergeConflicts.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toBatchDescribeMergeConflicts", []))

    @jsii.member(jsii_name="toBatchDisassociateApprovalRuleTemplateFromRepositories")
    def to_batch_disassociate_approval_rule_template_from_repositories(
        self,
    ) -> "Codecommit":
        '''(experimental) Grants permission to remove the association between an approval rule template and multiple repositories in a single operation.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_BatchDisassociateApprovalRuleTemplateFromRepositories.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toBatchDisassociateApprovalRuleTemplateFromRepositories", []))

    @jsii.member(jsii_name="toBatchGetCommits")
    def to_batch_get_commits(self) -> "Codecommit":
        '''(experimental) Grants permission to get return information about one or more commits in an AWS CodeCommit repository.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_BatchGetCommits.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toBatchGetCommits", []))

    @jsii.member(jsii_name="toBatchGetPullRequests")
    def to_batch_get_pull_requests(self) -> "Codecommit":
        '''(experimental) Grants permission to return information about one or more pull requests in an AWS CodeCommit repository.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/userguide/auth-and-access-control-permissions-reference.html#aa-pr

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toBatchGetPullRequests", []))

    @jsii.member(jsii_name="toBatchGetRepositories")
    def to_batch_get_repositories(self) -> "Codecommit":
        '''(experimental) Grants permission to get information about multiple repositories.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_BatchGetRepositories.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toBatchGetRepositories", []))

    @jsii.member(jsii_name="toCancelUploadArchive")
    def to_cancel_upload_archive(self) -> "Codecommit":
        '''(experimental) Grants permission to cancel the uploading of an archive to a pipeline in AWS CodePipeline.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/userguide/auth-and-access-control-permissions-reference.html#aa-acp

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toCancelUploadArchive", []))

    @jsii.member(jsii_name="toCreateApprovalRuleTemplate")
    def to_create_approval_rule_template(self) -> "Codecommit":
        '''(experimental) Grants permission to create an approval rule template that will automatically create approval rules in pull requests that match the conditions defined in the template;

        does not grant permission to create approval rules for individual pull requests

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_CreateApprovalRuleTemplate.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toCreateApprovalRuleTemplate", []))

    @jsii.member(jsii_name="toCreateBranch")
    def to_create_branch(self) -> "Codecommit":
        '''(experimental) Grants permission to create a branch in an AWS CodeCommit repository with this API;

        does not control Git create branch actions

        Access Level: Write

        Possible conditions:

        - .ifReferences()

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_CreateBranch.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toCreateBranch", []))

    @jsii.member(jsii_name="toCreateCommit")
    def to_create_commit(self) -> "Codecommit":
        '''(experimental) Grants permission to add, copy, move or update single or multiple files in a branch in an AWS CodeCommit repository, and generate a commit for the changes in the specified branch.

        Access Level: Write

        Possible conditions:

        - .ifReferences()

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_CreateCommit.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toCreateCommit", []))

    @jsii.member(jsii_name="toCreatePullRequest")
    def to_create_pull_request(self) -> "Codecommit":
        '''(experimental) Grants permission to create a pull request in the specified repository.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_CreatePullRequest.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toCreatePullRequest", []))

    @jsii.member(jsii_name="toCreatePullRequestApprovalRule")
    def to_create_pull_request_approval_rule(self) -> "Codecommit":
        '''(experimental) Grants permission to create an approval rule specific to an individual pull request;

        does not grant permission to create approval rule templates

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_CreatePullRequestApprovalRule.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toCreatePullRequestApprovalRule", []))

    @jsii.member(jsii_name="toCreateRepository")
    def to_create_repository(self) -> "Codecommit":
        '''(experimental) Grants permission to create an AWS CodeCommit repository.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_CreateRepository.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toCreateRepository", []))

    @jsii.member(jsii_name="toCreateUnreferencedMergeCommit")
    def to_create_unreferenced_merge_commit(self) -> "Codecommit":
        '''(experimental) Grants permission to create an unreferenced commit that contains the result of merging two commits using either the three-way or the squash merge option;

        does not control Git merge actions

        Access Level: Write

        Possible conditions:

        - .ifReferences()

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_CreateUnreferencedMergeCommit.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toCreateUnreferencedMergeCommit", []))

    @jsii.member(jsii_name="toDeleteApprovalRuleTemplate")
    def to_delete_approval_rule_template(self) -> "Codecommit":
        '''(experimental) Grants permission to delete an approval rule template.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_DeleteApprovalRuleTemplate.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toDeleteApprovalRuleTemplate", []))

    @jsii.member(jsii_name="toDeleteBranch")
    def to_delete_branch(self) -> "Codecommit":
        '''(experimental) Grants permission to delete a branch in an AWS CodeCommit repository with this API;

        does not control Git delete branch actions

        Access Level: Write

        Possible conditions:

        - .ifReferences()

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_DeleteBranch.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toDeleteBranch", []))

    @jsii.member(jsii_name="toDeleteCommentContent")
    def to_delete_comment_content(self) -> "Codecommit":
        '''(experimental) Grants permission to delete the content of a comment made on a change, file, or commit in a repository.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_DeleteCommentContent.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toDeleteCommentContent", []))

    @jsii.member(jsii_name="toDeleteFile")
    def to_delete_file(self) -> "Codecommit":
        '''(experimental) Grants permission to delete a specified file from a specified branch.

        Access Level: Write

        Possible conditions:

        - .ifReferences()

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_DeleteFile.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toDeleteFile", []))

    @jsii.member(jsii_name="toDeletePullRequestApprovalRule")
    def to_delete_pull_request_approval_rule(self) -> "Codecommit":
        '''(experimental) Grants permission to delete approval rule created for a pull request if the rule was not created by an approval rule template.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_DeletePullRequestApprovalRule.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toDeletePullRequestApprovalRule", []))

    @jsii.member(jsii_name="toDeleteRepository")
    def to_delete_repository(self) -> "Codecommit":
        '''(experimental) Grants permission to delete an AWS CodeCommit repository.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_DeleteRepository.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toDeleteRepository", []))

    @jsii.member(jsii_name="toDescribeMergeConflicts")
    def to_describe_merge_conflicts(self) -> "Codecommit":
        '''(experimental) Grants permission to get information about specific merge conflicts when attempting to merge two commits using either the three-way or the squash merge option.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_DescribeMergeConflicts.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toDescribeMergeConflicts", []))

    @jsii.member(jsii_name="toDescribePullRequestEvents")
    def to_describe_pull_request_events(self) -> "Codecommit":
        '''(experimental) Grants permission to return information about one or more pull request events.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_DescribePullRequestEvents.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toDescribePullRequestEvents", []))

    @jsii.member(jsii_name="toDisassociateApprovalRuleTemplateFromRepository")
    def to_disassociate_approval_rule_template_from_repository(self) -> "Codecommit":
        '''(experimental) Grants permission to remove the association between an approval rule template and a repository.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_DisassociateApprovalRuleTemplateFromRepository.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toDisassociateApprovalRuleTemplateFromRepository", []))

    @jsii.member(jsii_name="toEvaluatePullRequestApprovalRules")
    def to_evaluate_pull_request_approval_rules(self) -> "Codecommit":
        '''(experimental) Grants permission to evaluate whether a pull request is mergable based on its current approval state and approval rule requirements.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_EvaluatePullRequestApprovalRules.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toEvaluatePullRequestApprovalRules", []))

    @jsii.member(jsii_name="toGetApprovalRuleTemplate")
    def to_get_approval_rule_template(self) -> "Codecommit":
        '''(experimental) Grants permission to return information about an approval rule template.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetApprovalRuleTemplate.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetApprovalRuleTemplate", []))

    @jsii.member(jsii_name="toGetBlob")
    def to_get_blob(self) -> "Codecommit":
        '''(experimental) Grants permission to view the encoded content of an individual file in an AWS CodeCommit repository from the AWS CodeCommit console.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetBlob.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetBlob", []))

    @jsii.member(jsii_name="toGetBranch")
    def to_get_branch(self) -> "Codecommit":
        '''(experimental) Grants permission to get details about a branch in an AWS CodeCommit repository with this API;

        does not control Git branch actions

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetBranch.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetBranch", []))

    @jsii.member(jsii_name="toGetComment")
    def to_get_comment(self) -> "Codecommit":
        '''(experimental) Grants permission to get the content of a comment made on a change, file, or commit in a repository.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetComment.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetComment", []))

    @jsii.member(jsii_name="toGetCommentReactions")
    def to_get_comment_reactions(self) -> "Codecommit":
        '''(experimental) Grants permission to get the reactions on a comment.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetCommentReactions.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetCommentReactions", []))

    @jsii.member(jsii_name="toGetCommentsForComparedCommit")
    def to_get_comments_for_compared_commit(self) -> "Codecommit":
        '''(experimental) Grants permission to get information about comments made on the comparison between two commits.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetCommentsForComparedCommit.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetCommentsForComparedCommit", []))

    @jsii.member(jsii_name="toGetCommentsForPullRequest")
    def to_get_comments_for_pull_request(self) -> "Codecommit":
        '''(experimental) Grants permission to get comments made on a pull request.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetCommentsForPullRequest.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetCommentsForPullRequest", []))

    @jsii.member(jsii_name="toGetCommit")
    def to_get_commit(self) -> "Codecommit":
        '''(experimental) Grants permission to return information about a commit, including commit message and committer information, with this API;

        does not control Git log actions

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetCommit.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetCommit", []))

    @jsii.member(jsii_name="toGetCommitHistory")
    def to_get_commit_history(self) -> "Codecommit":
        '''(experimental) Grants permission to get information about the history of commits in a repository.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/userguide/auth-and-access-control-permissions-reference.html#aa-code

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetCommitHistory", []))

    @jsii.member(jsii_name="toGetCommitsFromMergeBase")
    def to_get_commits_from_merge_base(self) -> "Codecommit":
        '''(experimental) Grants permission to get information about the difference between commits in the context of a potential merge.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/userguide/auth-and-access-control-permissions-reference.html#aa-pr

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetCommitsFromMergeBase", []))

    @jsii.member(jsii_name="toGetDifferences")
    def to_get_differences(self) -> "Codecommit":
        '''(experimental) Grants permission to view information about the differences between valid commit specifiers such as a branch, tag, HEAD, commit ID, or other fully qualified reference.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetDifferences.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetDifferences", []))

    @jsii.member(jsii_name="toGetFile")
    def to_get_file(self) -> "Codecommit":
        '''(experimental) Grants permission to return the base-64 encoded contents of a specified file and its metadata.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetFile.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetFile", []))

    @jsii.member(jsii_name="toGetFolder")
    def to_get_folder(self) -> "Codecommit":
        '''(experimental) Grants permission to return the contents of a specified folder in a repository.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetFolder.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetFolder", []))

    @jsii.member(jsii_name="toGetMergeCommit")
    def to_get_merge_commit(self) -> "Codecommit":
        '''(experimental) Grants permission to get information about a merge commit created by one of the merge options for pull requests that creates merge commits.

        Not all merge options create merge commits. This permission does not control Git merge actions

        Access Level: Read

        Possible conditions:

        - .ifReferences()

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetMergeCommit.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetMergeCommit", []))

    @jsii.member(jsii_name="toGetMergeConflicts")
    def to_get_merge_conflicts(self) -> "Codecommit":
        '''(experimental) Grants permission to get information about merge conflicts between the before and after commit IDs for a pull request in a repository.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetMergeConflicts.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetMergeConflicts", []))

    @jsii.member(jsii_name="toGetMergeOptions")
    def to_get_merge_options(self) -> "Codecommit":
        '''(experimental) Grants permission to get information about merge options for pull requests that can be used to merge two commits;

        does not control Git merge actions

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetMergeOptions.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetMergeOptions", []))

    @jsii.member(jsii_name="toGetObjectIdentifier")
    def to_get_object_identifier(self) -> "Codecommit":
        '''(experimental) Grants permission to resolve blobs, trees, and commits to their identifier.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/userguide/auth-and-access-control-permissions-reference.html#aa-code

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetObjectIdentifier", []))

    @jsii.member(jsii_name="toGetPullRequest")
    def to_get_pull_request(self) -> "Codecommit":
        '''(experimental) Grants permission to get information about a pull request in a specified repository.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetPullRequest.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetPullRequest", []))

    @jsii.member(jsii_name="toGetPullRequestApprovalStates")
    def to_get_pull_request_approval_states(self) -> "Codecommit":
        '''(experimental) Grants permission to retrieve the current approvals on an inputted pull request.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetPullRequestApprovalStates.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetPullRequestApprovalStates", []))

    @jsii.member(jsii_name="toGetPullRequestOverrideState")
    def to_get_pull_request_override_state(self) -> "Codecommit":
        '''(experimental) Grants permission to retrieve the current override state of a given pull request.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetPullRequestOverrideState.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetPullRequestOverrideState", []))

    @jsii.member(jsii_name="toGetReferences")
    def to_get_references(self) -> "Codecommit":
        '''(experimental) Grants permission to get details about references in an AWS CodeCommit repository; does not control Git reference actions.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/userguide/auth-and-access-control-permissions-reference.html#aa-code

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetReferences", []))

    @jsii.member(jsii_name="toGetRepository")
    def to_get_repository(self) -> "Codecommit":
        '''(experimental) Grants permission to get information about an AWS CodeCommit repository.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetRepository.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetRepository", []))

    @jsii.member(jsii_name="toGetRepositoryTriggers")
    def to_get_repository_triggers(self) -> "Codecommit":
        '''(experimental) Grants permission to get information about triggers configured for a repository.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetRepositoryTriggers.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetRepositoryTriggers", []))

    @jsii.member(jsii_name="toGetTree")
    def to_get_tree(self) -> "Codecommit":
        '''(experimental) Grants permission to view the contents of a specified tree in an AWS CodeCommit repository from the AWS CodeCommit console.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/userguide/auth-and-access-control-permissions-reference.html#aa-code

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetTree", []))

    @jsii.member(jsii_name="toGetUploadArchiveStatus")
    def to_get_upload_archive_status(self) -> "Codecommit":
        '''(experimental) Grants permission to get status information about an archive upload to a pipeline in AWS CodePipeline.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/userguide/auth-and-access-control-permissions-reference.html#aa-acp

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetUploadArchiveStatus", []))

    @jsii.member(jsii_name="toGitPull")
    def to_git_pull(self) -> "Codecommit":
        '''(experimental) Grants permission to pull information from an AWS CodeCommit repository to a local repo.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/userguide/auth-and-access-control-permissions-reference.html#aa-git

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGitPull", []))

    @jsii.member(jsii_name="toGitPush")
    def to_git_push(self) -> "Codecommit":
        '''(experimental) Grants permission to push information from a local repo to an AWS CodeCommit repository.

        Access Level: Write

        Possible conditions:

        - .ifReferences()

        https://docs.aws.amazon.com/codecommit/latest/userguide/auth-and-access-control-permissions-reference.html#aa-git

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGitPush", []))

    @jsii.member(jsii_name="toListApprovalRuleTemplates")
    def to_list_approval_rule_templates(self) -> "Codecommit":
        '''(experimental) Grants permission to list all approval rule templates in an AWS Region for the AWS account.

        Access Level: List

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_ListApprovalRuleTemplates.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toListApprovalRuleTemplates", []))

    @jsii.member(jsii_name="toListAssociatedApprovalRuleTemplatesForRepository")
    def to_list_associated_approval_rule_templates_for_repository(self) -> "Codecommit":
        '''(experimental) Grants permission to list approval rule templates that are associated with a repository.

        Access Level: List

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_ListAssociatedApprovalRuleTemplatesForRepository.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toListAssociatedApprovalRuleTemplatesForRepository", []))

    @jsii.member(jsii_name="toListBranches")
    def to_list_branches(self) -> "Codecommit":
        '''(experimental) Grants permission to list branches for an AWS CodeCommit repository with this API; does not control Git branch actions.

        Access Level: List

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_ListBranches.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toListBranches", []))

    @jsii.member(jsii_name="toListPullRequests")
    def to_list_pull_requests(self) -> "Codecommit":
        '''(experimental) Grants permission to list pull requests for a specified repository.

        Access Level: List

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_ListPullRequests.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toListPullRequests", []))

    @jsii.member(jsii_name="toListRepositories")
    def to_list_repositories(self) -> "Codecommit":
        '''(experimental) Grants permission to list information about AWS CodeCommit repositories in the current Region for your AWS account.

        Access Level: List

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_ListRepositories.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toListRepositories", []))

    @jsii.member(jsii_name="toListRepositoriesForApprovalRuleTemplate")
    def to_list_repositories_for_approval_rule_template(self) -> "Codecommit":
        '''(experimental) Grants permission to list repositories that are associated with an approval rule template.

        Access Level: List

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_ListRepositoriesForApprovalRuleTemplate.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toListRepositoriesForApprovalRuleTemplate", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Codecommit":
        '''(experimental) Grants permission to list the resource attached to a CodeCommit resource ARN.

        Access Level: List

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toMergeBranchesByFastForward")
    def to_merge_branches_by_fast_forward(self) -> "Codecommit":
        '''(experimental) Grants permission to merge two commits into the specified destination branch using the fast-forward merge option.

        Access Level: Write

        Possible conditions:

        - .ifReferences()

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_MergeBranchesByFastForward.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toMergeBranchesByFastForward", []))

    @jsii.member(jsii_name="toMergeBranchesBySquash")
    def to_merge_branches_by_squash(self) -> "Codecommit":
        '''(experimental) Grants permission to merge two commits into the specified destination branch using the squash merge option.

        Access Level: Write

        Possible conditions:

        - .ifReferences()

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_MergeBranchesBySquash.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toMergeBranchesBySquash", []))

    @jsii.member(jsii_name="toMergeBranchesByThreeWay")
    def to_merge_branches_by_three_way(self) -> "Codecommit":
        '''(experimental) Grants permission to merge two commits into the specified destination branch using the three-way merge option.

        Access Level: Write

        Possible conditions:

        - .ifReferences()

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_MergeBranchesByThreeWay.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toMergeBranchesByThreeWay", []))

    @jsii.member(jsii_name="toMergePullRequestByFastForward")
    def to_merge_pull_request_by_fast_forward(self) -> "Codecommit":
        '''(experimental) Grants permission to close a pull request and attempt to merge it into the specified destination branch for that pull request at the specified commit using the fast-forward merge option.

        Access Level: Write

        Possible conditions:

        - .ifReferences()

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_MergePullRequestByFastForward.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toMergePullRequestByFastForward", []))

    @jsii.member(jsii_name="toMergePullRequestBySquash")
    def to_merge_pull_request_by_squash(self) -> "Codecommit":
        '''(experimental) Grants permission to close a pull request and attempt to merge it into the specified destination branch for that pull request at the specified commit using the squash merge option.

        Access Level: Write

        Possible conditions:

        - .ifReferences()

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_MergePullRequestBySquash.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toMergePullRequestBySquash", []))

    @jsii.member(jsii_name="toMergePullRequestByThreeWay")
    def to_merge_pull_request_by_three_way(self) -> "Codecommit":
        '''(experimental) Grants permission to close a pull request and attempt to merge it into the specified destination branch for that pull request at the specified commit using the three-way merge option.

        Access Level: Write

        Possible conditions:

        - .ifReferences()

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_MergePullRequestByThreeWay.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toMergePullRequestByThreeWay", []))

    @jsii.member(jsii_name="toOverridePullRequestApprovalRules")
    def to_override_pull_request_approval_rules(self) -> "Codecommit":
        '''(experimental) Grants permission to override all approval rules for a pull request, including approval rules created by a template.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_OverridePullRequestApprovalRules.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toOverridePullRequestApprovalRules", []))

    @jsii.member(jsii_name="toPostCommentForComparedCommit")
    def to_post_comment_for_compared_commit(self) -> "Codecommit":
        '''(experimental) Grants permission to post a comment on the comparison between two commits.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_PostCommentForComparedCommit.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toPostCommentForComparedCommit", []))

    @jsii.member(jsii_name="toPostCommentForPullRequest")
    def to_post_comment_for_pull_request(self) -> "Codecommit":
        '''(experimental) Grants permission to post a comment on a pull request.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_PostCommentForPullRequest.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toPostCommentForPullRequest", []))

    @jsii.member(jsii_name="toPostCommentReply")
    def to_post_comment_reply(self) -> "Codecommit":
        '''(experimental) Grants permission to post a comment in reply to a comment on a comparison between commits or a pull request.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_PostCommentReply.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toPostCommentReply", []))

    @jsii.member(jsii_name="toPutCommentReaction")
    def to_put_comment_reaction(self) -> "Codecommit":
        '''(experimental) Grants permission to post a reaction on a comment.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_PutCommentReaction.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toPutCommentReaction", []))

    @jsii.member(jsii_name="toPutFile")
    def to_put_file(self) -> "Codecommit":
        '''(experimental) Grants permission to add or update a file in a branch in an AWS CodeCommit repository, and generate a commit for the addition in the specified branch.

        Access Level: Write

        Possible conditions:

        - .ifReferences()

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_PutFile.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toPutFile", []))

    @jsii.member(jsii_name="toPutRepositoryTriggers")
    def to_put_repository_triggers(self) -> "Codecommit":
        '''(experimental) Grants permission to create, update, or delete triggers for a repository.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_PutRepositoryTriggers.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toPutRepositoryTriggers", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Codecommit":
        '''(experimental) Grants permission to attach resource tags to a CodeCommit resource ARN.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTestRepositoryTriggers")
    def to_test_repository_triggers(self) -> "Codecommit":
        '''(experimental) Grants permission to test the functionality of repository triggers by sending information to the trigger target.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_TestRepositoryTriggers.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toTestRepositoryTriggers", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Codecommit":
        '''(experimental) Grants permission to disassociate resource tags from a CodeCommit resource ARN.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateApprovalRuleTemplateContent")
    def to_update_approval_rule_template_content(self) -> "Codecommit":
        '''(experimental) Grants permission to update the content of approval rule templates;

        does not grant permission to update content of approval rules created specifically for pull requests

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_UpdateApprovalRuleTemplateContent.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toUpdateApprovalRuleTemplateContent", []))

    @jsii.member(jsii_name="toUpdateApprovalRuleTemplateDescription")
    def to_update_approval_rule_template_description(self) -> "Codecommit":
        '''(experimental) Grants permission to update the description of approval rule templates.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_UpdateApprovalRuleTemplateDescription.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toUpdateApprovalRuleTemplateDescription", []))

    @jsii.member(jsii_name="toUpdateApprovalRuleTemplateName")
    def to_update_approval_rule_template_name(self) -> "Codecommit":
        '''(experimental) Grants permission to update the name of approval rule templates.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_UpdateApprovalRuleTemplateName.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toUpdateApprovalRuleTemplateName", []))

    @jsii.member(jsii_name="toUpdateComment")
    def to_update_comment(self) -> "Codecommit":
        '''(experimental) Grants permission to update the contents of a comment if the identity matches the identity used to create the comment.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_UpdateComment.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toUpdateComment", []))

    @jsii.member(jsii_name="toUpdateDefaultBranch")
    def to_update_default_branch(self) -> "Codecommit":
        '''(experimental) Grants permission to change the default branch in an AWS CodeCommit repository.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_UpdateDefaultBranch.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toUpdateDefaultBranch", []))

    @jsii.member(jsii_name="toUpdatePullRequestApprovalRuleContent")
    def to_update_pull_request_approval_rule_content(self) -> "Codecommit":
        '''(experimental) Grants permission to update the content for approval rules created for a specific pull requests;

        does not grant permission to update approval rule content for rules created with an approval rule template

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_UpdatePullRequestApprovalRuleContent.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toUpdatePullRequestApprovalRuleContent", []))

    @jsii.member(jsii_name="toUpdatePullRequestApprovalState")
    def to_update_pull_request_approval_state(self) -> "Codecommit":
        '''(experimental) Grants permission to update the approval state for pull requests.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_UpdatePullRequestApprovalState.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toUpdatePullRequestApprovalState", []))

    @jsii.member(jsii_name="toUpdatePullRequestDescription")
    def to_update_pull_request_description(self) -> "Codecommit":
        '''(experimental) Grants permission to update the description of a pull request.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_UpdatePullRequestDescription.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toUpdatePullRequestDescription", []))

    @jsii.member(jsii_name="toUpdatePullRequestStatus")
    def to_update_pull_request_status(self) -> "Codecommit":
        '''(experimental) Grants permission to update the status of a pull request.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_UpdatePullRequestStatus.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toUpdatePullRequestStatus", []))

    @jsii.member(jsii_name="toUpdatePullRequestTitle")
    def to_update_pull_request_title(self) -> "Codecommit":
        '''(experimental) Grants permission to update the title of a pull request.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_UpdatePullRequestTitle.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toUpdatePullRequestTitle", []))

    @jsii.member(jsii_name="toUpdateRepositoryDescription")
    def to_update_repository_description(self) -> "Codecommit":
        '''(experimental) Grants permission to change the description of an AWS CodeCommit repository.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_UpdateRepositoryDescription.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toUpdateRepositoryDescription", []))

    @jsii.member(jsii_name="toUpdateRepositoryName")
    def to_update_repository_name(self) -> "Codecommit":
        '''(experimental) Grants permission to change the name of an AWS CodeCommit repository.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_UpdateRepositoryName.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toUpdateRepositoryName", []))

    @jsii.member(jsii_name="toUploadArchive")
    def to_upload_archive(self) -> "Codecommit":
        '''(experimental) Grants permission to the service role for AWS CodePipeline to upload repository changes into a pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/userguide/auth-and-access-control-permissions-reference.html#aa-acp

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toUploadArchive", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Codedeploy(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Codedeploy",
):
    '''(experimental) Statement provider for service `codedeploy <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscodedeploy.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `codedeploy <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscodedeploy.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Codedeploy, self, [sid])

    @jsii.member(jsii_name="onApplication")
    def on_application(
        self,
        application_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codedeploy":
        '''(experimental) Adds a resource of type application to the statement.

        https://docs.aws.amazon.com/codedeploy/latest/userguide/auth-and-access-control-permissions-reference.html

        :param application_name: - Identifier for the applicationName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "onApplication", [application_name, account, region, partition]))

    @jsii.member(jsii_name="onDeploymentconfig")
    def on_deploymentconfig(
        self,
        deployment_configuration_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codedeploy":
        '''(experimental) Adds a resource of type deploymentconfig to the statement.

        https://docs.aws.amazon.com/codedeploy/latest/userguide/auth-and-access-control-permissions-reference.html

        :param deployment_configuration_name: - Identifier for the deploymentConfigurationName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "onDeploymentconfig", [deployment_configuration_name, account, region, partition]))

    @jsii.member(jsii_name="onDeploymentgroup")
    def on_deploymentgroup(
        self,
        application_name: builtins.str,
        deployment_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codedeploy":
        '''(experimental) Adds a resource of type deploymentgroup to the statement.

        https://docs.aws.amazon.com/codedeploy/latest/userguide/auth-and-access-control-permissions-reference.html

        :param application_name: - Identifier for the applicationName.
        :param deployment_group_name: - Identifier for the deploymentGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "onDeploymentgroup", [application_name, deployment_group_name, account, region, partition]))

    @jsii.member(jsii_name="onInstance")
    def on_instance(
        self,
        instance_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codedeploy":
        '''(experimental) Adds a resource of type instance to the statement.

        https://docs.aws.amazon.com/codedeploy/latest/userguide/auth-and-access-control-permissions-reference.html

        :param instance_name: - Identifier for the instanceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "onInstance", [instance_name, account, region, partition]))

    @jsii.member(jsii_name="toAddTagsToOnPremisesInstances")
    def to_add_tags_to_on_premises_instances(self) -> "Codedeploy":
        '''(experimental) Add tags to one or more on-premises instances.

        Access Level: Tagging

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_AddTagsToOnPremisesInstances.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toAddTagsToOnPremisesInstances", []))

    @jsii.member(jsii_name="toBatchGetApplicationRevisions")
    def to_batch_get_application_revisions(self) -> "Codedeploy":
        '''(experimental) Gets information about one or more application revisions.

        Access Level: Read

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_BatchGetApplicationRevisions.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toBatchGetApplicationRevisions", []))

    @jsii.member(jsii_name="toBatchGetApplications")
    def to_batch_get_applications(self) -> "Codedeploy":
        '''(experimental) Get information about multiple applications associated with the IAM user.

        Access Level: Read

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_BatchGetApplications.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toBatchGetApplications", []))

    @jsii.member(jsii_name="toBatchGetDeploymentGroups")
    def to_batch_get_deployment_groups(self) -> "Codedeploy":
        '''(experimental) Get information about one or more deployment groups.

        Access Level: Read

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_BatchGetDeploymentGroups.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toBatchGetDeploymentGroups", []))

    @jsii.member(jsii_name="toBatchGetDeploymentInstances")
    def to_batch_get_deployment_instances(self) -> "Codedeploy":
        '''(experimental) Gets information about one or more instance that are part of a deployment group.

        Access Level: Read

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_BatchGetDeploymentInstances.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toBatchGetDeploymentInstances", []))

    @jsii.member(jsii_name="toBatchGetDeployments")
    def to_batch_get_deployments(self) -> "Codedeploy":
        '''(experimental) Get information about multiple deployments associated with the IAM user.

        Access Level: Read

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_BatchGetDeployments.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toBatchGetDeployments", []))

    @jsii.member(jsii_name="toBatchGetDeploymentTargets")
    def to_batch_get_deployment_targets(self) -> "Codedeploy":
        '''(experimental) Returns an array of one or more targets associated with a deployment.

        This method works with all compute types and should be used instead of the deprecated BatchGetDeploymentInstances. The maximum number of targets that can be returned is 25.

        Access Level: Read

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_BatchGetDeploymentTargets.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toBatchGetDeploymentTargets", []))

    @jsii.member(jsii_name="toBatchGetOnPremisesInstances")
    def to_batch_get_on_premises_instances(self) -> "Codedeploy":
        '''(experimental) Get information about one or more on-premises instances.

        Access Level: Read

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_BatchGetOnPremisesInstances.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toBatchGetOnPremisesInstances", []))

    @jsii.member(jsii_name="toContinueDeployment")
    def to_continue_deployment(self) -> "Codedeploy":
        '''(experimental) Starts the process of rerouting traffic from instances in the original environment to instances in thereplacement environment without waiting for a specified wait time to elapse.

        Access Level: Write

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ContinueDeployment.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toContinueDeployment", []))

    @jsii.member(jsii_name="toCreateApplication")
    def to_create_application(self) -> "Codedeploy":
        '''(experimental) Create an application associated with the IAM user.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_CreateApplication.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toCreateApplication", []))

    @jsii.member(jsii_name="toCreateCloudFormationDeployment")
    def to_create_cloud_formation_deployment(self) -> "Codedeploy":
        '''(experimental) Create CloudFormation deployment to cooperate ochestration for a CloudFormation stack update.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toCreateCloudFormationDeployment", []))

    @jsii.member(jsii_name="toCreateDeployment")
    def to_create_deployment(self) -> "Codedeploy":
        '''(experimental) Create a deployment for an application associated with the IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_CreateDeployment.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toCreateDeployment", []))

    @jsii.member(jsii_name="toCreateDeploymentConfig")
    def to_create_deployment_config(self) -> "Codedeploy":
        '''(experimental) Create a custom deployment configuration associated with the IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_CreateDeploymentConfig.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toCreateDeploymentConfig", []))

    @jsii.member(jsii_name="toCreateDeploymentGroup")
    def to_create_deployment_group(self) -> "Codedeploy":
        '''(experimental) Create a deployment group for an application associated with the IAM user.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_CreateDeploymentGroup.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toCreateDeploymentGroup", []))

    @jsii.member(jsii_name="toDeleteApplication")
    def to_delete_application(self) -> "Codedeploy":
        '''(experimental) Delete an application associated with the IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_DeleteApplication.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toDeleteApplication", []))

    @jsii.member(jsii_name="toDeleteDeploymentConfig")
    def to_delete_deployment_config(self) -> "Codedeploy":
        '''(experimental) Delete a custom deployment configuration associated with the IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_DeleteDeploymentConfig.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toDeleteDeploymentConfig", []))

    @jsii.member(jsii_name="toDeleteDeploymentGroup")
    def to_delete_deployment_group(self) -> "Codedeploy":
        '''(experimental) Delete a deployment group for an application associated with the IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_DeleteDeploymentGroup.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toDeleteDeploymentGroup", []))

    @jsii.member(jsii_name="toDeleteGitHubAccountToken")
    def to_delete_git_hub_account_token(self) -> "Codedeploy":
        '''(experimental) Deletes a GitHub account connection.

        Access Level: Write

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_DeleteGitHubAccountToken.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toDeleteGitHubAccountToken", []))

    @jsii.member(jsii_name="toDeleteResourcesByExternalId")
    def to_delete_resources_by_external_id(self) -> "Codedeploy":
        '''(experimental) Delete resources associated with the given external Id.

        Access Level: Write

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_DeleteResourcesByExternalId.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toDeleteResourcesByExternalId", []))

    @jsii.member(jsii_name="toDeregisterOnPremisesInstance")
    def to_deregister_on_premises_instance(self) -> "Codedeploy":
        '''(experimental) Deregister an on-premises instance.

        Access Level: Write

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_DeregisterOnPremisesInstance.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toDeregisterOnPremisesInstance", []))

    @jsii.member(jsii_name="toGetApplication")
    def to_get_application(self) -> "Codedeploy":
        '''(experimental) Get information about a single application associated with the IAM user.

        Access Level: List

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetApplication.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toGetApplication", []))

    @jsii.member(jsii_name="toGetApplicationRevision")
    def to_get_application_revision(self) -> "Codedeploy":
        '''(experimental) Get information about a single application revision for an application associated with the IAM user.

        Access Level: List

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetApplicationRevision.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toGetApplicationRevision", []))

    @jsii.member(jsii_name="toGetDeployment")
    def to_get_deployment(self) -> "Codedeploy":
        '''(experimental) Get information about a single deployment to a deployment group for an application associated with the IAM user.

        Access Level: List

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetDeployment.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toGetDeployment", []))

    @jsii.member(jsii_name="toGetDeploymentConfig")
    def to_get_deployment_config(self) -> "Codedeploy":
        '''(experimental) Get information about a single deployment configuration associated with the IAM user.

        Access Level: List

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetDeploymentConfig.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toGetDeploymentConfig", []))

    @jsii.member(jsii_name="toGetDeploymentGroup")
    def to_get_deployment_group(self) -> "Codedeploy":
        '''(experimental) Get information about a single deployment group for an application associated with the IAM user.

        Access Level: List

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetDeploymentGroup.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toGetDeploymentGroup", []))

    @jsii.member(jsii_name="toGetDeploymentInstance")
    def to_get_deployment_instance(self) -> "Codedeploy":
        '''(experimental) Get information about a single instance in a deployment associated with the IAM user.

        Access Level: List

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetDeploymentInstance.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toGetDeploymentInstance", []))

    @jsii.member(jsii_name="toGetDeploymentTarget")
    def to_get_deployment_target(self) -> "Codedeploy":
        '''(experimental) Returns information about a deployment target.

        Access Level: Read

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetDeploymentTarget.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toGetDeploymentTarget", []))

    @jsii.member(jsii_name="toGetOnPremisesInstance")
    def to_get_on_premises_instance(self) -> "Codedeploy":
        '''(experimental) Get information about a single on-premises instance.

        Access Level: List

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetOnPremisesInstance.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toGetOnPremisesInstance", []))

    @jsii.member(jsii_name="toListApplicationRevisions")
    def to_list_application_revisions(self) -> "Codedeploy":
        '''(experimental) Get information about all application revisions for an application associated with the IAM user.

        Access Level: List

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListApplicationRevisions.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toListApplicationRevisions", []))

    @jsii.member(jsii_name="toListApplications")
    def to_list_applications(self) -> "Codedeploy":
        '''(experimental) Get information about all applications associated with the IAM user.

        Access Level: List

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListApplications.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toListApplications", []))

    @jsii.member(jsii_name="toListDeploymentConfigs")
    def to_list_deployment_configs(self) -> "Codedeploy":
        '''(experimental) Get information about all deployment configurations associated with the IAM user.

        Access Level: List

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListDeploymentConfigs.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toListDeploymentConfigs", []))

    @jsii.member(jsii_name="toListDeploymentGroups")
    def to_list_deployment_groups(self) -> "Codedeploy":
        '''(experimental) Get information about all deployment groups for an application associated with the IAM user.

        Access Level: List

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListDeploymentGroups.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toListDeploymentGroups", []))

    @jsii.member(jsii_name="toListDeploymentInstances")
    def to_list_deployment_instances(self) -> "Codedeploy":
        '''(experimental) Get information about all instances in a deployment associated with the IAM user.

        Access Level: List

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListDeploymentInstances.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toListDeploymentInstances", []))

    @jsii.member(jsii_name="toListDeployments")
    def to_list_deployments(self) -> "Codedeploy":
        '''(experimental) Get information about all deployments to a deployment group associated with the IAM user, or to get all deployments associated with the IAM user.

        Access Level: List

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListDeployments.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toListDeployments", []))

    @jsii.member(jsii_name="toListDeploymentTargets")
    def to_list_deployment_targets(self) -> "Codedeploy":
        '''(experimental) Returns an array of target IDs that are associated a deployment.

        Access Level: List

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListDeploymentTargets.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toListDeploymentTargets", []))

    @jsii.member(jsii_name="toListGitHubAccountTokenNames")
    def to_list_git_hub_account_token_names(self) -> "Codedeploy":
        '''(experimental) Lists the names of stored connections to GitHub accounts.

        Access Level: List

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ ListGitHubAccountTokenNames.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toListGitHubAccountTokenNames", []))

    @jsii.member(jsii_name="toListOnPremisesInstances")
    def to_list_on_premises_instances(self) -> "Codedeploy":
        '''(experimental) Get a list of one or more on-premises instance names.

        Access Level: List

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListOnPremisesInstances.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toListOnPremisesInstances", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Codedeploy":
        '''(experimental) Returns a list of tags for the resource identified by a specified ARN.

        Tags are used to organize and categorize your CodeDeploy resources.

        Access Level: List

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutLifecycleEventHookExecutionStatus")
    def to_put_lifecycle_event_hook_execution_status(self) -> "Codedeploy":
        '''(experimental) Notify a lifecycle event hook execution status for associated deployment with the IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_PutLifecycleEventHookExecutionStatus.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toPutLifecycleEventHookExecutionStatus", []))

    @jsii.member(jsii_name="toRegisterApplicationRevision")
    def to_register_application_revision(self) -> "Codedeploy":
        '''(experimental) Register information about an application revision for an application associated with the IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_RegisterApplicationRevision.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toRegisterApplicationRevision", []))

    @jsii.member(jsii_name="toRegisterOnPremisesInstance")
    def to_register_on_premises_instance(self) -> "Codedeploy":
        '''(experimental) Register an on-premises instance.

        Access Level: Write

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_RegisterOnPremisesInstance.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toRegisterOnPremisesInstance", []))

    @jsii.member(jsii_name="toRemoveTagsFromOnPremisesInstances")
    def to_remove_tags_from_on_premises_instances(self) -> "Codedeploy":
        '''(experimental) Remove tags from one or more on-premises instances.

        Access Level: Tagging

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_RemoveTagsFromOnPremisesInstances.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toRemoveTagsFromOnPremisesInstances", []))

    @jsii.member(jsii_name="toSkipWaitTimeForInstanceTermination")
    def to_skip_wait_time_for_instance_termination(self) -> "Codedeploy":
        '''(experimental) In a blue/green deployment, overrides any specified wait time and starts terminating instances immediately after the traffic routing is complete.

        Access Level: Write

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ SkipWaitTimeForInstanceTermination.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toSkipWaitTimeForInstanceTermination", []))

    @jsii.member(jsii_name="toStopDeployment")
    def to_stop_deployment(self) -> "Codedeploy":
        '''(experimental) Description for StopDeployment.

        Access Level: Write

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_StopDeployment.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toStopDeployment", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Codedeploy":
        '''(experimental) Associates the list of tags in the input Tags parameter with the resource identified by the ResourceArn input parameter.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Codedeploy":
        '''(experimental) Disassociates a resource from a list of tags.

        The resource is identified by the ResourceArn input parameter. The tags are identfied by the list of keys in the TagKeys input parameter.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateApplication")
    def to_update_application(self) -> "Codedeploy":
        '''(experimental) Description for UpdateApplication.

        Access Level: Write

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_UpdateApplication.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toUpdateApplication", []))

    @jsii.member(jsii_name="toUpdateDeploymentGroup")
    def to_update_deployment_group(self) -> "Codedeploy":
        '''(experimental) Change information about a single deployment group for an application associated with the IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_UpdateDeploymentGroup.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toUpdateDeploymentGroup", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Codeguru(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Codeguru",
):
    '''(experimental) Statement provider for service `codeguru <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncodeguru.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `codeguru <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncodeguru.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Codeguru, self, [sid])

    @jsii.member(jsii_name="toGetCodeGuruFreeTrialSummary")
    def to_get_code_guru_free_trial_summary(self) -> "Codeguru":
        '''(experimental) Gets free trial summary for the CodeGuru service which includes expiration date.

        Access Level: Read

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_GetCodeGuruFreeTrialSummary.html

        :stability: experimental
        '''
        return typing.cast("Codeguru", jsii.invoke(self, "toGetCodeGuruFreeTrialSummary", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class CodeguruProfiler(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.CodeguruProfiler",
):
    '''(experimental) Statement provider for service `codeguru-profiler <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncodeguruprofiler.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `codeguru-profiler <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncodeguruprofiler.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(CodeguruProfiler, self, [sid])

    @jsii.member(jsii_name="onProfilingGroup")
    def on_profiling_group(
        self,
        profiling_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "CodeguruProfiler":
        '''(experimental) Adds a resource of type ProfilingGroup to the statement.

        https://docs.aws.amazon.com/codeguru/latest/profiler-ug/working-with-profiling-groups.html

        :param profiling_group_name: - Identifier for the profilingGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "onProfilingGroup", [profiling_group_name, account, region, partition]))

    @jsii.member(jsii_name="toAddNotificationChannels")
    def to_add_notification_channels(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to add up to 2 topic ARNs of existing AWS SNS topics to publish notifications.

        Access Level: Write

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_AddNotificationChannels.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toAddNotificationChannels", []))

    @jsii.member(jsii_name="toBatchGetFrameMetricData")
    def to_batch_get_frame_metric_data(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to get the frame metric data for a Profiling Group.

        Access Level: List

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_BatchGetFrameMetricData.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toBatchGetFrameMetricData", []))

    @jsii.member(jsii_name="toConfigureAgent")
    def to_configure_agent(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission for an agent to register with the orchestration service and retrieve profiling configuration information.

        Access Level: Write

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_ConfigureAgent.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toConfigureAgent", []))

    @jsii.member(jsii_name="toCreateProfilingGroup")
    def to_create_profiling_group(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to create a profiling group.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_CreateProfilingGroup.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toCreateProfilingGroup", []))

    @jsii.member(jsii_name="toDeleteProfilingGroup")
    def to_delete_profiling_group(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to delete a profiling group.

        Access Level: Write

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_DeleteProfilingGroup.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toDeleteProfilingGroup", []))

    @jsii.member(jsii_name="toDescribeProfilingGroup")
    def to_describe_profiling_group(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to describe a profiling group.

        Access Level: Read

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_DescribeProfilingGroup.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toDescribeProfilingGroup", []))

    @jsii.member(jsii_name="toGetFindingsReportAccountSummary")
    def to_get_findings_report_account_summary(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to get a summary of recent recommendations for each profiling group in the account.

        Access Level: Read

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_GetFindingsReportAccountSummary.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toGetFindingsReportAccountSummary", []))

    @jsii.member(jsii_name="toGetNotificationConfiguration")
    def to_get_notification_configuration(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to get the notification configuration.

        Access Level: Read

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_GetNotificationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toGetNotificationConfiguration", []))

    @jsii.member(jsii_name="toGetPolicy")
    def to_get_policy(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to get the resource policy associated with the specified Profiling Group.

        Access Level: Read

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_GetPolicy.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toGetPolicy", []))

    @jsii.member(jsii_name="toGetProfile")
    def to_get_profile(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to get aggregated profiles for a specific profiling group.

        Access Level: Read

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_GetProfile.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toGetProfile", []))

    @jsii.member(jsii_name="toGetRecommendations")
    def to_get_recommendations(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to get recommendations.

        Access Level: Read

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_GetRecommendations.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toGetRecommendations", []))

    @jsii.member(jsii_name="toListFindingsReports")
    def to_list_findings_reports(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to list the available recommendations reports for a specific profiling group.

        Access Level: List

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_ListFindingsReports.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toListFindingsReports", []))

    @jsii.member(jsii_name="toListProfileTimes")
    def to_list_profile_times(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to list the start times of the available aggregated profiles for a specific profiling group.

        Access Level: List

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_ListProfileTimes.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toListProfileTimes", []))

    @jsii.member(jsii_name="toListProfilingGroups")
    def to_list_profiling_groups(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to list profiling groups in the account.

        Access Level: List

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_ListProfilingGroups.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toListProfilingGroups", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to list tags for a Profiling Group.

        Access Level: List

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPostAgentProfile")
    def to_post_agent_profile(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to submit a profile collected by an agent belonging to a specific profiling group for aggregation.

        Access Level: Write

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_PostAgentProfile.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toPostAgentProfile", []))

    @jsii.member(jsii_name="toPutPermission")
    def to_put_permission(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to update the list of principals allowed for an action group in the resource policy associated with the specified Profiling Group.

        Access Level: Permissions management

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_PutPermission.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toPutPermission", []))

    @jsii.member(jsii_name="toRemoveNotificationChannel")
    def to_remove_notification_channel(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to delete an already configured SNStopic arn from the notification configuration.

        Access Level: Write

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_RemoveNotificationChannel.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toRemoveNotificationChannel", []))

    @jsii.member(jsii_name="toRemovePermission")
    def to_remove_permission(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to remove the permission of specified Action Group from the resource policy associated with the specified Profiling Group.

        Access Level: Permissions management

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_RemovePermission.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toRemovePermission", []))

    @jsii.member(jsii_name="toSubmitFeedback")
    def to_submit_feedback(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to submit user feedback for useful or non useful anomaly.

        Access Level: Write

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_SubmitFeedback.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toSubmitFeedback", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to add or overwrite tags to a Profiling Group.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to remove tags from a Profiling Group.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateProfilingGroup")
    def to_update_profiling_group(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to update a specific profiling group.

        Access Level: Write

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_UpdateProfilingGroup.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toUpdateProfilingGroup", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class CodeguruReviewer(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.CodeguruReviewer",
):
    '''(experimental) Statement provider for service `codeguru-reviewer <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncodegurureviewer.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `codeguru-reviewer <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncodegurureviewer.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(CodeguruReviewer, self, [sid])

    @jsii.member(jsii_name="onAssociation")
    def on_association(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "CodeguruReviewer":
        '''(experimental) Adds a resource of type association to the statement.

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "onAssociation", [resource_id, account, partition]))

    @jsii.member(jsii_name="onCodereview")
    def on_codereview(
        self,
        code_review_uuid: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "CodeguruReviewer":
        '''(experimental) Adds a resource of type codereview to the statement.

        :param code_review_uuid: - Identifier for the codeReviewUuid.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "onCodereview", [code_review_uuid, account, region, partition]))

    @jsii.member(jsii_name="onConnection")
    def on_connection(
        self,
        connection_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "CodeguruReviewer":
        '''(experimental) Adds a resource of type connection to the statement.

        :param connection_id: - Identifier for the connectionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "onConnection", [connection_id, account, region, partition]))

    @jsii.member(jsii_name="onRepository")
    def on_repository(
        self,
        repository_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "CodeguruReviewer":
        '''(experimental) Adds a resource of type repository to the statement.

        https://docs.aws.amazon.com/codeguru/latest/reviewer-ug/auth-and-access-control-iam-access-control-identity-based.html#arn-formats

        :param repository_name: - Identifier for the repositoryName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "onRepository", [repository_name, account, region, partition]))

    @jsii.member(jsii_name="toAssociateRepository")
    def to_associate_repository(self) -> "CodeguruReviewer":
        '''(experimental) Grants permission to associates a repository with Amazon CodeGuru Reviewer.

        Access Level: Write

        Dependent actions:

        - codecommit:ListRepositories
        - codecommit:TagResource
        - events:PutRule
        - events:PutTargets
        - iam:CreateServiceLinkedRole
        - s3:CreateBucket
        - s3:ListBucket
        - s3:PutBucketPolicy
        - s3:PutLifecycleConfiguration

        https://docs.aws.amazon.com/codeguru/latest/reviewer-api/API_AssociateRepository.html

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "toAssociateRepository", []))

    @jsii.member(jsii_name="toCreateCodeReview")
    def to_create_code_review(self) -> "CodeguruReviewer":
        '''(experimental) Grants permission to create a code review.

        Access Level: Write

        Dependent actions:

        - s3:GetObject

        https://docs.aws.amazon.com/codeguru/latest/reviewer-api/API_CreateCodeReview.html

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "toCreateCodeReview", []))

    @jsii.member(jsii_name="toCreateConnectionToken")
    def to_create_connection_token(self) -> "CodeguruReviewer":
        '''(experimental) Grants permission to perform webbased oauth handshake for 3rd party providers.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "toCreateConnectionToken", []))

    @jsii.member(jsii_name="toDescribeCodeReview")
    def to_describe_code_review(self) -> "CodeguruReviewer":
        '''(experimental) Grants permission to describe a code review.

        Access Level: Read

        https://docs.aws.amazon.com/codeguru/latest/reviewer-api/API_DescribeCodeReview.html

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "toDescribeCodeReview", []))

    @jsii.member(jsii_name="toDescribeRecommendationFeedback")
    def to_describe_recommendation_feedback(self) -> "CodeguruReviewer":
        '''(experimental) Grants permission to describe a recommendation feedback on a code review.

        Access Level: Read

        https://docs.aws.amazon.com/codeguru/latest/reviewer-api/API_DescribeRecommendationFeedback.html

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "toDescribeRecommendationFeedback", []))

    @jsii.member(jsii_name="toDescribeRepositoryAssociation")
    def to_describe_repository_association(self) -> "CodeguruReviewer":
        '''(experimental) Grants permission to describe a repository association.

        Access Level: Read

        https://docs.aws.amazon.com/codeguru/latest/reviewer-api/API_DescribeRepositoryAssociation.html

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "toDescribeRepositoryAssociation", []))

    @jsii.member(jsii_name="toDisassociateRepository")
    def to_disassociate_repository(self) -> "CodeguruReviewer":
        '''(experimental) Grants permission to disassociate a repository with Amazon CodeGuru Reviewer.

        Access Level: Write

        Dependent actions:

        - codecommit:UntagResource
        - events:DeleteRule
        - events:RemoveTargets

        https://docs.aws.amazon.com/codeguru/latest/reviewer-api/API_DisassociateRepository.html

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "toDisassociateRepository", []))

    @jsii.member(jsii_name="toGetMetricsData")
    def to_get_metrics_data(self) -> "CodeguruReviewer":
        '''(experimental) Grants permission to view pull request metrics in console.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "toGetMetricsData", []))

    @jsii.member(jsii_name="toListCodeReviews")
    def to_list_code_reviews(self) -> "CodeguruReviewer":
        '''(experimental) Grants permission to list summary of code reviews.

        Access Level: List

        https://docs.aws.amazon.com/codeguru/latest/reviewer-api/API_ListCodeReviews.html

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "toListCodeReviews", []))

    @jsii.member(jsii_name="toListRecommendationFeedback")
    def to_list_recommendation_feedback(self) -> "CodeguruReviewer":
        '''(experimental) Grants permission to list summary of recommendation feedback on a code review.

        Access Level: List

        https://docs.aws.amazon.com/codeguru/latest/reviewer-api/API_ListRecommendationFeedback.html

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "toListRecommendationFeedback", []))

    @jsii.member(jsii_name="toListRecommendations")
    def to_list_recommendations(self) -> "CodeguruReviewer":
        '''(experimental) Grants permission to list summary of recommendations on a code review.

        Access Level: List

        https://docs.aws.amazon.com/codeguru/latest/reviewer-api/API_ListRecommendations.html

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "toListRecommendations", []))

    @jsii.member(jsii_name="toListRepositoryAssociations")
    def to_list_repository_associations(self) -> "CodeguruReviewer":
        '''(experimental) Grants permission to list summary of repository associations.

        Access Level: List

        https://docs.aws.amazon.com/codeguru/latest/reviewer-api/API_ListRepositoryAssociations.html

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "toListRepositoryAssociations", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "CodeguruReviewer":
        '''(experimental) Grants permission to list the resource attached to a associated repository ARN.

        Access Level: List

        https://docs.aws.amazon.com/codeguru/latest/reviewer-api/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListThirdPartyRepositories")
    def to_list_third_party_repositories(self) -> "CodeguruReviewer":
        '''(experimental) Grants permission to list 3rd party providers repositories in console.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "toListThirdPartyRepositories", []))

    @jsii.member(jsii_name="toPutRecommendationFeedback")
    def to_put_recommendation_feedback(self) -> "CodeguruReviewer":
        '''(experimental) Grants permission to put feedback for a recommendation on a code review.

        Access Level: Write

        https://docs.aws.amazon.com/codeguru/latest/reviewer-api/API_PutRecommendationFeedback.html

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "toPutRecommendationFeedback", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "CodeguruReviewer":
        '''(experimental) Grants permission to attach resource tags to an associated repository ARN.

        Access Level: Tagging

        https://docs.aws.amazon.com/codeguru/latest/reviewer-api/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUnTagResource")
    def to_un_tag_resource(self) -> "CodeguruReviewer":
        '''(experimental) Grants permission to disassociate resource tags from an associated repository ARN.

        Access Level: Tagging

        https://docs.aws.amazon.com/codeguru/latest/reviewer-api/API_UnTagResource.html

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "toUnTagResource", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Codepipeline(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Codepipeline",
):
    '''(experimental) Statement provider for service `codepipeline <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscodepipeline.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `codepipeline <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscodepipeline.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Codepipeline, self, [sid])

    @jsii.member(jsii_name="onAction")
    def on_action(
        self,
        pipeline_name: builtins.str,
        stage_name: builtins.str,
        action_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codepipeline":
        '''(experimental) Adds a resource of type action to the statement.

        https://docs.aws.amazon.com/codepipeline/latest/userguide/iam-access-control-identity-based.html#ACP_ARN_Format

        :param pipeline_name: - Identifier for the pipelineName.
        :param stage_name: - Identifier for the stageName.
        :param action_name: - Identifier for the actionName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "onAction", [pipeline_name, stage_name, action_name, account, region, partition]))

    @jsii.member(jsii_name="onActiontype")
    def on_actiontype(
        self,
        owner: builtins.str,
        category: builtins.str,
        provider: builtins.str,
        version: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codepipeline":
        '''(experimental) Adds a resource of type actiontype to the statement.

        https://docs.aws.amazon.com/codepipeline/latest/userguide/iam-access-control-identity-based.html#ACP_ARN_Format

        :param owner: - Identifier for the owner.
        :param category: - Identifier for the category.
        :param provider: - Identifier for the provider.
        :param version: - Identifier for the version.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "onActiontype", [owner, category, provider, version, account, region, partition]))

    @jsii.member(jsii_name="onPipeline")
    def on_pipeline(
        self,
        pipeline_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codepipeline":
        '''(experimental) Adds a resource of type pipeline to the statement.

        https://docs.aws.amazon.com/codepipeline/latest/userguide/iam-access-control-identity-based.html#ACP_ARN_Format

        :param pipeline_name: - Identifier for the pipelineName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "onPipeline", [pipeline_name, account, region, partition]))

    @jsii.member(jsii_name="onStage")
    def on_stage(
        self,
        pipeline_name: builtins.str,
        stage_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codepipeline":
        '''(experimental) Adds a resource of type stage to the statement.

        https://docs.aws.amazon.com/codepipeline/latest/userguide/iam-access-control-identity-based.html#ACP_ARN_Format

        :param pipeline_name: - Identifier for the pipelineName.
        :param stage_name: - Identifier for the stageName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "onStage", [pipeline_name, stage_name, account, region, partition]))

    @jsii.member(jsii_name="onWebhook")
    def on_webhook(
        self,
        webhook_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codepipeline":
        '''(experimental) Adds a resource of type webhook to the statement.

        https://docs.aws.amazon.com/codepipeline/latest/userguide/iam-access-control-identity-based.html#ACP_ARN_Format

        :param webhook_name: - Identifier for the webhookName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "onWebhook", [webhook_name, account, region, partition]))

    @jsii.member(jsii_name="toAcknowledgeJob")
    def to_acknowledge_job(self) -> "Codepipeline":
        '''(experimental) Grants permission to view information about a specified job and whether that job has been received by the job worker.

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_AcknowledgeJob.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toAcknowledgeJob", []))

    @jsii.member(jsii_name="toAcknowledgeThirdPartyJob")
    def to_acknowledge_third_party_job(self) -> "Codepipeline":
        '''(experimental) Grants permission to confirm that a job worker has received the specified job (partner actions only).

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_AcknowledgeThirdPartyJob.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toAcknowledgeThirdPartyJob", []))

    @jsii.member(jsii_name="toCreateCustomActionType")
    def to_create_custom_action_type(self) -> "Codepipeline":
        '''(experimental) Grants permission to create a custom action that you can use in the pipelines associated with your AWS account.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_CreateCustomActionType.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toCreateCustomActionType", []))

    @jsii.member(jsii_name="toCreatePipeline")
    def to_create_pipeline(self) -> "Codepipeline":
        '''(experimental) Grants permission to create a uniquely named pipeline.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_CreatePipeline.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toCreatePipeline", []))

    @jsii.member(jsii_name="toDeleteCustomActionType")
    def to_delete_custom_action_type(self) -> "Codepipeline":
        '''(experimental) Grants permission to delete a custom action.

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_DeleteCustomActionType.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toDeleteCustomActionType", []))

    @jsii.member(jsii_name="toDeletePipeline")
    def to_delete_pipeline(self) -> "Codepipeline":
        '''(experimental) Grants permission to delete a specified pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_DeletePipeline.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toDeletePipeline", []))

    @jsii.member(jsii_name="toDeleteWebhook")
    def to_delete_webhook(self) -> "Codepipeline":
        '''(experimental) Grants permission to delete a specified webhook.

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_DeleteWebhook.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toDeleteWebhook", []))

    @jsii.member(jsii_name="toDeregisterWebhookWithThirdParty")
    def to_deregister_webhook_with_third_party(self) -> "Codepipeline":
        '''(experimental) Grants permission to remove the registration of a webhook with the third party specified in its configuration.

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_DeregisterWebhookWithThirdParty.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toDeregisterWebhookWithThirdParty", []))

    @jsii.member(jsii_name="toDisableStageTransition")
    def to_disable_stage_transition(self) -> "Codepipeline":
        '''(experimental) Grants permission to prevent revisions from transitioning to the next stage in a pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_DisableStageTransition.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toDisableStageTransition", []))

    @jsii.member(jsii_name="toEnableStageTransition")
    def to_enable_stage_transition(self) -> "Codepipeline":
        '''(experimental) Grants permission to allow revisions to transition to the next stage in a pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_EnableStageTransition.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toEnableStageTransition", []))

    @jsii.member(jsii_name="toGetJobDetails")
    def to_get_job_details(self) -> "Codepipeline":
        '''(experimental) Grants permission to view information about a job (custom actions only).

        Access Level: Read

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_GetJobDetails.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toGetJobDetails", []))

    @jsii.member(jsii_name="toGetPipeline")
    def to_get_pipeline(self) -> "Codepipeline":
        '''(experimental) Grants permission to retrieve information about a pipeline structure.

        Access Level: Read

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_GetPipeline.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toGetPipeline", []))

    @jsii.member(jsii_name="toGetPipelineExecution")
    def to_get_pipeline_execution(self) -> "Codepipeline":
        '''(experimental) Grants permission to view information about an execution of a pipeline, including details about artifacts, the pipeline execution ID, and the name, version, and status of the pipeline.

        Access Level: Read

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_GetPipelineExecution.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toGetPipelineExecution", []))

    @jsii.member(jsii_name="toGetPipelineState")
    def to_get_pipeline_state(self) -> "Codepipeline":
        '''(experimental) Grants permission to view information about the current state of the stages and actions of a pipeline.

        Access Level: Read

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_GetPipelineState.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toGetPipelineState", []))

    @jsii.member(jsii_name="toGetThirdPartyJobDetails")
    def to_get_third_party_job_details(self) -> "Codepipeline":
        '''(experimental) Grants permission to view the details of a job for a third-party action (partner actions only).

        Access Level: Read

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_GetThirdPartyJobDetails.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toGetThirdPartyJobDetails", []))

    @jsii.member(jsii_name="toListActionExecutions")
    def to_list_action_executions(self) -> "Codepipeline":
        '''(experimental) Grants permission to list the action executions that have occurred in a pipeline.

        Access Level: Read

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_ListActionExecutions.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toListActionExecutions", []))

    @jsii.member(jsii_name="toListActionTypes")
    def to_list_action_types(self) -> "Codepipeline":
        '''(experimental) Grants permission to list a summary of all the action types available for pipelines in your account.

        Access Level: Read

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_ListActionTypes.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toListActionTypes", []))

    @jsii.member(jsii_name="toListPipelineExecutions")
    def to_list_pipeline_executions(self) -> "Codepipeline":
        '''(experimental) Grants permission to list a summary of the most recent executions for a pipeline.

        Access Level: List

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_ListPipelineExecutions.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toListPipelineExecutions", []))

    @jsii.member(jsii_name="toListPipelines")
    def to_list_pipelines(self) -> "Codepipeline":
        '''(experimental) Grants permission to list a summary of all the pipelines associated with your AWS account.

        Access Level: List

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_ListPipelines.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toListPipelines", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Codepipeline":
        '''(experimental) Grants permission to list tags for a CodePipeline resource.

        Access Level: Read

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListWebhooks")
    def to_list_webhooks(self) -> "Codepipeline":
        '''(experimental) Grants permission to list all of the webhooks associated with your AWS account.

        Access Level: List

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_ListWebhooks.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toListWebhooks", []))

    @jsii.member(jsii_name="toPollForJobs")
    def to_poll_for_jobs(self) -> "Codepipeline":
        '''(experimental) Grants permission to view information about any jobs for CodePipeline to act on.

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_PollForJobs.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toPollForJobs", []))

    @jsii.member(jsii_name="toPollForThirdPartyJobs")
    def to_poll_for_third_party_jobs(self) -> "Codepipeline":
        '''(experimental) Grants permission to determine whether there are any third-party jobs for a job worker to act on (partner actions only).

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_PollForThirdPartyJobs.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toPollForThirdPartyJobs", []))

    @jsii.member(jsii_name="toPutActionRevision")
    def to_put_action_revision(self) -> "Codepipeline":
        '''(experimental) Grants permission to edit actions in a pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_PutActionRevision.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toPutActionRevision", []))

    @jsii.member(jsii_name="toPutApprovalResult")
    def to_put_approval_result(self) -> "Codepipeline":
        '''(experimental) Grants permission to provide a response (Approved or Rejected) to a manual approval request in CodePipeline.

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_PutApprovalResult.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toPutApprovalResult", []))

    @jsii.member(jsii_name="toPutJobFailureResult")
    def to_put_job_failure_result(self) -> "Codepipeline":
        '''(experimental) Grants permission to represent the failure of a job as returned to the pipeline by a job worker (custom actions only).

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_PutJobFailureResult.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toPutJobFailureResult", []))

    @jsii.member(jsii_name="toPutJobSuccessResult")
    def to_put_job_success_result(self) -> "Codepipeline":
        '''(experimental) Grants permission to represent the success of a job as returned to the pipeline by a job worker (custom actions only).

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_PutJobSuccessResult.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toPutJobSuccessResult", []))

    @jsii.member(jsii_name="toPutThirdPartyJobFailureResult")
    def to_put_third_party_job_failure_result(self) -> "Codepipeline":
        '''(experimental) Grants permission to represent the failure of a third-party job as returned to the pipeline by a job worker (partner actions only).

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_PutThirdPartyJobFailureResult.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toPutThirdPartyJobFailureResult", []))

    @jsii.member(jsii_name="toPutThirdPartyJobSuccessResult")
    def to_put_third_party_job_success_result(self) -> "Codepipeline":
        '''(experimental) Grants permission to represent the success of a third-party job as returned to the pipeline by a job worker (partner actions only).

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_PutThirdPartyJobSuccessResult.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toPutThirdPartyJobSuccessResult", []))

    @jsii.member(jsii_name="toPutWebhook")
    def to_put_webhook(self) -> "Codepipeline":
        '''(experimental) Grants permission to create or update a webhook.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_PutWebhook.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toPutWebhook", []))

    @jsii.member(jsii_name="toRegisterWebhookWithThirdParty")
    def to_register_webhook_with_third_party(self) -> "Codepipeline":
        '''(experimental) Grants permission to register a webhook with the third party specified in its configuration.

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_RegisterWebhookWithThirdParty.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toRegisterWebhookWithThirdParty", []))

    @jsii.member(jsii_name="toRetryStageExecution")
    def to_retry_stage_execution(self) -> "Codepipeline":
        '''(experimental) Grants permission to resume the pipeline execution by retrying the last failed actions in a stage.

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_RetryStageExecution.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toRetryStageExecution", []))

    @jsii.member(jsii_name="toStartPipelineExecution")
    def to_start_pipeline_execution(self) -> "Codepipeline":
        '''(experimental) Grants permission to run the most recent revision through the pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_StartPipelineExecution.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toStartPipelineExecution", []))

    @jsii.member(jsii_name="toStopPipelineExecution")
    def to_stop_pipeline_execution(self) -> "Codepipeline":
        '''(experimental) Grants permission to stop an in-progress pipeline execution.

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_StopPipelineExecution.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toStopPipelineExecution", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Codepipeline":
        '''(experimental) Grants permission to tag a CodePipeline resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Codepipeline":
        '''(experimental) Grants permission to remove a tag from a CodePipeline resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdatePipeline")
    def to_update_pipeline(self) -> "Codepipeline":
        '''(experimental) Grants permission to update a pipeline with changes to the structure of the pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_UpdatePipeline.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toUpdatePipeline", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Codestar(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Codestar",
):
    '''(experimental) Statement provider for service `codestar <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscodestar.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `codestar <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscodestar.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Codestar, self, [sid])

    @jsii.member(jsii_name="ifIamResourceTag")
    def if_iam_resource_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Codestar":
        '''(experimental) Applies to resource types: - user.

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "ifIamResourceTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="onProject")
    def on_project(
        self,
        project_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codestar":
        '''(experimental) Adds a resource of type project to the statement.

        https://docs.aws.amazon.com/codestar/latest/userguide/working-with-projects.html

        :param project_id: - Identifier for the projectId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "onProject", [project_id, account, region, partition]))

    @jsii.member(jsii_name="onUser")
    def on_user(
        self,
        user_name_with_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codestar":
        '''(experimental) Adds a resource of type user to the statement.

        :param user_name_with_path: - Identifier for the userNameWithPath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifIamResourceTag()

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "onUser", [user_name_with_path, account, region, partition]))

    @jsii.member(jsii_name="toAssociateTeamMember")
    def to_associate_team_member(self) -> "Codestar":
        '''(experimental) Adds a user to the team for an AWS CodeStar project.

        Access Level: Permissions management

        https://docs.aws.amazon.com/codestar/latest/APIReference/API_AssociateTeamMember.html

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toAssociateTeamMember", []))

    @jsii.member(jsii_name="toCreateProject")
    def to_create_project(self) -> "Codestar":
        '''(experimental) Creates a project with minimal structure, customer policies, and no resources.

        Access Level: Permissions management

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codestar/latest/APIReference/API_CreateProject.html

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toCreateProject", []))

    @jsii.member(jsii_name="toCreateUserProfile")
    def to_create_user_profile(self) -> "Codestar":
        '''(experimental) Creates a profile for a user that includes user preferences, display name, and email.

        Access Level: Write

        https://docs.aws.amazon.com/codestar/latest/APIReference/API_CreateUserProfile.html

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toCreateUserProfile", []))

    @jsii.member(jsii_name="toDeleteExtendedAccess")
    def to_delete_extended_access(self) -> "Codestar":
        '''(experimental) Grants access to extended delete APIs.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toDeleteExtendedAccess", []))

    @jsii.member(jsii_name="toDeleteProject")
    def to_delete_project(self) -> "Codestar":
        '''(experimental) Deletes a project, including project resources.

        Does not delete users associated with the project, but does delete the IAM roles that allowed access to the project.

        Access Level: Permissions management

        https://docs.aws.amazon.com/codestar/latest/APIReference/API_DeleteProject.html

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toDeleteProject", []))

    @jsii.member(jsii_name="toDeleteUserProfile")
    def to_delete_user_profile(self) -> "Codestar":
        '''(experimental) Deletes a user profile in AWS CodeStar, including all personal preference data associated with that profile, such as display name and email address.

        It does not delete the history of that user, for example the history of commits made by that user.

        Access Level: Write

        https://docs.aws.amazon.com/codestar/latest/APIReference/API_DeleteUserProfile.html

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toDeleteUserProfile", []))

    @jsii.member(jsii_name="toDescribeProject")
    def to_describe_project(self) -> "Codestar":
        '''(experimental) Describes a project and its resources.

        Access Level: Read

        https://docs.aws.amazon.com/codestar/latest/APIReference/API_DescribeProject.html

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toDescribeProject", []))

    @jsii.member(jsii_name="toDescribeUserProfile")
    def to_describe_user_profile(self) -> "Codestar":
        '''(experimental) Describes a user in AWS CodeStar and the user attributes across all projects.

        Access Level: Read

        https://docs.aws.amazon.com/codestar/latest/APIReference/API_DescribeUserProfile.html

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toDescribeUserProfile", []))

    @jsii.member(jsii_name="toDisassociateTeamMember")
    def to_disassociate_team_member(self) -> "Codestar":
        '''(experimental) Removes a user from a project.

        Removing a user from a project also removes the IAM policies from that user that allowed access to the project and its resources.

        Access Level: Permissions management

        https://docs.aws.amazon.com/codestar/latest/APIReference/API_DisassociateTeamMember.html

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toDisassociateTeamMember", []))

    @jsii.member(jsii_name="toGetExtendedAccess")
    def to_get_extended_access(self) -> "Codestar":
        '''(experimental) Grants access to extended read APIs.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toGetExtendedAccess", []))

    @jsii.member(jsii_name="toListProjects")
    def to_list_projects(self) -> "Codestar":
        '''(experimental) Lists all projects in CodeStar associated with your AWS account.

        Access Level: List

        https://docs.aws.amazon.com/codestar/latest/APIReference/API_ListProjects.html

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toListProjects", []))

    @jsii.member(jsii_name="toListResources")
    def to_list_resources(self) -> "Codestar":
        '''(experimental) Lists all resources associated with a project in CodeStar.

        Access Level: List

        https://docs.aws.amazon.com/codestar/latest/APIReference/API_ListResources.html

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toListResources", []))

    @jsii.member(jsii_name="toListTagsForProject")
    def to_list_tags_for_project(self) -> "Codestar":
        '''(experimental) Lists the tags associated with a project in CodeStar.

        Access Level: List

        https://docs.aws.amazon.com/codestar/latest/APIReference/API_ListTagsForProject.html

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toListTagsForProject", []))

    @jsii.member(jsii_name="toListTeamMembers")
    def to_list_team_members(self) -> "Codestar":
        '''(experimental) Lists all team members associated with a project.

        Access Level: List

        https://docs.aws.amazon.com/codestar/latest/APIReference/API_ListTeamMembers.html

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toListTeamMembers", []))

    @jsii.member(jsii_name="toListUserProfiles")
    def to_list_user_profiles(self) -> "Codestar":
        '''(experimental) Lists user profiles in AWS CodeStar.

        Access Level: List

        https://docs.aws.amazon.com/codestar/latest/APIReference/API_ListUserProfiles.html

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toListUserProfiles", []))

    @jsii.member(jsii_name="toPutExtendedAccess")
    def to_put_extended_access(self) -> "Codestar":
        '''(experimental) Grants access to extended write APIs.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toPutExtendedAccess", []))

    @jsii.member(jsii_name="toTagProject")
    def to_tag_project(self) -> "Codestar":
        '''(experimental) Adds tags to a project in CodeStar.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codestar/latest/APIReference/API_TagProject.html

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toTagProject", []))

    @jsii.member(jsii_name="toUntagProject")
    def to_untag_project(self) -> "Codestar":
        '''(experimental) Removes tags from a project in CodeStar.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codestar/latest/APIReference/API_UntagProject.html

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toUntagProject", []))

    @jsii.member(jsii_name="toUpdateProject")
    def to_update_project(self) -> "Codestar":
        '''(experimental) Updates a project in CodeStar.

        Access Level: Write

        https://docs.aws.amazon.com/codestar/latest/APIReference/API_UpdateProject.html

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toUpdateProject", []))

    @jsii.member(jsii_name="toUpdateTeamMember")
    def to_update_team_member(self) -> "Codestar":
        '''(experimental) Updates team member attributes within a CodeStar project.

        Access Level: Permissions management

        https://docs.aws.amazon.com/codestar/latest/APIReference/API_UpdateTeamMember.html

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toUpdateTeamMember", []))

    @jsii.member(jsii_name="toUpdateUserProfile")
    def to_update_user_profile(self) -> "Codestar":
        '''(experimental) Updates a profile for a user that includes user preferences, display name, and email.

        Access Level: Write

        https://docs.aws.amazon.com/codestar/latest/APIReference/API_UpdateUserProfile.html

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toUpdateUserProfile", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class CodestarConnections(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.CodestarConnections",
):
    '''(experimental) Statement provider for service `codestar-connections <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscodestarconnections.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `codestar-connections <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscodestarconnections.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(CodestarConnections, self, [sid])

    @jsii.member(jsii_name="ifBranchName")
    def if_branch_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "CodestarConnections":
        '''(experimental) Filters access by the branch name that is passed in the request.

        Applies only to UseConnection requests for access to a specific repository branch

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#permissions-reference-connections-use

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "ifBranchName", [value, operator]))

    @jsii.member(jsii_name="ifFullRepositoryId")
    def if_full_repository_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "CodestarConnections":
        '''(experimental) Filters access by the repository that is passed in the request.

        Applies only to UseConnection requests for access to a specific repository

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#permissions-reference-connections-use

        Applies to actions:

        - .toUseConnection()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "ifFullRepositoryId", [value, operator]))

    @jsii.member(jsii_name="ifHostArn")
    def if_host_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "CodestarConnections":
        '''(experimental) Filters access by the host resource associated with the connection used in the request.

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#permissions-reference-connections-hosts

        Applies to actions:

        - .toRegisterAppCode()
        - .toStartAppRegistrationHandshake()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "ifHostArn", [value, operator]))

    @jsii.member(jsii_name="ifInstallationId")
    def if_installation_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "CodestarConnections":
        '''(experimental) Filters access by the third-party ID (such as the Bitbucket App installation ID for CodeStar Connections) that is used to update a Connection.

        Allows you to restrict which third-party App installations can be used to make a Connection

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#permissions-reference-connections-handshake

        Applies to actions:

        - .toUpdateConnectionInstallation()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "ifInstallationId", [value, operator]))

    @jsii.member(jsii_name="ifOwnerId")
    def if_owner_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "CodestarConnections":
        '''(experimental) Filters access by the owner of the third-party repository.

        Applies only to UseConnection requests for access to repositories owned by a specific user

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#permissions-reference-connections-use

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "ifOwnerId", [value, operator]))

    @jsii.member(jsii_name="ifPassedToService")
    def if_passed_to_service(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "CodestarConnections":
        '''(experimental) Filters access by the service to which the principal is allowed to pass a Connection.

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#permissions-reference-connections-passconnection

        Applies to actions:

        - .toPassConnection()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "ifPassedToService", [value, operator]))

    @jsii.member(jsii_name="ifProviderAction")
    def if_provider_action(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "CodestarConnections":
        '''(experimental) Filters access by the provider action in a UseConnection request such as ListRepositories. See documentation for all valid values.

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#permissions-reference-connections-access

        Applies to actions:

        - .toUseConnection()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "ifProviderAction", [value, operator]))

    @jsii.member(jsii_name="ifProviderPermissionsRequired")
    def if_provider_permissions_required(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "CodestarConnections":
        '''(experimental) Filters access by the write permissions of a provider action in a UseConnection request.

        Valid types include read_only and read_write

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#permissions-reference-connections-use

        Applies to actions:

        - .toUseConnection()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "ifProviderPermissionsRequired", [value, operator]))

    @jsii.member(jsii_name="ifProviderType")
    def if_provider_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "CodestarConnections":
        '''(experimental) Filters access by the type of third-party provider passed in the request.

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#permissions-reference-connections-managing

        Applies to actions:

        - .toCreateConnection()
        - .toCreateHost()
        - .toGetIndividualAccessToken()
        - .toGetInstallationUrl()
        - .toStartOAuthHandshake()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "ifProviderType", [value, operator]))

    @jsii.member(jsii_name="ifProviderTypeFilter")
    def if_provider_type_filter(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "CodestarConnections":
        '''(experimental) Filters access by the type of third-party provider used to filter results.

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#permissions-reference-connections-managing

        Applies to actions:

        - .toListConnections()
        - .toListHosts()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "ifProviderTypeFilter", [value, operator]))

    @jsii.member(jsii_name="ifRepositoryName")
    def if_repository_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "CodestarConnections":
        '''(experimental) Filters access by the repository name that is passed in the request.

        Applies only to UseConnection requests for creating new repositories

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#permissions-reference-connections-use

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "ifRepositoryName", [value, operator]))

    @jsii.member(jsii_name="onConnection")
    def on_connection(
        self,
        connection_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "CodestarConnections":
        '''(experimental) Adds a resource of type Connection to the statement.

        https://docs.aws.amazon.com/dtconsole/latest/userguide/connections.html

        :param connection_id: - Identifier for the connectionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "onConnection", [connection_id, account, region, partition]))

    @jsii.member(jsii_name="onHost")
    def on_host(
        self,
        host_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "CodestarConnections":
        '''(experimental) Adds a resource of type Host to the statement.

        https://docs.aws.amazon.com/dtconsole/latest/userguide/connections-hosts.html

        :param host_id: - Identifier for the hostId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "onHost", [host_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateConnection")
    def to_create_connection(self) -> "CodestarConnections":
        '''(experimental) Grants permission to create a Connection resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifProviderType()

        https://docs.aws.amazon.com/codestar-connections/latest/APIReference/API_CreateConnection.html

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toCreateConnection", []))

    @jsii.member(jsii_name="toCreateHost")
    def to_create_host(self) -> "CodestarConnections":
        '''(experimental) Grants permission to create a host resource.

        Access Level: Write

        Possible conditions:

        - .ifProviderType()

        https://docs.aws.amazon.com/codestar-connections/latest/APIReference/API_CreateHost.html

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toCreateHost", []))

    @jsii.member(jsii_name="toDeleteConnection")
    def to_delete_connection(self) -> "CodestarConnections":
        '''(experimental) Grants permission to delete a Connection resource.

        Access Level: Write

        https://docs.aws.amazon.com/codestar-connections/latest/APIReference/API_DeleteConnection.html

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toDeleteConnection", []))

    @jsii.member(jsii_name="toDeleteHost")
    def to_delete_host(self) -> "CodestarConnections":
        '''(experimental) Grants permission to delete a host resource.

        Access Level: Write

        https://docs.aws.amazon.com/codestar-connections/latest/APIReference/API_DeleteHost.html

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toDeleteHost", []))

    @jsii.member(jsii_name="toGetConnection")
    def to_get_connection(self) -> "CodestarConnections":
        '''(experimental) Grants permission to get details about a Connection resource.

        Access Level: Read

        https://docs.aws.amazon.com/codestar-connections/latest/APIReference/API_GetConnection.html

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toGetConnection", []))

    @jsii.member(jsii_name="toGetHost")
    def to_get_host(self) -> "CodestarConnections":
        '''(experimental) Grants permission to get details about a host resource.

        Access Level: Read

        https://docs.aws.amazon.com/codestar-connections/latest/APIReference/API_GetHost.html

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toGetHost", []))

    @jsii.member(jsii_name="toGetIndividualAccessToken")
    def to_get_individual_access_token(self) -> "CodestarConnections":
        '''(experimental) Grants permission to associate a third party, such as a Bitbucket App installation, with a Connection.

        Access Level: Read

        Possible conditions:

        - .ifProviderType()

        Dependent actions:

        - codestar-connections:StartOAuthHandshake

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#permissions-reference-connections-handshake

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toGetIndividualAccessToken", []))

    @jsii.member(jsii_name="toGetInstallationUrl")
    def to_get_installation_url(self) -> "CodestarConnections":
        '''(experimental) Grants permission to associate a third party, such as a Bitbucket App installation, with a Connection.

        Access Level: Read

        Possible conditions:

        - .ifProviderType()

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#permissions-reference-connections-handshake

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toGetInstallationUrl", []))

    @jsii.member(jsii_name="toListConnections")
    def to_list_connections(self) -> "CodestarConnections":
        '''(experimental) Grants permission to list Connection resources.

        Access Level: List

        Possible conditions:

        - .ifProviderTypeFilter()

        https://docs.aws.amazon.com/codestar-connections/latest/APIReference/API_ListConnections.html

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toListConnections", []))

    @jsii.member(jsii_name="toListHosts")
    def to_list_hosts(self) -> "CodestarConnections":
        '''(experimental) Grants permission to list host resources.

        Access Level: List

        Possible conditions:

        - .ifProviderTypeFilter()

        https://docs.aws.amazon.com/codestar-connections/latest/APIReference/API_ListHosts.html

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toListHosts", []))

    @jsii.member(jsii_name="toListInstallationTargets")
    def to_list_installation_targets(self) -> "CodestarConnections":
        '''(experimental) Grants permission to associate a third party, such as a Bitbucket App installation, with a Connection.

        Access Level: List

        Dependent actions:

        - codestar-connections:GetIndividualAccessToken
        - codestar-connections:StartOAuthHandshake

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#permissions-reference-connections-handshake

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toListInstallationTargets", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "CodestarConnections":
        '''(experimental) Gets the set of key-value pairs that are used to manage the resource.

        Access Level: List

        https://docs.aws.amazon.com/codestar-connections/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPassConnection")
    def to_pass_connection(self) -> "CodestarConnections":
        '''(experimental) Grants permission to pass a Connection resource to an AWS service that accepts a Connection ARN as input, such as codepipeline:CreatePipeline.

        Access Level: Read

        Possible conditions:

        - .ifPassedToService()

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#permissions-reference-connections-passconnection

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toPassConnection", []))

    @jsii.member(jsii_name="toRegisterAppCode")
    def to_register_app_code(self) -> "CodestarConnections":
        '''(experimental) Grants permission to associate a third party server, such as a GitHub Enterprise Server instance, with a Host.

        Access Level: Read

        Possible conditions:

        - .ifHostArn()

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#connections-permissions-actions-host-registration

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toRegisterAppCode", []))

    @jsii.member(jsii_name="toStartAppRegistrationHandshake")
    def to_start_app_registration_handshake(self) -> "CodestarConnections":
        '''(experimental) Grants permission to associate a third party server, such as a GitHub Enterprise Server instance, with a Host.

        Access Level: Read

        Possible conditions:

        - .ifHostArn()

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#connections-permissions-actions-host-registration

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toStartAppRegistrationHandshake", []))

    @jsii.member(jsii_name="toStartOAuthHandshake")
    def to_start_o_auth_handshake(self) -> "CodestarConnections":
        '''(experimental) Grants permission to associate a third party, such as a Bitbucket App installation, with a Connection.

        Access Level: Read

        Possible conditions:

        - .ifProviderType()

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#permissions-reference-connections-handshake

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toStartOAuthHandshake", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "CodestarConnections":
        '''(experimental) Adds to or modifies the tags of the given resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/codestar-connections/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "CodestarConnections":
        '''(experimental) Removes tags from an AWS resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codestar-connections/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateConnectionInstallation")
    def to_update_connection_installation(self) -> "CodestarConnections":
        '''(experimental) Grants permission to update a Connection resource with an installation of the CodeStar Connections App.

        Access Level: Write

        Possible conditions:

        - .ifInstallationId()

        Dependent actions:

        - codestar-connections:GetIndividualAccessToken
        - codestar-connections:GetInstallationUrl
        - codestar-connections:ListInstallationTargets
        - codestar-connections:StartOAuthHandshake

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#permissions-reference-connections-handshake

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toUpdateConnectionInstallation", []))

    @jsii.member(jsii_name="toUpdateHost")
    def to_update_host(self) -> "CodestarConnections":
        '''(experimental) Grants permission to update a host resource.

        Access Level: Write

        https://docs.aws.amazon.com/codestar-connections/latest/APIReference/API_UpdateHost.html

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toUpdateHost", []))

    @jsii.member(jsii_name="toUseConnection")
    def to_use_connection(self) -> "CodestarConnections":
        '''(experimental) Grants permission to use a Connection resource to call provider actions.

        Access Level: Read

        Possible conditions:

        - .ifFullRepositoryId()
        - .ifProviderAction()
        - .ifProviderPermissionsRequired()

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#permissions-reference-connections-use

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toUseConnection", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class CodestarNotifications(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.CodestarNotifications",
):
    '''(experimental) Statement provider for service `codestar-notifications <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscodestarnotifications.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `codestar-notifications <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscodestarnotifications.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(CodestarNotifications, self, [sid])

    @jsii.member(jsii_name="ifNotificationsForResource")
    def if_notifications_for_resource(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "CodestarNotifications":
        '''(experimental) Filters access based on the ARN of the resource for which notifications are configured.

        https://docs.aws.amazon.com/codestar-notifications/latest/userguide/security_iam_id-based-policy-examples.html

        Applies to actions:

        - .toCreateNotificationRule()
        - .toDeleteNotificationRule()
        - .toDescribeNotificationRule()
        - .toSubscribe()
        - .toUnsubscribe()
        - .toUpdateNotificationRule()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("CodestarNotifications", jsii.invoke(self, "ifNotificationsForResource", [value, operator]))

    @jsii.member(jsii_name="onNotificationrule")
    def on_notificationrule(
        self,
        notification_rule_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "CodestarNotifications":
        '''(experimental) Adds a resource of type notificationrule to the statement.

        https://docs.aws.amazon.com/codestar-notifications/latest/userguide/security_iam_service-with-iam.html

        :param notification_rule_id: - Identifier for the notificationRuleId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("CodestarNotifications", jsii.invoke(self, "onNotificationrule", [notification_rule_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateNotificationRule")
    def to_create_notification_rule(self) -> "CodestarNotifications":
        '''(experimental) Grants permission to create a notification rule for a resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifNotificationsForResource()

        https://docs.aws.amazon.com/codestar-notifications/latest/APIReference/API_CreateNotificationRule.html

        :stability: experimental
        '''
        return typing.cast("CodestarNotifications", jsii.invoke(self, "toCreateNotificationRule", []))

    @jsii.member(jsii_name="toDeleteNotificationRule")
    def to_delete_notification_rule(self) -> "CodestarNotifications":
        '''(experimental) Grants permission to delete a notification rule for a resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifNotificationsForResource()

        https://docs.aws.amazon.com/codestar-notifications/latest/APIReference/API_DeleteNotificationRule.html

        :stability: experimental
        '''
        return typing.cast("CodestarNotifications", jsii.invoke(self, "toDeleteNotificationRule", []))

    @jsii.member(jsii_name="toDeleteTarget")
    def to_delete_target(self) -> "CodestarNotifications":
        '''(experimental) Grants permission to delete a target for a notification rule.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codestar-notifications/latest/APIReference/API_DeleteTarget.html

        :stability: experimental
        '''
        return typing.cast("CodestarNotifications", jsii.invoke(self, "toDeleteTarget", []))

    @jsii.member(jsii_name="toDescribeNotificationRule")
    def to_describe_notification_rule(self) -> "CodestarNotifications":
        '''(experimental) Grants permission to get information about a notification rule.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifNotificationsForResource()

        https://docs.aws.amazon.com/codestar-notifications/latest/APIReference/API_DescribeNotificationRule.html

        :stability: experimental
        '''
        return typing.cast("CodestarNotifications", jsii.invoke(self, "toDescribeNotificationRule", []))

    @jsii.member(jsii_name="toListEventTypes")
    def to_list_event_types(self) -> "CodestarNotifications":
        '''(experimental) Grants permission to list notifications event types.

        Access Level: List

        https://docs.aws.amazon.com/codestar-notifications/latest/APIReference/API_ListEventTypes.html

        :stability: experimental
        '''
        return typing.cast("CodestarNotifications", jsii.invoke(self, "toListEventTypes", []))

    @jsii.member(jsii_name="toListNotificationRules")
    def to_list_notification_rules(self) -> "CodestarNotifications":
        '''(experimental) Grants permission to list notification rules in an AWS account.

        Access Level: List

        https://docs.aws.amazon.com/codestar-notifications/latest/APIReference/API_ListNotificationRules.html

        :stability: experimental
        '''
        return typing.cast("CodestarNotifications", jsii.invoke(self, "toListNotificationRules", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "CodestarNotifications":
        '''(experimental) Grants permission to list the tags attached to a notification rule resource ARN.

        Access Level: List

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codestar-notifications/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("CodestarNotifications", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTargets")
    def to_list_targets(self) -> "CodestarNotifications":
        '''(experimental) Grants permission to list the notification rule targets for an AWS account.

        Access Level: List

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codestar-notifications/latest/APIReference/API_ListTargets.html

        :stability: experimental
        '''
        return typing.cast("CodestarNotifications", jsii.invoke(self, "toListTargets", []))

    @jsii.member(jsii_name="toSubscribe")
    def to_subscribe(self) -> "CodestarNotifications":
        '''(experimental) Grants permission to create an association between a notification rule and an Amazon SNS topic.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifNotificationsForResource()

        https://docs.aws.amazon.com/codestar-notifications/latest/APIReference/API_Subscribe.html

        :stability: experimental
        '''
        return typing.cast("CodestarNotifications", jsii.invoke(self, "toSubscribe", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "CodestarNotifications":
        '''(experimental) Grants permission to attach resource tags to a notification rule resource ARN.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codestar-notifications/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("CodestarNotifications", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUnsubscribe")
    def to_unsubscribe(self) -> "CodestarNotifications":
        '''(experimental) Grants permission to remove an association between a notification rule and an Amazon SNS topic.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifNotificationsForResource()

        https://docs.aws.amazon.com/codestar-notifications/latest/APIReference/API_Unsubscribe.html

        :stability: experimental
        '''
        return typing.cast("CodestarNotifications", jsii.invoke(self, "toUnsubscribe", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "CodestarNotifications":
        '''(experimental) Grants permission to disassociate resource tags from a notification rule resource ARN.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codestar-notifications/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("CodestarNotifications", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateNotificationRule")
    def to_update_notification_rule(self) -> "CodestarNotifications":
        '''(experimental) Grants permission to change a notification rule for a resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifNotificationsForResource()

        https://docs.aws.amazon.com/codestar-notifications/latest/APIReference/API_UpdateNotificationRule.html

        :stability: experimental
        '''
        return typing.cast("CodestarNotifications", jsii.invoke(self, "toUpdateNotificationRule", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class CognitoIdentity(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.CognitoIdentity",
):
    '''(experimental) Statement provider for service `cognito-identity <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncognitoidentity.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `cognito-identity <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncognitoidentity.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(CognitoIdentity, self, [sid])

    @jsii.member(jsii_name="onIdentitypool")
    def on_identitypool(
        self,
        identity_pool_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "CognitoIdentity":
        '''(experimental) Adds a resource of type identitypool to the statement.

        https://docs.aws.amazon.com/cognito/latest/developerguide/identity-pools.html

        :param identity_pool_id: - Identifier for the identityPoolId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "onIdentitypool", [identity_pool_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateIdentityPool")
    def to_create_identity_pool(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to create a new identity pool.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_CreateIdentityPool.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toCreateIdentityPool", []))

    @jsii.member(jsii_name="toDeleteIdentities")
    def to_delete_identities(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to delete identities from an identity pool.

        You can specify a list of 1-60 identities that you want to delete

        Access Level: Write

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_DeleteIdentities.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toDeleteIdentities", []))

    @jsii.member(jsii_name="toDeleteIdentityPool")
    def to_delete_identity_pool(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to delete a user pool.

        Once a pool is deleted, users will not be able to authenticate with the pool

        Access Level: Write

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_DeleteIdentityPool.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toDeleteIdentityPool", []))

    @jsii.member(jsii_name="toDescribeIdentity")
    def to_describe_identity(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to return metadata related to the given identity, including when the identity was created and any associated linked logins.

        Access Level: Read

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_DescribeIdentity.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toDescribeIdentity", []))

    @jsii.member(jsii_name="toDescribeIdentityPool")
    def to_describe_identity_pool(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to get details about a particular identity pool, including the pool name, ID description, creation date, and current number of users.

        Access Level: Read

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_DescribeIdentityPool.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toDescribeIdentityPool", []))

    @jsii.member(jsii_name="toGetCredentialsForIdentity")
    def to_get_credentials_for_identity(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to return credentials for the provided identity ID.

        Access Level: Read

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_GetCredentialsForIdentity.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toGetCredentialsForIdentity", []))

    @jsii.member(jsii_name="toGetId")
    def to_get_id(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to generate (or retrieve) a Cognito ID. Supplying multiple logins will create an implicit linked account.

        Access Level: Write

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_GetId.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toGetId", []))

    @jsii.member(jsii_name="toGetIdentityPoolRoles")
    def to_get_identity_pool_roles(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to get the roles for an identity pool.

        Access Level: Read

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_GetIdentityPoolRoles.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toGetIdentityPoolRoles", []))

    @jsii.member(jsii_name="toGetOpenIdToken")
    def to_get_open_id_token(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to get an OpenID token, using a known Cognito ID.

        Access Level: Read

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_GetOpenIdToken.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toGetOpenIdToken", []))

    @jsii.member(jsii_name="toGetOpenIdTokenForDeveloperIdentity")
    def to_get_open_id_token_for_developer_identity(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to register (or retrieve) a Cognito IdentityId and an OpenID Connect token for a user authenticated by your backend authentication process.

        Access Level: Read

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_GetOpenIdTokenForDeveloperIdentity.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toGetOpenIdTokenForDeveloperIdentity", []))

    @jsii.member(jsii_name="toGetPrincipalTagAttributeMap")
    def to_get_principal_tag_attribute_map(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to get the principal tags for an identity pool and provider.

        Access Level: Read

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_GetPrincipalTagAttributeMap.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toGetPrincipalTagAttributeMap", []))

    @jsii.member(jsii_name="toListIdentities")
    def to_list_identities(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to list the identities in an identity pool.

        Access Level: List

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_ListIdentities.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toListIdentities", []))

    @jsii.member(jsii_name="toListIdentityPools")
    def to_list_identity_pools(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to list all of the Cognito identity pools registered for your account.

        Access Level: List

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_ListIdentityPools.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toListIdentityPools", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to list the tags that are assigned to an Amazon Cognito identity pool.

        Access Level: Read

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toLookupDeveloperIdentity")
    def to_lookup_developer_identity(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to retrieve the IdentityId associated with a DeveloperUserIdentifier or the list of DeveloperUserIdentifiers associated with an IdentityId for an existing identity.

        Access Level: Read

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_LookupDeveloperIdentity.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toLookupDeveloperIdentity", []))

    @jsii.member(jsii_name="toMergeDeveloperIdentities")
    def to_merge_developer_identities(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to merge two users having different IdentityIds, existing in the same identity pool, and identified by the same developer provider.

        Access Level: Write

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_MergeDeveloperIdentities.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toMergeDeveloperIdentities", []))

    @jsii.member(jsii_name="toSetIdentityPoolRoles")
    def to_set_identity_pool_roles(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to set the roles for an identity pool.

        These roles are used when making calls to GetCredentialsForIdentity action

        Access Level: Write

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_SetIdentityPoolRoles.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toSetIdentityPoolRoles", []))

    @jsii.member(jsii_name="toSetPrincipalTagAttributeMap")
    def to_set_principal_tag_attribute_map(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to set the principal tags for an identity pool and provider.

        These tags are used when making calls to GetOpenIdToken action

        Access Level: Write

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_SetPrincipalTagAttributeMap.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toSetPrincipalTagAttributeMap", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to assign a set of tags to an Amazon Cognito identity pool.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUnlinkDeveloperIdentity")
    def to_unlink_developer_identity(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to unlink a DeveloperUserIdentifier from an existing identity.

        Access Level: Write

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_UnlinkDeveloperIdentity.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toUnlinkDeveloperIdentity", []))

    @jsii.member(jsii_name="toUnlinkIdentity")
    def to_unlink_identity(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to unlink a federated identity from an existing account.

        Access Level: Write

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_UnlinkIdentity.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toUnlinkIdentity", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to remove the specified tags from an Amazon Cognito identity pool.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateIdentityPool")
    def to_update_identity_pool(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to update an identity pool.

        Access Level: Write

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_UpdateIdentityPool.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toUpdateIdentityPool", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class CognitoIdp(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.CognitoIdp",
):
    '''(experimental) Statement provider for service `cognito-idp <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncognitouserpools.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `cognito-idp <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncognitouserpools.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(CognitoIdp, self, [sid])

    @jsii.member(jsii_name="onUserpool")
    def on_userpool(
        self,
        user_pool_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "CognitoIdp":
        '''(experimental) Adds a resource of type userpool to the statement.

        https://docs.aws.amazon.com/cognito/latest/developerguide/resource-permissions.html#amazon-cognito-amazon-resource-names

        :param user_pool_id: - Identifier for the userPoolId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "onUserpool", [user_pool_id, account, region, partition]))

    @jsii.member(jsii_name="toAddCustomAttributes")
    def to_add_custom_attributes(self) -> "CognitoIdp":
        '''(experimental) Adds additional user attributes to the user pool schema.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AddCustomAttributes.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAddCustomAttributes", []))

    @jsii.member(jsii_name="toAdminAddUserToGroup")
    def to_admin_add_user_to_group(self) -> "CognitoIdp":
        '''(experimental) Adds the specified user to the specified group.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminAddUserToGroup.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminAddUserToGroup", []))

    @jsii.member(jsii_name="toAdminConfirmSignUp")
    def to_admin_confirm_sign_up(self) -> "CognitoIdp":
        '''(experimental) Confirms user registration as an admin without using a confirmation code. Works on any user.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminConfirmSignUp.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminConfirmSignUp", []))

    @jsii.member(jsii_name="toAdminCreateUser")
    def to_admin_create_user(self) -> "CognitoIdp":
        '''(experimental) Creates a new user in the specified user pool and sends a welcome message via email or phone (SMS).

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminCreateUser.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminCreateUser", []))

    @jsii.member(jsii_name="toAdminDeleteUser")
    def to_admin_delete_user(self) -> "CognitoIdp":
        '''(experimental) Deletes a user as an administrator. Works on any user.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminDeleteUser.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminDeleteUser", []))

    @jsii.member(jsii_name="toAdminDeleteUserAttributes")
    def to_admin_delete_user_attributes(self) -> "CognitoIdp":
        '''(experimental) Deletes the user attributes in a user pool as an administrator. Works on any user.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminDeleteUserAttributes.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminDeleteUserAttributes", []))

    @jsii.member(jsii_name="toAdminDisableProviderForUser")
    def to_admin_disable_provider_for_user(self) -> "CognitoIdp":
        '''(experimental) Disables the user from signing in with the specified external (SAML or social) identity provider.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminDisableProviderForUser.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminDisableProviderForUser", []))

    @jsii.member(jsii_name="toAdminDisableUser")
    def to_admin_disable_user(self) -> "CognitoIdp":
        '''(experimental) Disables the specified user as an administrator. Works on any user.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminDisableUser.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminDisableUser", []))

    @jsii.member(jsii_name="toAdminEnableUser")
    def to_admin_enable_user(self) -> "CognitoIdp":
        '''(experimental) Enables the specified user as an administrator. Works on any user.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminEnableUser.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminEnableUser", []))

    @jsii.member(jsii_name="toAdminForgetDevice")
    def to_admin_forget_device(self) -> "CognitoIdp":
        '''(experimental) Forgets the device, as an administrator.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminForgetDevice.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminForgetDevice", []))

    @jsii.member(jsii_name="toAdminGetDevice")
    def to_admin_get_device(self) -> "CognitoIdp":
        '''(experimental) Gets the device, as an administrator.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminGetDevice.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminGetDevice", []))

    @jsii.member(jsii_name="toAdminGetUser")
    def to_admin_get_user(self) -> "CognitoIdp":
        '''(experimental) Gets the specified user by user name in a user pool as an administrator. Works on any user.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminGetUser.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminGetUser", []))

    @jsii.member(jsii_name="toAdminInitiateAuth")
    def to_admin_initiate_auth(self) -> "CognitoIdp":
        '''(experimental) Authenticates a user in a user pool as an administrator. Works on any user.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminInitiateAuth.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminInitiateAuth", []))

    @jsii.member(jsii_name="toAdminLinkProviderForUser")
    def to_admin_link_provider_for_user(self) -> "CognitoIdp":
        '''(experimental) Links an existing user account in a user pool (DestinationUser) to an identity from an external identity provider (SourceUser) based on a specified attribute name and value from the external identity provider.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminLinkProviderForUser.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminLinkProviderForUser", []))

    @jsii.member(jsii_name="toAdminListDevices")
    def to_admin_list_devices(self) -> "CognitoIdp":
        '''(experimental) Lists devices, as an administrator.

        Access Level: List

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminListDevices.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminListDevices", []))

    @jsii.member(jsii_name="toAdminListGroupsForUser")
    def to_admin_list_groups_for_user(self) -> "CognitoIdp":
        '''(experimental) Lists the groups that the user belongs to.

        Access Level: List

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminInitiateAuth.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminListGroupsForUser", []))

    @jsii.member(jsii_name="toAdminListUserAuthEvents")
    def to_admin_list_user_auth_events(self) -> "CognitoIdp":
        '''(experimental) Lists the authentication events for the user.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminListUserAuthEvents.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminListUserAuthEvents", []))

    @jsii.member(jsii_name="toAdminRemoveUserFromGroup")
    def to_admin_remove_user_from_group(self) -> "CognitoIdp":
        '''(experimental) Removes the specified user from the specified group.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminRemoveUserFromGroup.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminRemoveUserFromGroup", []))

    @jsii.member(jsii_name="toAdminResetUserPassword")
    def to_admin_reset_user_password(self) -> "CognitoIdp":
        '''(experimental) Resets the specified user's password in a user pool as an administrator. Works on any user.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminResetUserPassword.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminResetUserPassword", []))

    @jsii.member(jsii_name="toAdminRespondToAuthChallenge")
    def to_admin_respond_to_auth_challenge(self) -> "CognitoIdp":
        '''(experimental) Responds to an authentication challenge, as an administrator.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminRespondToAuthChallenge.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminRespondToAuthChallenge", []))

    @jsii.member(jsii_name="toAdminSetUserMFAPreference")
    def to_admin_set_user_mfa_preference(self) -> "CognitoIdp":
        '''(experimental) Sets MFA preference for the user in the userpool.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminSetUserMFAPreference.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminSetUserMFAPreference", []))

    @jsii.member(jsii_name="toAdminSetUserPassword")
    def to_admin_set_user_password(self) -> "CognitoIdp":
        '''(experimental) Sets the specified user's password in a user pool as an administrator. Works on any user.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminSetUserPassword.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminSetUserPassword", []))

    @jsii.member(jsii_name="toAdminSetUserSettings")
    def to_admin_set_user_settings(self) -> "CognitoIdp":
        '''(experimental) Sets all the user settings for a specified user name. Works on any user.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminSetUserSettings.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminSetUserSettings", []))

    @jsii.member(jsii_name="toAdminUpdateAuthEventFeedback")
    def to_admin_update_auth_event_feedback(self) -> "CognitoIdp":
        '''(experimental) Updates the feedback for the user authentication event.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminUpdateAuthEventFeedback.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminUpdateAuthEventFeedback", []))

    @jsii.member(jsii_name="toAdminUpdateDeviceStatus")
    def to_admin_update_device_status(self) -> "CognitoIdp":
        '''(experimental) Updates the device status as an administrator.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminUpdateDeviceStatus.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminUpdateDeviceStatus", []))

    @jsii.member(jsii_name="toAdminUpdateUserAttributes")
    def to_admin_update_user_attributes(self) -> "CognitoIdp":
        '''(experimental) Updates the specified user's attributes, including developer attributes, as an administrator.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminUpdateUserAttributes.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminUpdateUserAttributes", []))

    @jsii.member(jsii_name="toAdminUserGlobalSignOut")
    def to_admin_user_global_sign_out(self) -> "CognitoIdp":
        '''(experimental) Signs out users from all devices, as an administrator.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminUserGlobalSignOut.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminUserGlobalSignOut", []))

    @jsii.member(jsii_name="toAssociateSoftwareToken")
    def to_associate_software_token(self) -> "CognitoIdp":
        '''(experimental) Returns a unique generated shared secret key code for the user account.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AssociateSoftwareToken.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAssociateSoftwareToken", []))

    @jsii.member(jsii_name="toChangePassword")
    def to_change_password(self) -> "CognitoIdp":
        '''(experimental) Changes the password for a specified user in a user pool.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ChangePassword.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toChangePassword", []))

    @jsii.member(jsii_name="toConfirmDevice")
    def to_confirm_device(self) -> "CognitoIdp":
        '''(experimental) Confirms tracking of the device. This API call is the call that begins device tracking.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ConfirmDevice.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toConfirmDevice", []))

    @jsii.member(jsii_name="toConfirmForgotPassword")
    def to_confirm_forgot_password(self) -> "CognitoIdp":
        '''(experimental) Allows a user to enter a confirmation code to reset a forgotten password.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ConfirmForgotPassword.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toConfirmForgotPassword", []))

    @jsii.member(jsii_name="toConfirmSignUp")
    def to_confirm_sign_up(self) -> "CognitoIdp":
        '''(experimental) Confirms registration of a user and handles the existing alias from a previous user.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ConfirmSignUp.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toConfirmSignUp", []))

    @jsii.member(jsii_name="toCreateGroup")
    def to_create_group(self) -> "CognitoIdp":
        '''(experimental) Creates a new group in the specified user pool.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateGroup.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toCreateGroup", []))

    @jsii.member(jsii_name="toCreateIdentityProvider")
    def to_create_identity_provider(self) -> "CognitoIdp":
        '''(experimental) Creates an identity provider for a user pool.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateIdentityProvider.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toCreateIdentityProvider", []))

    @jsii.member(jsii_name="toCreateResourceServer")
    def to_create_resource_server(self) -> "CognitoIdp":
        '''(experimental) Creates a new OAuth2.0 resource server and defines custom scopes in it.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateResourceServer.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toCreateResourceServer", []))

    @jsii.member(jsii_name="toCreateUserImportJob")
    def to_create_user_import_job(self) -> "CognitoIdp":
        '''(experimental) Creates the user import job.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateUserImportJob.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toCreateUserImportJob", []))

    @jsii.member(jsii_name="toCreateUserPool")
    def to_create_user_pool(self) -> "CognitoIdp":
        '''(experimental) Creates a new Amazon Cognito user pool and sets the password policy for the pool.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateUserPool.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toCreateUserPool", []))

    @jsii.member(jsii_name="toCreateUserPoolClient")
    def to_create_user_pool_client(self) -> "CognitoIdp":
        '''(experimental) Creates the user pool client.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateUserPoolClient.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toCreateUserPoolClient", []))

    @jsii.member(jsii_name="toCreateUserPoolDomain")
    def to_create_user_pool_domain(self) -> "CognitoIdp":
        '''(experimental) Creates a new domain for a user pool.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateUserPoolDomain.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toCreateUserPoolDomain", []))

    @jsii.member(jsii_name="toDeleteGroup")
    def to_delete_group(self) -> "CognitoIdp":
        '''(experimental) Deletes a group. Currently only groups with no members can be deleted.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteGroup.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toDeleteGroup", []))

    @jsii.member(jsii_name="toDeleteIdentityProvider")
    def to_delete_identity_provider(self) -> "CognitoIdp":
        '''(experimental) Deletes an identity provider for a user pool.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteIdentityProvider.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toDeleteIdentityProvider", []))

    @jsii.member(jsii_name="toDeleteResourceServer")
    def to_delete_resource_server(self) -> "CognitoIdp":
        '''(experimental) Deletes a resource server.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteResourceServer.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toDeleteResourceServer", []))

    @jsii.member(jsii_name="toDeleteUser")
    def to_delete_user(self) -> "CognitoIdp":
        '''(experimental) Allows a user to delete one's self.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteUser.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toDeleteUser", []))

    @jsii.member(jsii_name="toDeleteUserAttributes")
    def to_delete_user_attributes(self) -> "CognitoIdp":
        '''(experimental) Deletes the attributes for a user.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteUserAttributes.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toDeleteUserAttributes", []))

    @jsii.member(jsii_name="toDeleteUserPool")
    def to_delete_user_pool(self) -> "CognitoIdp":
        '''(experimental) Deletes the specified Amazon Cognito user pool.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteUserPool.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toDeleteUserPool", []))

    @jsii.member(jsii_name="toDeleteUserPoolClient")
    def to_delete_user_pool_client(self) -> "CognitoIdp":
        '''(experimental) Allows the developer to delete the user pool client.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteUserPoolClient.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toDeleteUserPoolClient", []))

    @jsii.member(jsii_name="toDeleteUserPoolDomain")
    def to_delete_user_pool_domain(self) -> "CognitoIdp":
        '''(experimental) Deletes a domain for a user pool.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteUserPoolDomain.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toDeleteUserPoolDomain", []))

    @jsii.member(jsii_name="toDescribeIdentityProvider")
    def to_describe_identity_provider(self) -> "CognitoIdp":
        '''(experimental) Gets information about a specific identity provider.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeIdentityProvider.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toDescribeIdentityProvider", []))

    @jsii.member(jsii_name="toDescribeResourceServer")
    def to_describe_resource_server(self) -> "CognitoIdp":
        '''(experimental) Describes a resource server.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeResourceServer.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toDescribeResourceServer", []))

    @jsii.member(jsii_name="toDescribeRiskConfiguration")
    def to_describe_risk_configuration(self) -> "CognitoIdp":
        '''(experimental) Describes the risk configuration setting for the userpool / userpool client.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeRiskConfiguration.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toDescribeRiskConfiguration", []))

    @jsii.member(jsii_name="toDescribeUserImportJob")
    def to_describe_user_import_job(self) -> "CognitoIdp":
        '''(experimental) Describes the user import job.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeUserImportJob.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toDescribeUserImportJob", []))

    @jsii.member(jsii_name="toDescribeUserPool")
    def to_describe_user_pool(self) -> "CognitoIdp":
        '''(experimental) Returns the configuration information and metadata of the specified user pool.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeUserPool.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toDescribeUserPool", []))

    @jsii.member(jsii_name="toDescribeUserPoolClient")
    def to_describe_user_pool_client(self) -> "CognitoIdp":
        '''(experimental) Client method for returning the configuration information and metadata of the specified user pool client.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeUserPoolClient.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toDescribeUserPoolClient", []))

    @jsii.member(jsii_name="toDescribeUserPoolDomain")
    def to_describe_user_pool_domain(self) -> "CognitoIdp":
        '''(experimental) Gets information about a domain.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeUserPoolDomain.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toDescribeUserPoolDomain", []))

    @jsii.member(jsii_name="toForgetDevice")
    def to_forget_device(self) -> "CognitoIdp":
        '''(experimental) Forgets the specified device.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ForgetDevice.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toForgetDevice", []))

    @jsii.member(jsii_name="toForgotPassword")
    def to_forgot_password(self) -> "CognitoIdp":
        '''(experimental) Calling this API causes a message to be sent to the end user with a confirmation code that is required to change the user's password.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ForgotPassword.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toForgotPassword", []))

    @jsii.member(jsii_name="toGetCSVHeader")
    def to_get_csv_header(self) -> "CognitoIdp":
        '''(experimental) Gets the header information for the .csv file to be used as input for the user import job.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetCSVHeader.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toGetCSVHeader", []))

    @jsii.member(jsii_name="toGetDevice")
    def to_get_device(self) -> "CognitoIdp":
        '''(experimental) Gets the device.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetDevice.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toGetDevice", []))

    @jsii.member(jsii_name="toGetGroup")
    def to_get_group(self) -> "CognitoIdp":
        '''(experimental) Gets a group.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetGroup.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toGetGroup", []))

    @jsii.member(jsii_name="toGetIdentityProviderByIdentifier")
    def to_get_identity_provider_by_identifier(self) -> "CognitoIdp":
        '''(experimental) Gets the specified identity provider.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetIdentityProviderByIdentifier.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toGetIdentityProviderByIdentifier", []))

    @jsii.member(jsii_name="toGetSigningCertificate")
    def to_get_signing_certificate(self) -> "CognitoIdp":
        '''(experimental) Returns the signing certificate.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetSigningCertificate.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toGetSigningCertificate", []))

    @jsii.member(jsii_name="toGetUICustomization")
    def to_get_ui_customization(self) -> "CognitoIdp":
        '''(experimental) Gets the UI Customization information for a particular app client's app UI, if there is something set.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetUICustomization.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toGetUICustomization", []))

    @jsii.member(jsii_name="toGetUser")
    def to_get_user(self) -> "CognitoIdp":
        '''(experimental) Gets the user attributes and metadata for a user.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetUser.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toGetUser", []))

    @jsii.member(jsii_name="toGetUserAttributeVerificationCode")
    def to_get_user_attribute_verification_code(self) -> "CognitoIdp":
        '''(experimental) Gets the user attribute verification code for the specified attribute name.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetUserAttributeVerificationCode.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toGetUserAttributeVerificationCode", []))

    @jsii.member(jsii_name="toGetUserPoolMfaConfig")
    def to_get_user_pool_mfa_config(self) -> "CognitoIdp":
        '''(experimental) Gets the MFA configuration for the userpool.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetUserPoolMfaConfig.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toGetUserPoolMfaConfig", []))

    @jsii.member(jsii_name="toGlobalSignOut")
    def to_global_sign_out(self) -> "CognitoIdp":
        '''(experimental) Signs out users from all devices.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GlobalSignOut.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toGlobalSignOut", []))

    @jsii.member(jsii_name="toInitiateAuth")
    def to_initiate_auth(self) -> "CognitoIdp":
        '''(experimental) Initiates the authentication flow.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_InitiateAuth.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toInitiateAuth", []))

    @jsii.member(jsii_name="toListDevices")
    def to_list_devices(self) -> "CognitoIdp":
        '''(experimental) Lists the devices.

        Access Level: List

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListDevices.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toListDevices", []))

    @jsii.member(jsii_name="toListGroups")
    def to_list_groups(self) -> "CognitoIdp":
        '''(experimental) Lists the groups associated with a user pool.

        Access Level: List

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListGroups.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toListGroups", []))

    @jsii.member(jsii_name="toListIdentityProviders")
    def to_list_identity_providers(self) -> "CognitoIdp":
        '''(experimental) Lists information about all identity providers for a user pool.

        Access Level: List

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListIdentityProviders.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toListIdentityProviders", []))

    @jsii.member(jsii_name="toListResourceServers")
    def to_list_resource_servers(self) -> "CognitoIdp":
        '''(experimental) Lists the resource servers for a user pool.

        Access Level: List

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListResourceServers.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toListResourceServers", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "CognitoIdp":
        '''(experimental) Lists the tags that are assigned to an Amazon Cognito user pool.

        Access Level: List

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListUserImportJobs")
    def to_list_user_import_jobs(self) -> "CognitoIdp":
        '''(experimental) Lists the user import jobs..

        Access Level: List

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListUserImportJobs.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toListUserImportJobs", []))

    @jsii.member(jsii_name="toListUserPoolClients")
    def to_list_user_pool_clients(self) -> "CognitoIdp":
        '''(experimental) Lists the clients that have been created for the specified user pool.

        Access Level: List

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListUserPoolClients.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toListUserPoolClients", []))

    @jsii.member(jsii_name="toListUserPools")
    def to_list_user_pools(self) -> "CognitoIdp":
        '''(experimental) Lists the user pools associated with an AWS account.

        Access Level: List

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListUserPools.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toListUserPools", []))

    @jsii.member(jsii_name="toListUsers")
    def to_list_users(self) -> "CognitoIdp":
        '''(experimental) Lists the users in the Amazon Cognito user pool.

        Access Level: List

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListUsers.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toListUsers", []))

    @jsii.member(jsii_name="toListUsersInGroup")
    def to_list_users_in_group(self) -> "CognitoIdp":
        '''(experimental) Lists the users in the specified group.

        Access Level: List

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListUsersInGroup.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toListUsersInGroup", []))

    @jsii.member(jsii_name="toResendConfirmationCode")
    def to_resend_confirmation_code(self) -> "CognitoIdp":
        '''(experimental) Resends the confirmation (for confirmation of registration) to a specific user in the user pool.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ResendConfirmationCode.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toResendConfirmationCode", []))

    @jsii.member(jsii_name="toRespondToAuthChallenge")
    def to_respond_to_auth_challenge(self) -> "CognitoIdp":
        '''(experimental) Responds to the authentication challenge.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_RespondToAuthChallenge.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toRespondToAuthChallenge", []))

    @jsii.member(jsii_name="toSetRiskConfiguration")
    def to_set_risk_configuration(self) -> "CognitoIdp":
        '''(experimental) sets the risk configuration setting for the userpool / userpool client.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SetRiskConfiguration.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toSetRiskConfiguration", []))

    @jsii.member(jsii_name="toSetUICustomization")
    def to_set_ui_customization(self) -> "CognitoIdp":
        '''(experimental) Sets the UI customization information for a user pool's built-in app UI.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SetUICustomization.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toSetUICustomization", []))

    @jsii.member(jsii_name="toSetUserMFAPreference")
    def to_set_user_mfa_preference(self) -> "CognitoIdp":
        '''(experimental) Sets MFA preference for the user in the userpool.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SetUserMFAPreference.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toSetUserMFAPreference", []))

    @jsii.member(jsii_name="toSetUserPoolMfaConfig")
    def to_set_user_pool_mfa_config(self) -> "CognitoIdp":
        '''(experimental) Sets the MFA configuration for the userpool.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SetUserPoolMfaConfig.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toSetUserPoolMfaConfig", []))

    @jsii.member(jsii_name="toSetUserSettings")
    def to_set_user_settings(self) -> "CognitoIdp":
        '''(experimental) Sets the user settings like multi-factor authentication (MFA).

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SetUserSettings.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toSetUserSettings", []))

    @jsii.member(jsii_name="toSignUp")
    def to_sign_up(self) -> "CognitoIdp":
        '''(experimental) Registers the user in the specified user pool and creates a user name, password, and user attributes.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SignUp.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toSignUp", []))

    @jsii.member(jsii_name="toStartUserImportJob")
    def to_start_user_import_job(self) -> "CognitoIdp":
        '''(experimental) Starts the user import.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_StartUserImportJob.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toStartUserImportJob", []))

    @jsii.member(jsii_name="toStopUserImportJob")
    def to_stop_user_import_job(self) -> "CognitoIdp":
        '''(experimental) Stops the user import job.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_StopUserImportJob.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toStopUserImportJob", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "CognitoIdp":
        '''(experimental) Assigns a set of tags to an Amazon Cognito user pool.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "CognitoIdp":
        '''(experimental) Removes the specified tags from an Amazon Cognito user pool.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAuthEventFeedback")
    def to_update_auth_event_feedback(self) -> "CognitoIdp":
        '''(experimental) Updates the feedback for the user authentication event.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateAuthEventFeedback.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toUpdateAuthEventFeedback", []))

    @jsii.member(jsii_name="toUpdateDeviceStatus")
    def to_update_device_status(self) -> "CognitoIdp":
        '''(experimental) Updates the device status.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateDeviceStatus.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toUpdateDeviceStatus", []))

    @jsii.member(jsii_name="toUpdateGroup")
    def to_update_group(self) -> "CognitoIdp":
        '''(experimental) Updates the specified group with the specified attributes.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateGroup.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toUpdateGroup", []))

    @jsii.member(jsii_name="toUpdateIdentityProvider")
    def to_update_identity_provider(self) -> "CognitoIdp":
        '''(experimental) Updates identity provider information for a user pool.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateIdentityProvider.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toUpdateIdentityProvider", []))

    @jsii.member(jsii_name="toUpdateResourceServer")
    def to_update_resource_server(self) -> "CognitoIdp":
        '''(experimental) Updates the name and scopes of resource server.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateResourceServer.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toUpdateResourceServer", []))

    @jsii.member(jsii_name="toUpdateUserAttributes")
    def to_update_user_attributes(self) -> "CognitoIdp":
        '''(experimental) Allows a user to update a specific attribute (one at a time).

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateUserAttributes.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toUpdateUserAttributes", []))

    @jsii.member(jsii_name="toUpdateUserPool")
    def to_update_user_pool(self) -> "CognitoIdp":
        '''(experimental) Updates the specified user pool with the specified attributes.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateUserPool.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toUpdateUserPool", []))

    @jsii.member(jsii_name="toUpdateUserPoolClient")
    def to_update_user_pool_client(self) -> "CognitoIdp":
        '''(experimental) Allows the developer to update the specified user pool client and password policy.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateUserPoolClient.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toUpdateUserPoolClient", []))

    @jsii.member(jsii_name="toUpdateUserPoolDomain")
    def to_update_user_pool_domain(self) -> "CognitoIdp":
        '''(experimental) Updates the Secure Sockets Layer (SSL) certificate for the custom domain for your user pool.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateUserPoolDomain.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toUpdateUserPoolDomain", []))

    @jsii.member(jsii_name="toVerifySoftwareToken")
    def to_verify_software_token(self) -> "CognitoIdp":
        '''(experimental) Registers a user's entered TOTP code and mark the user's software token MFA status as verified if successful.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_VerifySoftwareToken.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toVerifySoftwareToken", []))

    @jsii.member(jsii_name="toVerifyUserAttribute")
    def to_verify_user_attribute(self) -> "CognitoIdp":
        '''(experimental) Verifies a user attribute using a one time verification code.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_VerifyUserAttribute.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toVerifyUserAttribute", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class CognitoSync(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.CognitoSync",
):
    '''(experimental) Statement provider for service `cognito-sync <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncognitosync.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `cognito-sync <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncognitosync.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(CognitoSync, self, [sid])

    @jsii.member(jsii_name="onDataset")
    def on_dataset(
        self,
        identity_pool_id: builtins.str,
        identity_id: builtins.str,
        dataset_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "CognitoSync":
        '''(experimental) Adds a resource of type dataset to the statement.

        https://docs.aws.amazon.com/cognito/latest/developerguide/synchronizing-data.html#understanding-datasets

        :param identity_pool_id: - Identifier for the identityPoolId.
        :param identity_id: - Identifier for the identityId.
        :param dataset_name: - Identifier for the datasetName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "onDataset", [identity_pool_id, identity_id, dataset_name, account, region, partition]))

    @jsii.member(jsii_name="onIdentity")
    def on_identity(
        self,
        identity_pool_id: builtins.str,
        identity_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "CognitoSync":
        '''(experimental) Adds a resource of type identity to the statement.

        https://docs.aws.amazon.com/cognito/latest/developerguide/identity-pools.html#authenticated-and-unauthenticated-identities

        :param identity_pool_id: - Identifier for the identityPoolId.
        :param identity_id: - Identifier for the identityId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "onIdentity", [identity_pool_id, identity_id, account, region, partition]))

    @jsii.member(jsii_name="onIdentitypool")
    def on_identitypool(
        self,
        identity_pool_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "CognitoSync":
        '''(experimental) Adds a resource of type identitypool to the statement.

        https://docs.aws.amazon.com/cognito/latest/developerguide/identity-pools.html

        :param identity_pool_id: - Identifier for the identityPoolId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "onIdentitypool", [identity_pool_id, account, region, partition]))

    @jsii.member(jsii_name="toBulkPublish")
    def to_bulk_publish(self) -> "CognitoSync":
        '''(experimental) Initiates a bulk publish of all existing datasets for an Identity Pool to the configured stream.

        Access Level: Write

        https://docs.aws.amazon.com/cognitosync/latest/APIReference/API_BulkPublish.html

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toBulkPublish", []))

    @jsii.member(jsii_name="toDeleteDataset")
    def to_delete_dataset(self) -> "CognitoSync":
        '''(experimental) Deletes the specific dataset.

        Access Level: Write

        https://docs.aws.amazon.com/cognitosync/latest/APIReference/API_DeleteDataset.html

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toDeleteDataset", []))

    @jsii.member(jsii_name="toDescribeDataset")
    def to_describe_dataset(self) -> "CognitoSync":
        '''(experimental) Gets meta data about a dataset by identity and dataset name.

        Access Level: Read

        https://docs.aws.amazon.com/cognitosync/latest/APIReference/API_DescribeDataset.html

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toDescribeDataset", []))

    @jsii.member(jsii_name="toDescribeIdentityPoolUsage")
    def to_describe_identity_pool_usage(self) -> "CognitoSync":
        '''(experimental) Gets usage details (for example, data storage) about a particular identity pool.

        Access Level: Read

        https://docs.aws.amazon.com/cognitosync/latest/APIReference/API_DescribeIdentityPoolUsage.html

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toDescribeIdentityPoolUsage", []))

    @jsii.member(jsii_name="toDescribeIdentityUsage")
    def to_describe_identity_usage(self) -> "CognitoSync":
        '''(experimental) Gets usage information for an identity, including number of datasets and data usage.

        Access Level: Read

        https://docs.aws.amazon.com/cognitosync/latest/APIReference/API_DescribeIdentityUsage.html

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toDescribeIdentityUsage", []))

    @jsii.member(jsii_name="toGetBulkPublishDetails")
    def to_get_bulk_publish_details(self) -> "CognitoSync":
        '''(experimental) Get the status of the last BulkPublish operation for an identity pool.

        Access Level: Read

        https://docs.aws.amazon.com/cognitosync/latest/APIReference/API_GetBulkPublishDetails.html

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toGetBulkPublishDetails", []))

    @jsii.member(jsii_name="toGetCognitoEvents")
    def to_get_cognito_events(self) -> "CognitoSync":
        '''(experimental) Gets the events and the corresponding Lambda functions associated with an identity pool.

        Access Level: Read

        https://docs.aws.amazon.com/cognitosync/latest/APIReference/API_GetCognitoEvents.html

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toGetCognitoEvents", []))

    @jsii.member(jsii_name="toGetIdentityPoolConfiguration")
    def to_get_identity_pool_configuration(self) -> "CognitoSync":
        '''(experimental) Gets the configuration settings of an identity pool.

        Access Level: Read

        https://docs.aws.amazon.com/cognitosync/latest/APIReference/API_GetIdentityPoolConfiguration.html

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toGetIdentityPoolConfiguration", []))

    @jsii.member(jsii_name="toListDatasets")
    def to_list_datasets(self) -> "CognitoSync":
        '''(experimental) Lists datasets for an identity.

        Access Level: List

        https://docs.aws.amazon.com/cognitosync/latest/APIReference/API_ListDatasets.html

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toListDatasets", []))

    @jsii.member(jsii_name="toListIdentityPoolUsage")
    def to_list_identity_pool_usage(self) -> "CognitoSync":
        '''(experimental) Gets a list of identity pools registered with Cognito.

        Access Level: Read

        https://docs.aws.amazon.com/cognitosync/latest/APIReference/API_ListIdentityPoolUsage.html

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toListIdentityPoolUsage", []))

    @jsii.member(jsii_name="toListRecords")
    def to_list_records(self) -> "CognitoSync":
        '''(experimental) Gets paginated records, optionally changed after a particular sync count for a dataset and identity.

        Access Level: Read

        https://docs.aws.amazon.com/cognitosync/latest/APIReference/API_ListRecords.html

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toListRecords", []))

    @jsii.member(jsii_name="toQueryRecords")
    def to_query_records(self) -> "CognitoSync":
        '''(experimental) A permission that grants the ability to query records.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toQueryRecords", []))

    @jsii.member(jsii_name="toRegisterDevice")
    def to_register_device(self) -> "CognitoSync":
        '''(experimental) Registers a device to receive push sync notifications.

        Access Level: Write

        https://docs.aws.amazon.com/cognitosync/latest/APIReference/API_RegisterDevice.html

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toRegisterDevice", []))

    @jsii.member(jsii_name="toSetCognitoEvents")
    def to_set_cognito_events(self) -> "CognitoSync":
        '''(experimental) Sets the AWS Lambda function for a given event type for an identity pool.

        Access Level: Write

        https://docs.aws.amazon.com/cognitosync/latest/APIReference/API_SetCognitoEvents.html

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toSetCognitoEvents", []))

    @jsii.member(jsii_name="toSetDatasetConfiguration")
    def to_set_dataset_configuration(self) -> "CognitoSync":
        '''(experimental) A permission that grants ability to configure datasets.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toSetDatasetConfiguration", []))

    @jsii.member(jsii_name="toSetIdentityPoolConfiguration")
    def to_set_identity_pool_configuration(self) -> "CognitoSync":
        '''(experimental) Sets the necessary configuration for push sync.

        Access Level: Write

        https://docs.aws.amazon.com/cognitosync/latest/APIReference/API_SetIdentityPoolConfiguration.html

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toSetIdentityPoolConfiguration", []))

    @jsii.member(jsii_name="toSubscribeToDataset")
    def to_subscribe_to_dataset(self) -> "CognitoSync":
        '''(experimental) Subscribes to receive notifications when a dataset is modified by another device.

        Access Level: Write

        https://docs.aws.amazon.com/cognitosync/latest/APIReference/API_SubscribeToDataset.html

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toSubscribeToDataset", []))

    @jsii.member(jsii_name="toUnsubscribeFromDataset")
    def to_unsubscribe_from_dataset(self) -> "CognitoSync":
        '''(experimental) Unsubscribes from receiving notifications when a dataset is modified by another device.

        Access Level: Write

        https://docs.aws.amazon.com/cognitosync/latest/APIReference/API_UnsubscribeFromDataset.html

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toUnsubscribeFromDataset", []))

    @jsii.member(jsii_name="toUpdateRecords")
    def to_update_records(self) -> "CognitoSync":
        '''(experimental) Posts updates to records and adds and deletes records for a dataset and user.

        Access Level: Write

        https://docs.aws.amazon.com/cognitosync/latest/APIReference/API_UpdateRecords.html

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toUpdateRecords", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Comprehend(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Comprehend",
):
    '''(experimental) Statement provider for service `comprehend <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncomprehend.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `comprehend <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncomprehend.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Comprehend, self, [sid])

    @jsii.member(jsii_name="ifModelKmsKey")
    def if_model_kms_key(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Comprehend":
        '''(experimental) Filters access by the model KMS key associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazoncomprehend.html#amazoncomprehend-policy-keys

        Applies to actions:

        - .toCreateDocumentClassifier()
        - .toCreateEntityRecognizer()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "ifModelKmsKey", [value, operator]))

    @jsii.member(jsii_name="ifOutputKmsKey")
    def if_output_kms_key(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Comprehend":
        '''(experimental) Filters access by the output KMS key associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazoncomprehend.html#amazoncomprehend-policy-keys

        Applies to actions:

        - .toCreateDocumentClassifier()
        - .toStartDocumentClassificationJob()
        - .toStartDominantLanguageDetectionJob()
        - .toStartEntitiesDetectionJob()
        - .toStartEventsDetectionJob()
        - .toStartKeyPhrasesDetectionJob()
        - .toStartPiiEntitiesDetectionJob()
        - .toStartSentimentDetectionJob()
        - .toStartTopicsDetectionJob()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "ifOutputKmsKey", [value, operator]))

    @jsii.member(jsii_name="ifVolumeKmsKey")
    def if_volume_kms_key(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Comprehend":
        '''(experimental) Filters access by the volume KMS key associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazoncomprehend.html#amazoncomprehend-policy-keys

        Applies to actions:

        - .toCreateDocumentClassifier()
        - .toCreateEntityRecognizer()
        - .toStartDocumentClassificationJob()
        - .toStartDominantLanguageDetectionJob()
        - .toStartEntitiesDetectionJob()
        - .toStartKeyPhrasesDetectionJob()
        - .toStartSentimentDetectionJob()
        - .toStartTopicsDetectionJob()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "ifVolumeKmsKey", [value, operator]))

    @jsii.member(jsii_name="ifVpcSecurityGroupIds")
    def if_vpc_security_group_ids(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Comprehend":
        '''(experimental) Filters access by the list of all VPC security group ids associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazoncomprehend.html#amazoncomprehend-policy-keys

        Applies to actions:

        - .toCreateDocumentClassifier()
        - .toCreateEntityRecognizer()
        - .toStartDocumentClassificationJob()
        - .toStartDominantLanguageDetectionJob()
        - .toStartEntitiesDetectionJob()
        - .toStartKeyPhrasesDetectionJob()
        - .toStartSentimentDetectionJob()
        - .toStartTopicsDetectionJob()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "ifVpcSecurityGroupIds", [value, operator]))

    @jsii.member(jsii_name="ifVpcSubnets")
    def if_vpc_subnets(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Comprehend":
        '''(experimental) Filters access by the list of all VPC subnets associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazoncomprehend.html#amazoncomprehend-policy-keys

        Applies to actions:

        - .toCreateDocumentClassifier()
        - .toCreateEntityRecognizer()
        - .toStartDocumentClassificationJob()
        - .toStartDominantLanguageDetectionJob()
        - .toStartEntitiesDetectionJob()
        - .toStartKeyPhrasesDetectionJob()
        - .toStartSentimentDetectionJob()
        - .toStartTopicsDetectionJob()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "ifVpcSubnets", [value, operator]))

    @jsii.member(jsii_name="onDocumentClassifier")
    def on_document_classifier(
        self,
        document_classifier_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Comprehend":
        '''(experimental) Adds a resource of type document-classifier to the statement.

        :param document_classifier_name: - Identifier for the documentClassifierName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "onDocumentClassifier", [document_classifier_name, account, region, partition]))

    @jsii.member(jsii_name="onDocumentClassifierEndpoint")
    def on_document_classifier_endpoint(
        self,
        document_classifier_endpoint_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Comprehend":
        '''(experimental) Adds a resource of type document-classifier-endpoint to the statement.

        :param document_classifier_endpoint_name: - Identifier for the documentClassifierEndpointName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "onDocumentClassifierEndpoint", [document_classifier_endpoint_name, account, region, partition]))

    @jsii.member(jsii_name="onEntityRecognizer")
    def on_entity_recognizer(
        self,
        entity_recognizer_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Comprehend":
        '''(experimental) Adds a resource of type entity-recognizer to the statement.

        :param entity_recognizer_name: - Identifier for the entityRecognizerName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "onEntityRecognizer", [entity_recognizer_name, account, region, partition]))

    @jsii.member(jsii_name="onEntityRecognizerEndpoint")
    def on_entity_recognizer_endpoint(
        self,
        entity_recognizer_endpoint_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Comprehend":
        '''(experimental) Adds a resource of type entity-recognizer-endpoint to the statement.

        :param entity_recognizer_endpoint_name: - Identifier for the entityRecognizerEndpointName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "onEntityRecognizerEndpoint", [entity_recognizer_endpoint_name, account, region, partition]))

    @jsii.member(jsii_name="toBatchDetectDominantLanguage")
    def to_batch_detect_dominant_language(self) -> "Comprehend":
        '''(experimental) Grants permission to detect the language or languages present in the list of text documents.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/dg/API_BatchDetectDominantLanguage.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toBatchDetectDominantLanguage", []))

    @jsii.member(jsii_name="toBatchDetectEntities")
    def to_batch_detect_entities(self) -> "Comprehend":
        '''(experimental) Grants permission to detect the named entities ("People", "Places", "Locations", etc) within the given list of text documents.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/dg/API_BatchDetectEntities.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toBatchDetectEntities", []))

    @jsii.member(jsii_name="toBatchDetectKeyPhrases")
    def to_batch_detect_key_phrases(self) -> "Comprehend":
        '''(experimental) Grants permission to detect the phrases in the list of text documents that are most indicative of the content.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/dg/API_BatchDetectKeyPhrases.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toBatchDetectKeyPhrases", []))

    @jsii.member(jsii_name="toBatchDetectSentiment")
    def to_batch_detect_sentiment(self) -> "Comprehend":
        '''(experimental) Grants permission to detect the sentiment of a text in the list of documents (Positive, Negative, Neutral, or Mixed).

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/dg/API_BatchDetectSentiment.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toBatchDetectSentiment", []))

    @jsii.member(jsii_name="toBatchDetectSyntax")
    def to_batch_detect_syntax(self) -> "Comprehend":
        '''(experimental) Grants permission to detect syntactic information (like Part of Speech, Tokens) in a list of text documents.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/dg/API_BatchDetectSyntax.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toBatchDetectSyntax", []))

    @jsii.member(jsii_name="toClassifyDocument")
    def to_classify_document(self) -> "Comprehend":
        '''(experimental) Grants permission to create a new document classification request to analyze a single document in real-time, using a previously created and trained custom model and an endpoint.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/dg/API_ClassifyDocument.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toClassifyDocument", []))

    @jsii.member(jsii_name="toContainsPiiEntities")
    def to_contains_pii_entities(self) -> "Comprehend":
        '''(experimental) Grants permission to classify the personally identifiable information within given documents at realtime.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/dg/API_ContainsPiiEntities.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toContainsPiiEntities", []))

    @jsii.member(jsii_name="toCreateDocumentClassifier")
    def to_create_document_classifier(self) -> "Comprehend":
        '''(experimental) Grants permission to create a new document classifier that you can use to categorize documents.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifVolumeKmsKey()
        - .ifModelKmsKey()
        - .ifOutputKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        https://docs.aws.amazon.com/comprehend/latest/dg/API_CreateDocumentClassifier.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toCreateDocumentClassifier", []))

    @jsii.member(jsii_name="toCreateEndpoint")
    def to_create_endpoint(self) -> "Comprehend":
        '''(experimental) Grants permission to create a model-specific endpoint for synchronous inference for a previously trained custom model.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/comprehend/latest/dg/API_CreateEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toCreateEndpoint", []))

    @jsii.member(jsii_name="toCreateEntityRecognizer")
    def to_create_entity_recognizer(self) -> "Comprehend":
        '''(experimental) Grants permission to create an entity recognizer using submitted files.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifVolumeKmsKey()
        - .ifModelKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        https://docs.aws.amazon.com/comprehend/latest/dg/API_CreateEntityRecognizer.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toCreateEntityRecognizer", []))

    @jsii.member(jsii_name="toDeleteDocumentClassifier")
    def to_delete_document_classifier(self) -> "Comprehend":
        '''(experimental) Grants permission to delete a previously created document classifier.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend/latest/dg/API_DeleteDocumentClassifier.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDeleteDocumentClassifier", []))

    @jsii.member(jsii_name="toDeleteEndpoint")
    def to_delete_endpoint(self) -> "Comprehend":
        '''(experimental) Grants permission to delete a model-specific endpoint for a previously-trained custom model.

        All endpoints must be deleted in order for the model to be deleted

        Access Level: Write

        https://docs.aws.amazon.com/comprehend/latest/dg/API_DeleteEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDeleteEndpoint", []))

    @jsii.member(jsii_name="toDeleteEntityRecognizer")
    def to_delete_entity_recognizer(self) -> "Comprehend":
        '''(experimental) Grants permission to delete a submitted entity recognizer.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend/latest/dg/API_DeleteEntityRecognizer.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDeleteEntityRecognizer", []))

    @jsii.member(jsii_name="toDescribeDocumentClassificationJob")
    def to_describe_document_classification_job(self) -> "Comprehend":
        '''(experimental) Grants permission to get the properties associated with a document classification job.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/dg/API_DescribeDocumentClassificationJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDescribeDocumentClassificationJob", []))

    @jsii.member(jsii_name="toDescribeDocumentClassifier")
    def to_describe_document_classifier(self) -> "Comprehend":
        '''(experimental) Grants permission to get the properties associated with a document classifier.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/dg/API_DescribeDocumentClassifier.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDescribeDocumentClassifier", []))

    @jsii.member(jsii_name="toDescribeDominantLanguageDetectionJob")
    def to_describe_dominant_language_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to get the properties associated with a dominant language detection job.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/dg/API_DescribeDominantLanguageDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDescribeDominantLanguageDetectionJob", []))

    @jsii.member(jsii_name="toDescribeEndpoint")
    def to_describe_endpoint(self) -> "Comprehend":
        '''(experimental) Grants permission to get the properties associated with a specific endpoint.

        Use this operation to get the status of an endpoint

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/dg/API_DescribeEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDescribeEndpoint", []))

    @jsii.member(jsii_name="toDescribeEntitiesDetectionJob")
    def to_describe_entities_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to get the properties associated with an entities detection job.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/dg/API_DescribeEntitiesDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDescribeEntitiesDetectionJob", []))

    @jsii.member(jsii_name="toDescribeEntityRecognizer")
    def to_describe_entity_recognizer(self) -> "Comprehend":
        '''(experimental) Grants permission to provide details about an entity recognizer including status, S3 buckets containing training data, recognizer metadata, metrics, and so on.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/dg/API_DescribeEntityRecognizer.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDescribeEntityRecognizer", []))

    @jsii.member(jsii_name="toDescribeEventsDetectionJob")
    def to_describe_events_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to get the properties associated with an Events detection job.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/dg/API_DescribeEventsDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDescribeEventsDetectionJob", []))

    @jsii.member(jsii_name="toDescribeKeyPhrasesDetectionJob")
    def to_describe_key_phrases_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to get the properties associated with a key phrases detection job.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/dg/API_DescribeKeyPhrasesDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDescribeKeyPhrasesDetectionJob", []))

    @jsii.member(jsii_name="toDescribePiiEntitiesDetectionJob")
    def to_describe_pii_entities_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to get the properties associated with a PII entities detection job.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/dg/API_DescribePiiEntitiesDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDescribePiiEntitiesDetectionJob", []))

    @jsii.member(jsii_name="toDescribeSentimentDetectionJob")
    def to_describe_sentiment_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to get the properties associated with a sentiment detection job.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/dg/API_DescribeSentimentDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDescribeSentimentDetectionJob", []))

    @jsii.member(jsii_name="toDescribeTopicsDetectionJob")
    def to_describe_topics_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to get the properties associated with a topic detection job.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/dg/API_DescribeTopicsDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDescribeTopicsDetectionJob", []))

    @jsii.member(jsii_name="toDetectDominantLanguage")
    def to_detect_dominant_language(self) -> "Comprehend":
        '''(experimental) Grants permission to detect the language or languages present in the text.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/dg/API_DetectDominantLanguage.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDetectDominantLanguage", []))

    @jsii.member(jsii_name="toDetectEntities")
    def to_detect_entities(self) -> "Comprehend":
        '''(experimental) Grants permission to detect the named entities ("People", "Places", "Locations", etc) within the given text document.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/dg/API_DetectEntities.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDetectEntities", []))

    @jsii.member(jsii_name="toDetectKeyPhrases")
    def to_detect_key_phrases(self) -> "Comprehend":
        '''(experimental) Grants permission to detect the phrases in the text that are most indicative of the content.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/dg/API_DetectKeyPhrases.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDetectKeyPhrases", []))

    @jsii.member(jsii_name="toDetectPiiEntities")
    def to_detect_pii_entities(self) -> "Comprehend":
        '''(experimental) Grants permission to detect the personally identifiable information entities ("Name", "SSN", "PIN", etc) within the given text document.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/dg/API_DetectPiiEntities.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDetectPiiEntities", []))

    @jsii.member(jsii_name="toDetectSentiment")
    def to_detect_sentiment(self) -> "Comprehend":
        '''(experimental) Grants permission to detect the sentiment of a text in a document (Positive, Negative, Neutral, or Mixed).

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/dg/API_DetectSentiment.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDetectSentiment", []))

    @jsii.member(jsii_name="toDetectSyntax")
    def to_detect_syntax(self) -> "Comprehend":
        '''(experimental) Grants permission to detect syntactic information (like Part of Speech, Tokens) in a text document.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/dg/API_DetectSyntax.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDetectSyntax", []))

    @jsii.member(jsii_name="toListDocumentClassificationJobs")
    def to_list_document_classification_jobs(self) -> "Comprehend":
        '''(experimental) Grants permission to get a list of the document classification jobs that you have submitted.

        Access Level: List

        https://docs.aws.amazon.com/comprehend/latest/dg/API_ListDocumentClassificationJobs.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toListDocumentClassificationJobs", []))

    @jsii.member(jsii_name="toListDocumentClassifiers")
    def to_list_document_classifiers(self) -> "Comprehend":
        '''(experimental) Grants permission to get a list of the document classifiers that you have created.

        Access Level: List

        https://docs.aws.amazon.com/comprehend/latest/dg/API_ListDocumentClassifiers.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toListDocumentClassifiers", []))

    @jsii.member(jsii_name="toListDominantLanguageDetectionJobs")
    def to_list_dominant_language_detection_jobs(self) -> "Comprehend":
        '''(experimental) Grants permission to get a list of the dominant language detection jobs that you have submitted.

        Access Level: List

        https://docs.aws.amazon.com/comprehend/latest/dg/API_ListDominantLanguageDetectionJobs.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toListDominantLanguageDetectionJobs", []))

    @jsii.member(jsii_name="toListEndpoints")
    def to_list_endpoints(self) -> "Comprehend":
        '''(experimental) Grants permission to get a list of all existing endpoints that you've created.

        Access Level: List

        https://docs.aws.amazon.com/comprehend/latest/dg/API_ListEndpoints.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toListEndpoints", []))

    @jsii.member(jsii_name="toListEntitiesDetectionJobs")
    def to_list_entities_detection_jobs(self) -> "Comprehend":
        '''(experimental) Grants permission to get a list of the entity detection jobs that you have submitted.

        Access Level: List

        https://docs.aws.amazon.com/comprehend/latest/dg/API_ListEntitiesDetectionJobs.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toListEntitiesDetectionJobs", []))

    @jsii.member(jsii_name="toListEntityRecognizers")
    def to_list_entity_recognizers(self) -> "Comprehend":
        '''(experimental) Grants permission to get a list of the properties of all entity recognizers that you created, including recognizers currently in training.

        Access Level: List

        https://docs.aws.amazon.com/comprehend/latest/dg/API_ListEntityRecognizers.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toListEntityRecognizers", []))

    @jsii.member(jsii_name="toListEventsDetectionJobs")
    def to_list_events_detection_jobs(self) -> "Comprehend":
        '''(experimental) Grants permission to get a list of Events detection jobs that you have submitted.

        Access Level: List

        https://docs.aws.amazon.com/comprehend/latest/dg/API_ListEventsDetectionJobs.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toListEventsDetectionJobs", []))

    @jsii.member(jsii_name="toListKeyPhrasesDetectionJobs")
    def to_list_key_phrases_detection_jobs(self) -> "Comprehend":
        '''(experimental) Grants permission to get a list of key phrase detection jobs that you have submitted.

        Access Level: List

        https://docs.aws.amazon.com/comprehend/latest/dg/API_ListKeyPhrasesDetectionJobs.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toListKeyPhrasesDetectionJobs", []))

    @jsii.member(jsii_name="toListPiiEntitiesDetectionJobs")
    def to_list_pii_entities_detection_jobs(self) -> "Comprehend":
        '''(experimental) Grants permission to get a list of PII entities detection jobs that you have submitted.

        Access Level: List

        https://docs.aws.amazon.com/comprehend/latest/dg/API_ListPiiEntitiesDetectionJobs.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toListPiiEntitiesDetectionJobs", []))

    @jsii.member(jsii_name="toListSentimentDetectionJobs")
    def to_list_sentiment_detection_jobs(self) -> "Comprehend":
        '''(experimental) Grants permission to get a list of sentiment detection jobs that you have submitted.

        Access Level: List

        https://docs.aws.amazon.com/comprehend/latest/dg/API_ListSentimentDetectionJobs.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toListSentimentDetectionJobs", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Comprehend":
        '''(experimental) Grants permission to list tags for a resource.

        Access Level: List

        https://docs.aws.amazon.com/comprehend/latest/dg/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTopicsDetectionJobs")
    def to_list_topics_detection_jobs(self) -> "Comprehend":
        '''(experimental) Grants permission to get a list of the topic detection jobs that you have submitted.

        Access Level: List

        https://docs.aws.amazon.com/comprehend/latest/dg/API_ListTopicsDetectionJobs.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toListTopicsDetectionJobs", []))

    @jsii.member(jsii_name="toStartDocumentClassificationJob")
    def to_start_document_classification_job(self) -> "Comprehend":
        '''(experimental) Grants permission to start an asynchronous document classification job.

        Access Level: Write

        Possible conditions:

        - .ifVolumeKmsKey()
        - .ifOutputKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        https://docs.aws.amazon.com/comprehend/latest/dg/API_StartDocumentClassificationJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toStartDocumentClassificationJob", []))

    @jsii.member(jsii_name="toStartDominantLanguageDetectionJob")
    def to_start_dominant_language_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to start an asynchronous dominant language detection job for a collection of documents.

        Access Level: Write

        Possible conditions:

        - .ifVolumeKmsKey()
        - .ifOutputKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        https://docs.aws.amazon.com/comprehend/latest/dg/API_StartDominantLanguageDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toStartDominantLanguageDetectionJob", []))

    @jsii.member(jsii_name="toStartEntitiesDetectionJob")
    def to_start_entities_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to start an asynchronous entity detection job for a collection of documents.

        Access Level: Write

        Possible conditions:

        - .ifVolumeKmsKey()
        - .ifOutputKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        https://docs.aws.amazon.com/comprehend/latest/dg/API_StartEntitiesDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toStartEntitiesDetectionJob", []))

    @jsii.member(jsii_name="toStartEventsDetectionJob")
    def to_start_events_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to start an asynchronous Events detection job for a collection of documents.

        Access Level: Write

        Possible conditions:

        - .ifOutputKmsKey()

        https://docs.aws.amazon.com/comprehend/latest/dg/API_StartEventsDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toStartEventsDetectionJob", []))

    @jsii.member(jsii_name="toStartKeyPhrasesDetectionJob")
    def to_start_key_phrases_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to start an asynchronous key phrase detection job for a collection of documents.

        Access Level: Write

        Possible conditions:

        - .ifVolumeKmsKey()
        - .ifOutputKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        https://docs.aws.amazon.com/comprehend/latest/dg/API_StartKeyPhrasesDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toStartKeyPhrasesDetectionJob", []))

    @jsii.member(jsii_name="toStartPiiEntitiesDetectionJob")
    def to_start_pii_entities_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to start an asynchronous PII entities detection job for a collection of documents.

        Access Level: Write

        Possible conditions:

        - .ifOutputKmsKey()

        https://docs.aws.amazon.com/comprehend/latest/dg/API_StartPiiEntitiesDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toStartPiiEntitiesDetectionJob", []))

    @jsii.member(jsii_name="toStartSentimentDetectionJob")
    def to_start_sentiment_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to start an asynchronous sentiment detection job for a collection of documents.

        Access Level: Write

        Possible conditions:

        - .ifVolumeKmsKey()
        - .ifOutputKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        https://docs.aws.amazon.com/comprehend/latest/dg/API_StartSentimentDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toStartSentimentDetectionJob", []))

    @jsii.member(jsii_name="toStartTopicsDetectionJob")
    def to_start_topics_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to start an asynchronous job to detect the most common topics in the collection of documents and the phrases associated with each topic.

        Access Level: Write

        Possible conditions:

        - .ifVolumeKmsKey()
        - .ifOutputKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        https://docs.aws.amazon.com/comprehend/latest/dg/API_StartTopicsDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toStartTopicsDetectionJob", []))

    @jsii.member(jsii_name="toStopDominantLanguageDetectionJob")
    def to_stop_dominant_language_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to stop a dominant language detection job.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend/latest/dg/API_StopDominantLanguageDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toStopDominantLanguageDetectionJob", []))

    @jsii.member(jsii_name="toStopEntitiesDetectionJob")
    def to_stop_entities_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to stop an entity detection job.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend/latest/dg/API_StopEntitiesDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toStopEntitiesDetectionJob", []))

    @jsii.member(jsii_name="toStopEventsDetectionJob")
    def to_stop_events_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to stop an Events detection job.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend/latest/dg/API_StopEventsDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toStopEventsDetectionJob", []))

    @jsii.member(jsii_name="toStopKeyPhrasesDetectionJob")
    def to_stop_key_phrases_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to stop a key phrase detection job.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend/latest/dg/API_StopKeyPhrasesDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toStopKeyPhrasesDetectionJob", []))

    @jsii.member(jsii_name="toStopPiiEntitiesDetectionJob")
    def to_stop_pii_entities_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to stop a PII entities detection job.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend/latest/dg/API_StopPiiEntitiesDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toStopPiiEntitiesDetectionJob", []))

    @jsii.member(jsii_name="toStopSentimentDetectionJob")
    def to_stop_sentiment_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to stop a sentiment detection job.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend/latest/dg/API_StopSentimentDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toStopSentimentDetectionJob", []))

    @jsii.member(jsii_name="toStopTrainingDocumentClassifier")
    def to_stop_training_document_classifier(self) -> "Comprehend":
        '''(experimental) Grants permission to stop a previously created document classifier training job.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend/latest/dg/API_StopTrainingDocumentClassifier.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toStopTrainingDocumentClassifier", []))

    @jsii.member(jsii_name="toStopTrainingEntityRecognizer")
    def to_stop_training_entity_recognizer(self) -> "Comprehend":
        '''(experimental) Grants permission to stop a previously created entity recognizer training job.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend/latest/dg/API_StopTrainingEntityRecognizer.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toStopTrainingEntityRecognizer", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Comprehend":
        '''(experimental) Grants permission to tag a resource with given key value pairs.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/comprehend/latest/dg/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Comprehend":
        '''(experimental) Grants permission to untag a resource with given key.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/comprehend/latest/dg/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateEndpoint")
    def to_update_endpoint(self) -> "Comprehend":
        '''(experimental) Grants permission to update information about the specified endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend/latest/dg/API_UpdateEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toUpdateEndpoint", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Comprehendmedical(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Comprehendmedical",
):
    '''(experimental) Statement provider for service `comprehendmedical <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncomprehendmedical.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `comprehendmedical <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncomprehendmedical.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Comprehendmedical, self, [sid])

    @jsii.member(jsii_name="toDescribeEntitiesDetectionV2Job")
    def to_describe_entities_detection_v2_job(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to describe the properties of a medical entity detection job that you have submitted.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/dg/API_medical_DescribeEntitiesDetectionV2Job.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toDescribeEntitiesDetectionV2Job", []))

    @jsii.member(jsii_name="toDescribeICD10CMInferenceJob")
    def to_describe_icd10_cm_inference_job(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to describe the properties of an ICD-10-CM linking job that you have submitted.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/dg/API_medical_DescribeICD10CMInferenceJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toDescribeICD10CMInferenceJob", []))

    @jsii.member(jsii_name="toDescribePHIDetectionJob")
    def to_describe_phi_detection_job(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to describe the properties of a PHI entity detection job that you have submitted.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/dg/API_medical_DescribePHIDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toDescribePHIDetectionJob", []))

    @jsii.member(jsii_name="toDescribeRxNormInferenceJob")
    def to_describe_rx_norm_inference_job(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to describe the properties of an RxNorm linking job that you have submitted.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/dg/API_medical_DescribeRxNormInferenceJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toDescribeRxNormInferenceJob", []))

    @jsii.member(jsii_name="toDetectEntitiesV2")
    def to_detect_entities_v2(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to detect the named medical entities, and their relationships and traits within the given text document.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/dg/API_medical_DetectEntitiesV2.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toDetectEntitiesV2", []))

    @jsii.member(jsii_name="toDetectPHI")
    def to_detect_phi(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to detect the protected health information (PHI) entities within the given text document.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/dg/API_medical_DetectPHI.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toDetectPHI", []))

    @jsii.member(jsii_name="toInferICD10CM")
    def to_infer_icd10_cm(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to detect the medical condition entities within the given text document and link them to ICD-10-CM codes.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/dg/API_medical_InferICD10CM.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toInferICD10CM", []))

    @jsii.member(jsii_name="toInferRxNorm")
    def to_infer_rx_norm(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to detect the medication entities within the given text document and link them to RxCUI concept identifiers from the National Library of Medicine RxNorm database.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/dg/API_medical_InferRxNorm.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toInferRxNorm", []))

    @jsii.member(jsii_name="toListEntitiesDetectionV2Jobs")
    def to_list_entities_detection_v2_jobs(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to list the medical entity detection jobs that you have submitted.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/dg/API_medical_ListEntitiesDetectionV2Jobs.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toListEntitiesDetectionV2Jobs", []))

    @jsii.member(jsii_name="toListICD10CMInferenceJobs")
    def to_list_icd10_cm_inference_jobs(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to list the ICD-10-CM linking jobs that you have submitted.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/dg/API_medical_ListICD10CMInferenceJobs.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toListICD10CMInferenceJobs", []))

    @jsii.member(jsii_name="toListPHIDetectionJobs")
    def to_list_phi_detection_jobs(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to list the PHI entity detection jobs that you have submitted.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/dg/API_medical_ListPHIDetectionJobs.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toListPHIDetectionJobs", []))

    @jsii.member(jsii_name="toListRxNormInferenceJobs")
    def to_list_rx_norm_inference_jobs(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to list the RxNorm linking jobs that you have submitted.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/dg/API_medical_ListRxNormInferenceJobs.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toListRxNormInferenceJobs", []))

    @jsii.member(jsii_name="toStartEntitiesDetectionV2Job")
    def to_start_entities_detection_v2_job(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to start an asynchronous medical entity detection job for a collection of documents.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend/latest/dg/API_medical_StartEntitiesDetectionV2Job.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toStartEntitiesDetectionV2Job", []))

    @jsii.member(jsii_name="toStartICD10CMInferenceJob")
    def to_start_icd10_cm_inference_job(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to start an asynchronous ICD-10-CM linking job for a collection of documents.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend/latest/dg/API_medical_StartICD10CMInferenceJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toStartICD10CMInferenceJob", []))

    @jsii.member(jsii_name="toStartPHIDetectionJob")
    def to_start_phi_detection_job(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to start an asynchronous PHI entity detection job for a collection of documents.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend/latest/dg/API_medical_StartPHIDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toStartPHIDetectionJob", []))

    @jsii.member(jsii_name="toStartRxNormInferenceJob")
    def to_start_rx_norm_inference_job(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to start an asynchronous RxNorm linking job for a collection of documents.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend/latest/dg/API_medical_StartRxNormInferenceJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toStartRxNormInferenceJob", []))

    @jsii.member(jsii_name="toStopEntitiesDetectionV2Job")
    def to_stop_entities_detection_v2_job(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to stop a medical entity detection job.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend/latest/dg/API_medical_StopEntitiesDetectionV2Job.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toStopEntitiesDetectionV2Job", []))

    @jsii.member(jsii_name="toStopICD10CMInferenceJob")
    def to_stop_icd10_cm_inference_job(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to stop an ICD-10-CM linking job.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend/latest/dg/API_medical_StopICD10CMInferenceJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toStopICD10CMInferenceJob", []))

    @jsii.member(jsii_name="toStopPHIDetectionJob")
    def to_stop_phi_detection_job(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to stop a PHI entity detection job.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend/latest/dg/API_medical_StopPHIDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toStopPHIDetectionJob", []))

    @jsii.member(jsii_name="toStopRxNormInferenceJob")
    def to_stop_rx_norm_inference_job(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to stop an RxNorm linking job.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend/latest/dg/API_medical_StopRxNormInferenceJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toStopRxNormInferenceJob", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class ComputeOptimizer(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.ComputeOptimizer",
):
    '''(experimental) Statement provider for service `compute-optimizer <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscomputeoptimizer.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `compute-optimizer <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscomputeoptimizer.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(ComputeOptimizer, self, [sid])

    @jsii.member(jsii_name="toDescribeRecommendationExportJobs")
    def to_describe_recommendation_export_jobs(self) -> "ComputeOptimizer":
        '''(experimental) Grants permission to view the status of recommendation export jobs.

        Access Level: List

        https://docs.aws.amazon.com/compute-optimizer/latest/APIReference/API_DescribeRecommendationExportJobs.html

        :stability: experimental
        '''
        return typing.cast("ComputeOptimizer", jsii.invoke(self, "toDescribeRecommendationExportJobs", []))

    @jsii.member(jsii_name="toExportAutoScalingGroupRecommendations")
    def to_export_auto_scaling_group_recommendations(self) -> "ComputeOptimizer":
        '''(experimental) Grants permission to export autoscaling group recommendations to S3 for the provided accounts.

        Access Level: Write

        Dependent actions:

        - autoscaling:DescribeAutoScalingGroups
        - compute-optimizer:GetAutoScalingGroupRecommendations

        https://docs.aws.amazon.com/compute-optimizer/latest/APIReference/API_ExportAutoScalingGroupRecommendations.html

        :stability: experimental
        '''
        return typing.cast("ComputeOptimizer", jsii.invoke(self, "toExportAutoScalingGroupRecommendations", []))

    @jsii.member(jsii_name="toExportEC2InstanceRecommendations")
    def to_export_ec2_instance_recommendations(self) -> "ComputeOptimizer":
        '''(experimental) Grants permission to export EC2 instance recommendations to S3 for the provided accounts.

        Access Level: Write

        Dependent actions:

        - compute-optimizer:GetEC2InstanceRecommendations
        - ec2:DescribeInstances

        https://docs.aws.amazon.com/compute-optimizer/latest/APIReference/API_ExportEC2InstanceRecommendations.html

        :stability: experimental
        '''
        return typing.cast("ComputeOptimizer", jsii.invoke(self, "toExportEC2InstanceRecommendations", []))

    @jsii.member(jsii_name="toGetAutoScalingGroupRecommendations")
    def to_get_auto_scaling_group_recommendations(self) -> "ComputeOptimizer":
        '''(experimental) Grants permission to get recommendations for the provided autoscaling groups.

        Access Level: List

        Dependent actions:

        - autoscaling:DescribeAutoScalingGroups

        https://docs.aws.amazon.com/compute-optimizer/latest/APIReference/API_GetAutoScalingGroupRecommendations.html

        :stability: experimental
        '''
        return typing.cast("ComputeOptimizer", jsii.invoke(self, "toGetAutoScalingGroupRecommendations", []))

    @jsii.member(jsii_name="toGetEBSVolumeRecommendations")
    def to_get_ebs_volume_recommendations(self) -> "ComputeOptimizer":
        '''(experimental) Grants permission to get recommendations for the provided ebs volumes.

        Access Level: List

        Dependent actions:

        - ec2:DescribeVolumes

        https://docs.aws.amazon.com/compute-optimizer/latest/APIReference/API_GetEBSVolumeRecommendations.html

        :stability: experimental
        '''
        return typing.cast("ComputeOptimizer", jsii.invoke(self, "toGetEBSVolumeRecommendations", []))

    @jsii.member(jsii_name="toGetEC2InstanceRecommendations")
    def to_get_ec2_instance_recommendations(self) -> "ComputeOptimizer":
        '''(experimental) Grants permission to get recommendations for the provided EC2 instances.

        Access Level: List

        Dependent actions:

        - ec2:DescribeInstances

        https://docs.aws.amazon.com/compute-optimizer/latest/APIReference/API_GetEC2InstanceRecommendations.html

        :stability: experimental
        '''
        return typing.cast("ComputeOptimizer", jsii.invoke(self, "toGetEC2InstanceRecommendations", []))

    @jsii.member(jsii_name="toGetEC2RecommendationProjectedMetrics")
    def to_get_ec2_recommendation_projected_metrics(self) -> "ComputeOptimizer":
        '''(experimental) Grants permission to get the recommendation projected metrics of the specified instance.

        Access Level: List

        Dependent actions:

        - ec2:DescribeInstances

        https://docs.aws.amazon.com/compute-optimizer/latest/APIReference/API_GetEC2RecommendationProjectedMetrics.html

        :stability: experimental
        '''
        return typing.cast("ComputeOptimizer", jsii.invoke(self, "toGetEC2RecommendationProjectedMetrics", []))

    @jsii.member(jsii_name="toGetEnrollmentStatus")
    def to_get_enrollment_status(self) -> "ComputeOptimizer":
        '''(experimental) Grants permission to get the enrollment status for the specified account.

        Access Level: List

        https://docs.aws.amazon.com/compute-optimizer/latest/APIReference/API_GetEnrollmentStatus.html

        :stability: experimental
        '''
        return typing.cast("ComputeOptimizer", jsii.invoke(self, "toGetEnrollmentStatus", []))

    @jsii.member(jsii_name="toGetLambdaFunctionRecommendations")
    def to_get_lambda_function_recommendations(self) -> "ComputeOptimizer":
        '''(experimental) Grants permission to get recommendations for the provided lambda functions.

        Access Level: List

        Dependent actions:

        - lambda:ListFunctions
        - lambda:ListProvisionedConcurrencyConfigs

        https://docs.aws.amazon.com/compute-optimizer/latest/APIReference/API_GetLambdaFunctionRecommendations.html

        :stability: experimental
        '''
        return typing.cast("ComputeOptimizer", jsii.invoke(self, "toGetLambdaFunctionRecommendations", []))

    @jsii.member(jsii_name="toGetRecommendationSummaries")
    def to_get_recommendation_summaries(self) -> "ComputeOptimizer":
        '''(experimental) Grants permission to get the recommendation summaries for the specified account(s).

        Access Level: List

        https://docs.aws.amazon.com/compute-optimizer/latest/APIReference/API_GetRecommendationSummaries.html

        :stability: experimental
        '''
        return typing.cast("ComputeOptimizer", jsii.invoke(self, "toGetRecommendationSummaries", []))

    @jsii.member(jsii_name="toUpdateEnrollmentStatus")
    def to_update_enrollment_status(self) -> "ComputeOptimizer":
        '''(experimental) Grants permission to update the enrollment status.

        Access Level: Write

        https://docs.aws.amazon.com/compute-optimizer/latest/APIReference/API_UpdateEnrollmentStatus.html

        :stability: experimental
        '''
        return typing.cast("ComputeOptimizer", jsii.invoke(self, "toUpdateEnrollmentStatus", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Config(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Config"):
    '''(experimental) Statement provider for service `config <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsconfig.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `config <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsconfig.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Config, self, [sid])

    @jsii.member(jsii_name="onAggregationAuthorization")
    def on_aggregation_authorization(
        self,
        aggregator_account: builtins.str,
        aggregator_region: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Config":
        '''(experimental) Adds a resource of type AggregationAuthorization to the statement.

        https://docs.aws.amazon.com/config/latest/APIReference/API_AggregationAuthorization.html

        :param aggregator_account: - Identifier for the aggregatorAccount.
        :param aggregator_region: - Identifier for the aggregatorRegion.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "onAggregationAuthorization", [aggregator_account, aggregator_region, account, region, partition]))

    @jsii.member(jsii_name="onConfigRule")
    def on_config_rule(
        self,
        config_rule_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Config":
        '''(experimental) Adds a resource of type ConfigRule to the statement.

        https://docs.aws.amazon.com/config/latest/APIReference/API_ConfigRule.html

        :param config_rule_id: - Identifier for the configRuleId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "onConfigRule", [config_rule_id, account, region, partition]))

    @jsii.member(jsii_name="onConfigurationAggregator")
    def on_configuration_aggregator(
        self,
        aggregator_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Config":
        '''(experimental) Adds a resource of type ConfigurationAggregator to the statement.

        https://docs.aws.amazon.com/config/latest/APIReference/API_ConfigurationAggregator.html

        :param aggregator_id: - Identifier for the aggregatorId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "onConfigurationAggregator", [aggregator_id, account, region, partition]))

    @jsii.member(jsii_name="onConformancePack")
    def on_conformance_pack(
        self,
        conformance_pack_name: builtins.str,
        conformance_pack_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Config":
        '''(experimental) Adds a resource of type ConformancePack to the statement.

        https://docs.aws.amazon.com/config/latest/APIReference/API_ConformancePack.html

        :param conformance_pack_name: - Identifier for the conformancePackName.
        :param conformance_pack_id: - Identifier for the conformancePackId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "onConformancePack", [conformance_pack_name, conformance_pack_id, account, region, partition]))

    @jsii.member(jsii_name="onOrganizationConfigRule")
    def on_organization_config_rule(
        self,
        organization_config_rule_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Config":
        '''(experimental) Adds a resource of type OrganizationConfigRule to the statement.

        https://docs.aws.amazon.com/config/latest/APIReference/API_OrganizationConfigRule.html

        :param organization_config_rule_id: - Identifier for the organizationConfigRuleId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "onOrganizationConfigRule", [organization_config_rule_id, account, region, partition]))

    @jsii.member(jsii_name="onOrganizationConformancePack")
    def on_organization_conformance_pack(
        self,
        organization_conformance_pack_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Config":
        '''(experimental) Adds a resource of type OrganizationConformancePack to the statement.

        https://docs.aws.amazon.com/config/latest/APIReference/API_OrganizationConformancePack.html

        :param organization_conformance_pack_id: - Identifier for the organizationConformancePackId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "onOrganizationConformancePack", [organization_conformance_pack_id, account, region, partition]))

    @jsii.member(jsii_name="onRemediationConfiguration")
    def on_remediation_configuration(
        self,
        remediation_configuration_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Config":
        '''(experimental) Adds a resource of type RemediationConfiguration to the statement.

        https://docs.aws.amazon.com/config/latest/APIReference/API_RemediationConfiguration.html

        :param remediation_configuration_id: - Identifier for the remediationConfigurationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "onRemediationConfiguration", [remediation_configuration_id, account, region, partition]))

    @jsii.member(jsii_name="onStoredQuery")
    def on_stored_query(
        self,
        stored_query_name: builtins.str,
        stored_query_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Config":
        '''(experimental) Adds a resource of type StoredQuery to the statement.

        https://docs.aws.amazon.com/config/latest/APIReference/API_StoredQuery.html

        :param stored_query_name: - Identifier for the storedQueryName.
        :param stored_query_id: - Identifier for the storedQueryId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "onStoredQuery", [stored_query_name, stored_query_id, account, region, partition]))

    @jsii.member(jsii_name="toBatchGetAggregateResourceConfig")
    def to_batch_get_aggregate_resource_config(self) -> "Config":
        '''(experimental) Grants permission to return the current configuration items for resources that are present in your AWS Config aggregator.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_BatchGetAggregateResourceConfig.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toBatchGetAggregateResourceConfig", []))

    @jsii.member(jsii_name="toBatchGetResourceConfig")
    def to_batch_get_resource_config(self) -> "Config":
        '''(experimental) Grants permission to return the current configuration for one or more requested resources.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_BatchGetResourceConfig.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toBatchGetResourceConfig", []))

    @jsii.member(jsii_name="toDeleteAggregationAuthorization")
    def to_delete_aggregation_authorization(self) -> "Config":
        '''(experimental) Grants permission to delete the authorization granted to the specified configuration aggregator account in a specified region.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_DeleteAggregationAuthorization.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDeleteAggregationAuthorization", []))

    @jsii.member(jsii_name="toDeleteConfigRule")
    def to_delete_config_rule(self) -> "Config":
        '''(experimental) Grants permission to delete the specified AWS Config rule and all of its evaluation results.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_DeleteConfigRule.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDeleteConfigRule", []))

    @jsii.member(jsii_name="toDeleteConfigurationAggregator")
    def to_delete_configuration_aggregator(self) -> "Config":
        '''(experimental) Grants permission to delete the specified configuration aggregator and the aggregated data associated with the aggregator.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_DeleteConfigurationAggregator.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDeleteConfigurationAggregator", []))

    @jsii.member(jsii_name="toDeleteConfigurationRecorder")
    def to_delete_configuration_recorder(self) -> "Config":
        '''(experimental) Grants permission to delete the configuration recorder.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_DeleteConfigurationRecorder.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDeleteConfigurationRecorder", []))

    @jsii.member(jsii_name="toDeleteConformancePack")
    def to_delete_conformance_pack(self) -> "Config":
        '''(experimental) Grants permission to delete the specified conformance pack and all the AWS Config rules and all evaluation results within that conformance pack.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_DeleteConformancePack.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDeleteConformancePack", []))

    @jsii.member(jsii_name="toDeleteDeliveryChannel")
    def to_delete_delivery_channel(self) -> "Config":
        '''(experimental) Grants permission to delete the delivery channel.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_DeleteDeliveryChannel.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDeleteDeliveryChannel", []))

    @jsii.member(jsii_name="toDeleteEvaluationResults")
    def to_delete_evaluation_results(self) -> "Config":
        '''(experimental) Grants permission to delete the evaluation results for the specified Config rule.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_DeleteEvaluationResults.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDeleteEvaluationResults", []))

    @jsii.member(jsii_name="toDeleteOrganizationConfigRule")
    def to_delete_organization_config_rule(self) -> "Config":
        '''(experimental) Grants permission to delete the specified organization config rule and all of its evaluation results from all member accounts in that organization.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_DeleteOrganizationConfigRule.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDeleteOrganizationConfigRule", []))

    @jsii.member(jsii_name="toDeleteOrganizationConformancePack")
    def to_delete_organization_conformance_pack(self) -> "Config":
        '''(experimental) Grants permission to delete the specified organization conformance pack and all of its evaluation results from all member accounts in that organization.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_DeleteOrganizationConformancePack.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDeleteOrganizationConformancePack", []))

    @jsii.member(jsii_name="toDeletePendingAggregationRequest")
    def to_delete_pending_aggregation_request(self) -> "Config":
        '''(experimental) Grants permission to delete pending authorization requests for a specified aggregator account in a specified region.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_DeletePendingAggregationRequest.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDeletePendingAggregationRequest", []))

    @jsii.member(jsii_name="toDeleteRemediationConfiguration")
    def to_delete_remediation_configuration(self) -> "Config":
        '''(experimental) Grants permission to delete the remediation configuration.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_DeleteRemediationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDeleteRemediationConfiguration", []))

    @jsii.member(jsii_name="toDeleteRemediationExceptions")
    def to_delete_remediation_exceptions(self) -> "Config":
        '''(experimental) Grants permission to delete one or more remediation exceptions for specific resource keys for a specific AWS Config Rule.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_DeleteRemediationExceptions.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDeleteRemediationExceptions", []))

    @jsii.member(jsii_name="toDeleteResourceConfig")
    def to_delete_resource_config(self) -> "Config":
        '''(experimental) Grants permission to record the configuration state for a custom resource that has been deleted.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_DeleteResourceConfig.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDeleteResourceConfig", []))

    @jsii.member(jsii_name="toDeleteRetentionConfiguration")
    def to_delete_retention_configuration(self) -> "Config":
        '''(experimental) Grants permission to delete the retention configuration.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_DeleteRetentionConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDeleteRetentionConfiguration", []))

    @jsii.member(jsii_name="toDeleteStoredQuery")
    def to_delete_stored_query(self) -> "Config":
        '''(experimental) Grants permission to delete the stored query for an AWS account in an AWS Region.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_DeleteStoredQuery.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDeleteStoredQuery", []))

    @jsii.member(jsii_name="toDeliverConfigSnapshot")
    def to_deliver_config_snapshot(self) -> "Config":
        '''(experimental) Grants permission to schedule delivery of a configuration snapshot to the Amazon S3 bucket in the specified delivery channel.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_DeliverConfigSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDeliverConfigSnapshot", []))

    @jsii.member(jsii_name="toDescribeAggregateComplianceByConfigRules")
    def to_describe_aggregate_compliance_by_config_rules(self) -> "Config":
        '''(experimental) Grants permission to return a list of compliant and noncompliant rules with the number of resources for compliant and noncompliant rules.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeAggregateComplianceByConfigRules.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeAggregateComplianceByConfigRules", []))

    @jsii.member(jsii_name="toDescribeAggregateComplianceByConformancePacks")
    def to_describe_aggregate_compliance_by_conformance_packs(self) -> "Config":
        '''(experimental) Grants permission to return a list of compliant and noncompliant conformance packs along with count of compliant, non-compliant and total rules within each conformance pack.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeAggregateComplianceByConformancePacks.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeAggregateComplianceByConformancePacks", []))

    @jsii.member(jsii_name="toDescribeAggregationAuthorizations")
    def to_describe_aggregation_authorizations(self) -> "Config":
        '''(experimental) Grants permission to return a list of authorizations granted to various aggregator accounts and regions.

        Access Level: List

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeAggregationAuthorizations.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeAggregationAuthorizations", []))

    @jsii.member(jsii_name="toDescribeComplianceByConfigRule")
    def to_describe_compliance_by_config_rule(self) -> "Config":
        '''(experimental) Grants permission to indicate whether the specified AWS Config rules are compliant.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeComplianceByConfigRule.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeComplianceByConfigRule", []))

    @jsii.member(jsii_name="toDescribeComplianceByResource")
    def to_describe_compliance_by_resource(self) -> "Config":
        '''(experimental) Grants permission to indicate whether the specified AWS resources are compliant.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeComplianceByResource.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeComplianceByResource", []))

    @jsii.member(jsii_name="toDescribeConfigRuleEvaluationStatus")
    def to_describe_config_rule_evaluation_status(self) -> "Config":
        '''(experimental) Grants permission to return status information for each of your AWS managed Config rules.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeConfigRuleEvaluationStatus.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeConfigRuleEvaluationStatus", []))

    @jsii.member(jsii_name="toDescribeConfigRules")
    def to_describe_config_rules(self) -> "Config":
        '''(experimental) Grants permission to return details about your AWS Config rules.

        Access Level: List

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeConfigRules.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeConfigRules", []))

    @jsii.member(jsii_name="toDescribeConfigurationAggregators")
    def to_describe_configuration_aggregators(self) -> "Config":
        '''(experimental) Grants permission to return the details of one or more configuration aggregators.

        Access Level: List

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeConfigurationAggregators.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeConfigurationAggregators", []))

    @jsii.member(jsii_name="toDescribeConfigurationAggregatorSourcesStatus")
    def to_describe_configuration_aggregator_sources_status(self) -> "Config":
        '''(experimental) Grants permission to return status information for sources within an aggregator.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeConfigurationAggregatorSourcesStatus.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeConfigurationAggregatorSourcesStatus", []))

    @jsii.member(jsii_name="toDescribeConfigurationRecorders")
    def to_describe_configuration_recorders(self) -> "Config":
        '''(experimental) Grants permission to return the names of one or more specified configuration recorders.

        Access Level: List

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeConfigurationRecorders.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeConfigurationRecorders", []))

    @jsii.member(jsii_name="toDescribeConfigurationRecorderStatus")
    def to_describe_configuration_recorder_status(self) -> "Config":
        '''(experimental) Grants permission to return the current status of the specified configuration recorder.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeConfigurationRecorderStatus.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeConfigurationRecorderStatus", []))

    @jsii.member(jsii_name="toDescribeConformancePackCompliance")
    def to_describe_conformance_pack_compliance(self) -> "Config":
        '''(experimental) Grants permission to return compliance information for each rule in that conformance pack.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeConformancePackCompliance.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeConformancePackCompliance", []))

    @jsii.member(jsii_name="toDescribeConformancePacks")
    def to_describe_conformance_packs(self) -> "Config":
        '''(experimental) Grants permission to return a list of one or more conformance packs.

        Access Level: List

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeConformancePacks.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeConformancePacks", []))

    @jsii.member(jsii_name="toDescribeConformancePackStatus")
    def to_describe_conformance_pack_status(self) -> "Config":
        '''(experimental) Grants permission to provide one or more conformance packs deployment status.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeConformancePackStatus.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeConformancePackStatus", []))

    @jsii.member(jsii_name="toDescribeDeliveryChannels")
    def to_describe_delivery_channels(self) -> "Config":
        '''(experimental) Grants permission to return details about the specified delivery channel.

        Access Level: List

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeDeliveryChannels.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeDeliveryChannels", []))

    @jsii.member(jsii_name="toDescribeDeliveryChannelStatus")
    def to_describe_delivery_channel_status(self) -> "Config":
        '''(experimental) Grants permission to return the current status of the specified delivery channel.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeDeliveryChannelStatus.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeDeliveryChannelStatus", []))

    @jsii.member(jsii_name="toDescribeOrganizationConfigRules")
    def to_describe_organization_config_rules(self) -> "Config":
        '''(experimental) Grants permission to return a list of organization config rules.

        Access Level: List

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeOrganizationConfigRules.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeOrganizationConfigRules", []))

    @jsii.member(jsii_name="toDescribeOrganizationConfigRuleStatuses")
    def to_describe_organization_config_rule_statuses(self) -> "Config":
        '''(experimental) Grants permission to provide organization config rule deployment status for an organization.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeOrganizationConfigRuleStatuses.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeOrganizationConfigRuleStatuses", []))

    @jsii.member(jsii_name="toDescribeOrganizationConformancePacks")
    def to_describe_organization_conformance_packs(self) -> "Config":
        '''(experimental) Grants permission to return a list of organization conformance packs.

        Access Level: List

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeOrganizationConformancePacks.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeOrganizationConformancePacks", []))

    @jsii.member(jsii_name="toDescribeOrganizationConformancePackStatuses")
    def to_describe_organization_conformance_pack_statuses(self) -> "Config":
        '''(experimental) Grants permission to provide organization conformance pack deployment status for an organization.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeOrganizationConformancePackStatuses.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeOrganizationConformancePackStatuses", []))

    @jsii.member(jsii_name="toDescribePendingAggregationRequests")
    def to_describe_pending_aggregation_requests(self) -> "Config":
        '''(experimental) Grants permission to return a list of all pending aggregation requests.

        Access Level: List

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribePendingAggregationRequests.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribePendingAggregationRequests", []))

    @jsii.member(jsii_name="toDescribeRemediationConfigurations")
    def to_describe_remediation_configurations(self) -> "Config":
        '''(experimental) Grants permission to return the details of one or more remediation configurations.

        Access Level: List

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeRemediationConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeRemediationConfigurations", []))

    @jsii.member(jsii_name="toDescribeRemediationExceptions")
    def to_describe_remediation_exceptions(self) -> "Config":
        '''(experimental) Grants permission to return the details of one or more remediation exceptions.

        Access Level: List

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeRemediationExceptions.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeRemediationExceptions", []))

    @jsii.member(jsii_name="toDescribeRemediationExecutionStatus")
    def to_describe_remediation_execution_status(self) -> "Config":
        '''(experimental) Grants permission to provide a detailed view of a Remediation Execution for a set of resources including state, timestamps and any error messages for steps that have failed.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeRemediationExecutionStatus.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeRemediationExecutionStatus", []))

    @jsii.member(jsii_name="toDescribeRetentionConfigurations")
    def to_describe_retention_configurations(self) -> "Config":
        '''(experimental) Grants permission to return the details of one or more retention configurations.

        Access Level: List

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeRetentionConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeRetentionConfigurations", []))

    @jsii.member(jsii_name="toGetAggregateComplianceDetailsByConfigRule")
    def to_get_aggregate_compliance_details_by_config_rule(self) -> "Config":
        '''(experimental) Grants permission to return the evaluation results for the specified AWS Config rule for a specific resource in a rule.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_GetAggregateComplianceDetailsByConfigRule.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toGetAggregateComplianceDetailsByConfigRule", []))

    @jsii.member(jsii_name="toGetAggregateConfigRuleComplianceSummary")
    def to_get_aggregate_config_rule_compliance_summary(self) -> "Config":
        '''(experimental) Grants permission to return the number of compliant and noncompliant rules for one or more accounts and regions in an aggregator.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_GetAggregateConfigRuleComplianceSummary.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toGetAggregateConfigRuleComplianceSummary", []))

    @jsii.member(jsii_name="toGetAggregateConformancePackComplianceSummary")
    def to_get_aggregate_conformance_pack_compliance_summary(self) -> "Config":
        '''(experimental) Grants permission to return the number of compliant and noncompliant conformance packs for one or more accounts and regions in an aggregator.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_GetAggregateConformancePackComplianceSummary.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toGetAggregateConformancePackComplianceSummary", []))

    @jsii.member(jsii_name="toGetAggregateDiscoveredResourceCounts")
    def to_get_aggregate_discovered_resource_counts(self) -> "Config":
        '''(experimental) Grants permission to return the resource counts across accounts and regions that are present in your AWS Config aggregator.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_GetAggregateDiscoveredResourceCounts.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toGetAggregateDiscoveredResourceCounts", []))

    @jsii.member(jsii_name="toGetAggregateResourceConfig")
    def to_get_aggregate_resource_config(self) -> "Config":
        '''(experimental) Grants permission to return configuration item that is aggregated for your specific resource in a specific source account and region.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_GetAggregateResourceConfig.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toGetAggregateResourceConfig", []))

    @jsii.member(jsii_name="toGetComplianceDetailsByConfigRule")
    def to_get_compliance_details_by_config_rule(self) -> "Config":
        '''(experimental) Grants permission to return the evaluation results for the specified AWS Config rule.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_GetComplianceDetailsByConfigRule.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toGetComplianceDetailsByConfigRule", []))

    @jsii.member(jsii_name="toGetComplianceDetailsByResource")
    def to_get_compliance_details_by_resource(self) -> "Config":
        '''(experimental) Grants permission to return the evaluation results for the specified AWS resource.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_GetComplianceDetailsByResource.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toGetComplianceDetailsByResource", []))

    @jsii.member(jsii_name="toGetComplianceSummaryByConfigRule")
    def to_get_compliance_summary_by_config_rule(self) -> "Config":
        '''(experimental) Grants permission to return the number of AWS Config rules that are compliant and noncompliant, up to a maximum of 25 for each.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_GetComplianceSummaryByConfigRule.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toGetComplianceSummaryByConfigRule", []))

    @jsii.member(jsii_name="toGetComplianceSummaryByResourceType")
    def to_get_compliance_summary_by_resource_type(self) -> "Config":
        '''(experimental) Grants permission to return the number of resources that are compliant and the number that are noncompliant.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_GetComplianceSummaryByResourceType.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toGetComplianceSummaryByResourceType", []))

    @jsii.member(jsii_name="toGetConformancePackComplianceDetails")
    def to_get_conformance_pack_compliance_details(self) -> "Config":
        '''(experimental) Grants permission to return compliance details of a conformance pack for all AWS resources that are monitered by conformance pack.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_GetConformancePackComplianceDetails.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toGetConformancePackComplianceDetails", []))

    @jsii.member(jsii_name="toGetConformancePackComplianceSummary")
    def to_get_conformance_pack_compliance_summary(self) -> "Config":
        '''(experimental) Grants permission to provide compliance summary for one or more conformance packs.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_GetConformancePackComplianceSummary.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toGetConformancePackComplianceSummary", []))

    @jsii.member(jsii_name="toGetDiscoveredResourceCounts")
    def to_get_discovered_resource_counts(self) -> "Config":
        '''(experimental) Grants permission to return the resource types, the number of each resource type, and the total number of resources that AWS Config is recording in this region for your AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_GetDiscoveredResourceCounts.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toGetDiscoveredResourceCounts", []))

    @jsii.member(jsii_name="toGetOrganizationConfigRuleDetailedStatus")
    def to_get_organization_config_rule_detailed_status(self) -> "Config":
        '''(experimental) Grants permission to return detailed status for each member account within an organization for a given organization config rule.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_GetOrganizationConfigRuleDetailedStatus.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toGetOrganizationConfigRuleDetailedStatus", []))

    @jsii.member(jsii_name="toGetOrganizationConformancePackDetailedStatus")
    def to_get_organization_conformance_pack_detailed_status(self) -> "Config":
        '''(experimental) Grants permission to return detailed status for each member account within an organization for a given organization conformance pack.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_GetOrganizationConformancePackDetailedStatus.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toGetOrganizationConformancePackDetailedStatus", []))

    @jsii.member(jsii_name="toGetResourceConfigHistory")
    def to_get_resource_config_history(self) -> "Config":
        '''(experimental) Grants permission to return a list of configuration items for the specified resource.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_GetResourceConfigHistory.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toGetResourceConfigHistory", []))

    @jsii.member(jsii_name="toGetStoredQuery")
    def to_get_stored_query(self) -> "Config":
        '''(experimental) Grants permission to return the details of a specific stored query.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_GetStoredQuery.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toGetStoredQuery", []))

    @jsii.member(jsii_name="toListAggregateDiscoveredResources")
    def to_list_aggregate_discovered_resources(self) -> "Config":
        '''(experimental) Grants permission to accept a resource type and returns a list of resource identifiers that are aggregated for a specific resource type across accounts and regions.

        Access Level: List

        https://docs.aws.amazon.com/config/latest/APIReference/API_ListAggregateDiscoveredResources.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toListAggregateDiscoveredResources", []))

    @jsii.member(jsii_name="toListDiscoveredResources")
    def to_list_discovered_resources(self) -> "Config":
        '''(experimental) Grants permission to accept a resource type and returns a list of resource identifiers for the resources of that type.

        Access Level: List

        https://docs.aws.amazon.com/config/latest/APIReference/API_ListDiscoveredResources.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toListDiscoveredResources", []))

    @jsii.member(jsii_name="toListStoredQueries")
    def to_list_stored_queries(self) -> "Config":
        '''(experimental) Grants permission to list the stored queries for an AWS account in an AWS Region.

        Access Level: List

        https://docs.aws.amazon.com/config/latest/APIReference/API_ListStoredQueries.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toListStoredQueries", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Config":
        '''(experimental) Grants permission to list the tags for AWS Config resource.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutAggregationAuthorization")
    def to_put_aggregation_authorization(self) -> "Config":
        '''(experimental) Grants permission to authorize the aggregator account and region to collect data from the source account and region.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/config/latest/APIReference/API_PutAggregationAuthorization.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toPutAggregationAuthorization", []))

    @jsii.member(jsii_name="toPutConfigRule")
    def to_put_config_rule(self) -> "Config":
        '''(experimental) Grants permission to add or update an AWS Config rule for evaluating whether your AWS resources comply with your desired configurations.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/config/latest/APIReference/API_PutConfigRule.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toPutConfigRule", []))

    @jsii.member(jsii_name="toPutConfigurationAggregator")
    def to_put_configuration_aggregator(self) -> "Config":
        '''(experimental) Grants permission to create and update the configuration aggregator with the selected source accounts and regions.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/config/latest/APIReference/API_PutConfigurationAggregator.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toPutConfigurationAggregator", []))

    @jsii.member(jsii_name="toPutConfigurationRecorder")
    def to_put_configuration_recorder(self) -> "Config":
        '''(experimental) Grants permission to create a new configuration recorder to record the selected resource configurations.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_PutConfigurationRecorder.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toPutConfigurationRecorder", []))

    @jsii.member(jsii_name="toPutConformancePack")
    def to_put_conformance_pack(self) -> "Config":
        '''(experimental) Grants permission to create or update a conformance pack.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_PutConformancePack.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toPutConformancePack", []))

    @jsii.member(jsii_name="toPutDeliveryChannel")
    def to_put_delivery_channel(self) -> "Config":
        '''(experimental) Grants permission to create a delivery channel object to deliver configuration information to an Amazon S3 bucket and Amazon SNS topic.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_PutDeliveryChannel.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toPutDeliveryChannel", []))

    @jsii.member(jsii_name="toPutEvaluations")
    def to_put_evaluations(self) -> "Config":
        '''(experimental) Grants permission to be used by an AWS Lambda function to deliver evaluation results to AWS Config.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_PutEvaluations.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toPutEvaluations", []))

    @jsii.member(jsii_name="toPutExternalEvaluation")
    def to_put_external_evaluation(self) -> "Config":
        '''(experimental) Grants permission to deliver evaluation result to AWS Config.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_PutExternalEvaluation.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toPutExternalEvaluation", []))

    @jsii.member(jsii_name="toPutOrganizationConfigRule")
    def to_put_organization_config_rule(self) -> "Config":
        '''(experimental) Grants permission to add or update organization config rule for your entire organization evaluating whether your AWS resources comply with your desired configurations.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_PutOrganizationConfigRule.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toPutOrganizationConfigRule", []))

    @jsii.member(jsii_name="toPutOrganizationConformancePack")
    def to_put_organization_conformance_pack(self) -> "Config":
        '''(experimental) Grants permission to add or update organization conformance pack for your entire organization evaluating whether your AWS resources comply with your desired configurations.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_PutOrganizationConformancePack.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toPutOrganizationConformancePack", []))

    @jsii.member(jsii_name="toPutRemediationConfigurations")
    def to_put_remediation_configurations(self) -> "Config":
        '''(experimental) Grants permission to add or update the remediation configuration with a specific AWS Config rule with the selected target or action.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_PutRemediationConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toPutRemediationConfigurations", []))

    @jsii.member(jsii_name="toPutRemediationExceptions")
    def to_put_remediation_exceptions(self) -> "Config":
        '''(experimental) Grants permission to add or update remediation exceptions for specific resources for a specific AWS Config rule.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_PutRemediationExceptions.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toPutRemediationExceptions", []))

    @jsii.member(jsii_name="toPutResourceConfig")
    def to_put_resource_config(self) -> "Config":
        '''(experimental) Grants permission to record the configuration state for the resource provided in the request.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_PutResourceConfig.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toPutResourceConfig", []))

    @jsii.member(jsii_name="toPutRetentionConfiguration")
    def to_put_retention_configuration(self) -> "Config":
        '''(experimental) Grants permission to create and update the retention configuration with details about retention period (number of days) that AWS Config stores your historical information.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_PutRetentionConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toPutRetentionConfiguration", []))

    @jsii.member(jsii_name="toPutStoredQuery")
    def to_put_stored_query(self) -> "Config":
        '''(experimental) Grants permission to save a new query or updates an existing saved query.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_PutStoredQuery.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toPutStoredQuery", []))

    @jsii.member(jsii_name="toSelectAggregateResourceConfig")
    def to_select_aggregate_resource_config(self) -> "Config":
        '''(experimental) Grants permission to accept a structured query language (SQL) SELECT command and an aggregator to query configuration state of AWS resources across multiple accounts and regions, performs the corresponding search, and returns resource configurations matching the properties.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_SelectAggregateResourceConfig.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toSelectAggregateResourceConfig", []))

    @jsii.member(jsii_name="toSelectResourceConfig")
    def to_select_resource_config(self) -> "Config":
        '''(experimental) Grants permission to accept a structured query language (SQL) SELECT command, performs the corresponding search, and returns resource configurations matching the properties.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_SelectResourceConfig.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toSelectResourceConfig", []))

    @jsii.member(jsii_name="toStartConfigRulesEvaluation")
    def to_start_config_rules_evaluation(self) -> "Config":
        '''(experimental) Grants permission to evaluate your resources against the specified Config rules.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_StartConfigRulesEvaluation.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toStartConfigRulesEvaluation", []))

    @jsii.member(jsii_name="toStartConfigurationRecorder")
    def to_start_configuration_recorder(self) -> "Config":
        '''(experimental) Grants permission to start recording configurations of the AWS resources you have selected to record in your AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_StartConfigurationRecorder.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toStartConfigurationRecorder", []))

    @jsii.member(jsii_name="toStartRemediationExecution")
    def to_start_remediation_execution(self) -> "Config":
        '''(experimental) Grants permission to run an on-demand remediation for the specified AWS Config rules against the last known remediation configuration.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_StartRemediationExecution.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toStartRemediationExecution", []))

    @jsii.member(jsii_name="toStopConfigurationRecorder")
    def to_stop_configuration_recorder(self) -> "Config":
        '''(experimental) Grants permission to stop recording configurations of the AWS resources you have selected to record in your AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_StopConfigurationRecorder.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toStopConfigurationRecorder", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Config":
        '''(experimental) Grants permission to associate the specified tags to a resource with the specified resourceArn.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/config/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Config":
        '''(experimental) Grants permission to delete specified tags from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/config/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toUntagResource", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Connect(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Connect"):
    '''(experimental) Statement provider for service `connect <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonconnect.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `connect <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonconnect.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Connect, self, [sid])

    @jsii.member(jsii_name="ifAttributeType")
    def if_attribute_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Connect":
        '''(experimental) Filters access by the attribute type of the Amazon Connect instance.

        https://docs.aws.amazon.com/connect/latest/adminguide/security_iam_service-with-iam.html

        Applies to actions:

        - .toDescribeInstanceAttribute()
        - .toUpdateInstanceAttribute()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "ifAttributeType", [value, operator]))

    @jsii.member(jsii_name="ifInstanceId")
    def if_instance_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Connect":
        '''(experimental) Filters access by restricting federation into specified Amazon Connect instances.

        https://docs.aws.amazon.com/connect/latest/adminguide/security_iam_service-with-iam.html

        Applies to actions:

        - .toGetFederationToken()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "ifInstanceId", [value, operator]))

    @jsii.member(jsii_name="ifStorageResourceType")
    def if_storage_resource_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Connect":
        '''(experimental) Filters access by restricting the storage resource type of the Amazon Connect instance storage configuration.

        https://docs.aws.amazon.com/connect/latest/adminguide/security_iam_service-with-iam.html

        Applies to actions:

        - .toAssociateInstanceStorageConfig()
        - .toDescribeInstanceStorageConfig()
        - .toDisassociateInstanceStorageConfig()
        - .toUpdateInstanceStorageConfig()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "ifStorageResourceType", [value, operator]))

    @jsii.member(jsii_name="onContact")
    def on_contact(
        self,
        instance_id: builtins.str,
        contact_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Connect":
        '''(experimental) Adds a resource of type contact to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/connect-contact-attributes.html

        :param instance_id: - Identifier for the instanceId.
        :param contact_id: - Identifier for the contactId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "onContact", [instance_id, contact_id, account, region, partition]))

    @jsii.member(jsii_name="onContactFlow")
    def on_contact_flow(
        self,
        instance_id: builtins.str,
        contact_flow_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Connect":
        '''(experimental) Adds a resource of type contact-flow to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/connect-contact-flows.html

        :param instance_id: - Identifier for the instanceId.
        :param contact_flow_id: - Identifier for the contactFlowId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "onContactFlow", [instance_id, contact_flow_id, account, region, partition]))

    @jsii.member(jsii_name="onHierarchyGroup")
    def on_hierarchy_group(
        self,
        instance_id: builtins.str,
        hierarchy_group_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Connect":
        '''(experimental) Adds a resource of type hierarchy-group to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/agent-hierarchy.html

        :param instance_id: - Identifier for the instanceId.
        :param hierarchy_group_id: - Identifier for the hierarchyGroupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "onHierarchyGroup", [instance_id, hierarchy_group_id, account, region, partition]))

    @jsii.member(jsii_name="onHoursOfOperation")
    def on_hours_of_operation(
        self,
        instance_id: builtins.str,
        hours_of_operation_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Connect":
        '''(experimental) Adds a resource of type hours-of-operation to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/API_HoursOfOperation.html

        :param instance_id: - Identifier for the instanceId.
        :param hours_of_operation_id: - Identifier for the hoursOfOperationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "onHoursOfOperation", [instance_id, hours_of_operation_id, account, region, partition]))

    @jsii.member(jsii_name="onInstance")
    def on_instance(
        self,
        instance_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Connect":
        '''(experimental) Adds a resource of type instance to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-instances.html

        :param instance_id: - Identifier for the instanceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "onInstance", [instance_id, account, region, partition]))

    @jsii.member(jsii_name="onPhoneNumber")
    def on_phone_number(
        self,
        instance_id: builtins.str,
        phone_number_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Connect":
        '''(experimental) Adds a resource of type phone-number to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/contact-center-phone-number.html

        :param instance_id: - Identifier for the instanceId.
        :param phone_number_id: - Identifier for the phoneNumberId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "onPhoneNumber", [instance_id, phone_number_id, account, region, partition]))

    @jsii.member(jsii_name="onQueue")
    def on_queue(
        self,
        instance_id: builtins.str,
        queue_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Connect":
        '''(experimental) Adds a resource of type queue to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/API_Queue.html

        :param instance_id: - Identifier for the instanceId.
        :param queue_id: - Identifier for the queueId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "onQueue", [instance_id, queue_id, account, region, partition]))

    @jsii.member(jsii_name="onQuickConnect")
    def on_quick_connect(
        self,
        instance_id: builtins.str,
        quick_connect_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Connect":
        '''(experimental) Adds a resource of type quick-connect to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/quick-connects.html

        :param instance_id: - Identifier for the instanceId.
        :param quick_connect_id: - Identifier for the quickConnectId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "onQuickConnect", [instance_id, quick_connect_id, account, region, partition]))

    @jsii.member(jsii_name="onRoutingProfile")
    def on_routing_profile(
        self,
        instance_id: builtins.str,
        routing_profile_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Connect":
        '''(experimental) Adds a resource of type routing-profile to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/routing-profiles.html

        :param instance_id: - Identifier for the instanceId.
        :param routing_profile_id: - Identifier for the routingProfileId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "onRoutingProfile", [instance_id, routing_profile_id, account, region, partition]))

    @jsii.member(jsii_name="onSecurityProfile")
    def on_security_profile(
        self,
        instance_id: builtins.str,
        security_profile_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Connect":
        '''(experimental) Adds a resource of type security-profile to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/connect-security-profiles.html

        :param instance_id: - Identifier for the instanceId.
        :param security_profile_id: - Identifier for the securityProfileId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "onSecurityProfile", [instance_id, security_profile_id, account, region, partition]))

    @jsii.member(jsii_name="onUser")
    def on_user(
        self,
        instance_id: builtins.str,
        user_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Connect":
        '''(experimental) Adds a resource of type user to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/connect-agents.html

        :param instance_id: - Identifier for the instanceId.
        :param user_id: - Identifier for the userId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "onUser", [instance_id, user_id, account, region, partition]))

    @jsii.member(jsii_name="toAssociateApprovedOrigin")
    def to_associate_approved_origin(self) -> "Connect":
        '''(experimental) Grants permissions to associate approved origin for an existing Amazon Connect instance.

        The associated required actions grant permission to modify the settings for the instance.

        Access Level: Write

        https://docs.aws.amazon.com/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toAssociateApprovedOrigin", []))

    @jsii.member(jsii_name="toAssociateInstanceStorageConfig")
    def to_associate_instance_storage_config(self) -> "Connect":
        '''(experimental) Grants permissions to associate instance storage for an existing Amazon Connect instance.

        The associated required actions grant permission to modify the settings for the instance.

        Access Level: Write

        Possible conditions:

        - .ifStorageResourceType()

        Dependent actions:

        - ds:DescribeDirectories
        - firehose:DescribeDeliveryStream
        - iam:AttachRolePolicy
        - iam:CreateServiceLinkedRole
        - iam:PutRolePolicy
        - kinesis:DescribeStream
        - kms:CreateGrant
        - kms:DescribeKey
        - s3:GetBucketAcl
        - s3:GetBucketLocation

        https://docs.aws.amazon.com/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toAssociateInstanceStorageConfig", []))

    @jsii.member(jsii_name="toAssociateLambdaFunction")
    def to_associate_lambda_function(self) -> "Connect":
        '''(experimental) Grants permissions to associate a Lambda function for an existing Amazon Connect instance.

        The associated required actions grant permission to modify the settings for the instance.

        Access Level: Write

        Dependent actions:

        - lambda:AddPermission

        https://docs.aws.amazon.com/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toAssociateLambdaFunction", []))

    @jsii.member(jsii_name="toAssociateLexBot")
    def to_associate_lex_bot(self) -> "Connect":
        '''(experimental) Grants permissions to associate a Lex bot for an existing Amazon Connect instance.

        The associated required actions grant permission to modify the settings for the instance.

        Access Level: Write

        Dependent actions:

        - iam:AttachRolePolicy
        - iam:CreateServiceLinkedRole
        - iam:PutRolePolicy
        - lex:GetBot

        https://docs.aws.amazon.com/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toAssociateLexBot", []))

    @jsii.member(jsii_name="toAssociateQueueQuickConnects")
    def to_associate_queue_quick_connects(self) -> "Connect":
        '''(experimental) Grants permissions to associate quick connects with a queue in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_AssociateQueueQuickConnects.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toAssociateQueueQuickConnects", []))

    @jsii.member(jsii_name="toAssociateRoutingProfileQueues")
    def to_associate_routing_profile_queues(self) -> "Connect":
        '''(experimental) Grants permissions to associate queues with a routing profile in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_AssociateRoutingProfileQueues.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toAssociateRoutingProfileQueues", []))

    @jsii.member(jsii_name="toAssociateSecurityKey")
    def to_associate_security_key(self) -> "Connect":
        '''(experimental) Grants permissions to associate a security key for an existing Amazon Connect instance.

        The associated required actions grant permission to modify the settings for the instance.

        Access Level: Write

        https://docs.aws.amazon.com/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toAssociateSecurityKey", []))

    @jsii.member(jsii_name="toCreateContactFlow")
    def to_create_contact_flow(self) -> "Connect":
        '''(experimental) Grants permissions to create a contact flow in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_CreateContactFlow.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toCreateContactFlow", []))

    @jsii.member(jsii_name="toCreateInstance")
    def to_create_instance(self) -> "Connect":
        '''(experimental) Grants permissions to create a new Amazon Connect instance. The associated required actions grant permissions to configure instance settings.

        Access Level: Write

        Dependent actions:

        - ds:AuthorizeApplication
        - ds:CheckAlias
        - ds:CreateAlias
        - ds:CreateDirectory
        - ds:CreateIdentityPoolDirectory
        - ds:DeleteDirectory
        - ds:DescribeDirectories
        - ds:UnauthorizeApplication
        - iam:AttachRolePolicy
        - iam:CreateServiceLinkedRole
        - iam:PutRolePolicy

        https://docs.aws.amazon.com/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toCreateInstance", []))

    @jsii.member(jsii_name="toCreateQueue")
    def to_create_queue(self) -> "Connect":
        '''(experimental) Grants permissions to create a queue in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_CreateQueue.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toCreateQueue", []))

    @jsii.member(jsii_name="toCreateQuickConnect")
    def to_create_quick_connect(self) -> "Connect":
        '''(experimental) Grants permission to create a quick connect in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_CreateQuickConnect.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toCreateQuickConnect", []))

    @jsii.member(jsii_name="toCreateRoutingProfile")
    def to_create_routing_profile(self) -> "Connect":
        '''(experimental) Grants permission to create a routing profile in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_CreateRoutingProfile.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toCreateRoutingProfile", []))

    @jsii.member(jsii_name="toCreateUser")
    def to_create_user(self) -> "Connect":
        '''(experimental) Grants permission to create a user for the specified Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_CreateUser.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toCreateUser", []))

    @jsii.member(jsii_name="toCreateUserHierarchyGroup")
    def to_create_user_hierarchy_group(self) -> "Connect":
        '''(experimental) Grants permissions to create a user hierarchy group in an Amazon Connect instance.

        Access Level: Write

        https://docs.aws.amazon.com/connect/latest/APIReference/API_CreateUserHierarchyGroup.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toCreateUserHierarchyGroup", []))

    @jsii.member(jsii_name="toDeleteInstance")
    def to_delete_instance(self) -> "Connect":
        '''(experimental) Grants permissions to delete an Amazon Connect instance.

        When you remove an instance, the link to an existing AWS directory is also removed.

        Access Level: Write

        Dependent actions:

        - ds:DeleteDirectory
        - ds:DescribeDirectories
        - ds:UnauthorizeApplication

        https://docs.aws.amazon.com/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDeleteInstance", []))

    @jsii.member(jsii_name="toDeleteQuickConnect")
    def to_delete_quick_connect(self) -> "Connect":
        '''(experimental) Grants permissions to delete a quick connect in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DeleteQuickConnect.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDeleteQuickConnect", []))

    @jsii.member(jsii_name="toDeleteUser")
    def to_delete_user(self) -> "Connect":
        '''(experimental) Grants permissions to delete a user in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DeleteUser.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDeleteUser", []))

    @jsii.member(jsii_name="toDeleteUserHierarchyGroup")
    def to_delete_user_hierarchy_group(self) -> "Connect":
        '''(experimental) Grants permissions to delete a user hierarchy group in an Amazon Connect instance.

        Access Level: Write

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DeleteUserHierarchyGroup.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDeleteUserHierarchyGroup", []))

    @jsii.member(jsii_name="toDescribeContactFlow")
    def to_describe_contact_flow(self) -> "Connect":
        '''(experimental) Grants permissions to describe a contact flow in an Amazon Connect instance.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DescribeContactFlow.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDescribeContactFlow", []))

    @jsii.member(jsii_name="toDescribeHoursOfOperation")
    def to_describe_hours_of_operation(self) -> "Connect":
        '''(experimental) Grants permissions to describe hours of operation in an Amazon Connect instance.

        Access Level: Read

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DescribeHoursOfOperation.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDescribeHoursOfOperation", []))

    @jsii.member(jsii_name="toDescribeInstance")
    def to_describe_instance(self) -> "Connect":
        '''(experimental) Grants permissions to view details of an Amazon Connect instance. This is required to create an instance.

        Access Level: Read

        Dependent actions:

        - ds:DescribeDirectories

        https://docs.aws.amazon.com/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDescribeInstance", []))

    @jsii.member(jsii_name="toDescribeInstanceAttribute")
    def to_describe_instance_attribute(self) -> "Connect":
        '''(experimental) Grants permissions to view the attribute details of an existing Amazon Connect instance.

        Access Level: Read

        Possible conditions:

        - .ifAttributeType()

        https://docs.aws.amazon.com/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDescribeInstanceAttribute", []))

    @jsii.member(jsii_name="toDescribeInstanceStorageConfig")
    def to_describe_instance_storage_config(self) -> "Connect":
        '''(experimental) Grants permissions to view the instance storage configuration for an existing Amazon Connect instance.

        Access Level: Read

        Possible conditions:

        - .ifStorageResourceType()

        https://docs.aws.amazon.com/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDescribeInstanceStorageConfig", []))

    @jsii.member(jsii_name="toDescribeQueue")
    def to_describe_queue(self) -> "Connect":
        '''(experimental) Grants permissions to describe a queue in an Amazon Connect instance.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DescribeQueue.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDescribeQueue", []))

    @jsii.member(jsii_name="toDescribeQuickConnect")
    def to_describe_quick_connect(self) -> "Connect":
        '''(experimental) Grants permissions to describe a quick connect in an Amazon Connect instance.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DescribeQuickConnect.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDescribeQuickConnect", []))

    @jsii.member(jsii_name="toDescribeRoutingProfile")
    def to_describe_routing_profile(self) -> "Connect":
        '''(experimental) Grants permissions to describe a routing profile in an Amazon Connect instance.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DescribeRoutingProfile.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDescribeRoutingProfile", []))

    @jsii.member(jsii_name="toDescribeUser")
    def to_describe_user(self) -> "Connect":
        '''(experimental) Grants permissions to describe a user in an Amazon Connect instance.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DescribeUser.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDescribeUser", []))

    @jsii.member(jsii_name="toDescribeUserHierarchyGroup")
    def to_describe_user_hierarchy_group(self) -> "Connect":
        '''(experimental) Grants permissions to describe a hierarchy group for an Amazon Connect instance.

        Access Level: Read

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DescribeUserHierarchyGroup.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDescribeUserHierarchyGroup", []))

    @jsii.member(jsii_name="toDescribeUserHierarchyStructure")
    def to_describe_user_hierarchy_structure(self) -> "Connect":
        '''(experimental) Grants permissions to describe the hierarchy structure for an Amazon Connect instance.

        Access Level: Read

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DescribeUserHierarchyStructure.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDescribeUserHierarchyStructure", []))

    @jsii.member(jsii_name="toDisassociateApprovedOrigin")
    def to_disassociate_approved_origin(self) -> "Connect":
        '''(experimental) Grants permissions to disassociate approved origin for an existing Amazon Connect instance.

        The associated required actions grant permission to modify the settings for the instance.

        Access Level: Write

        https://docs.aws.amazon.com/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDisassociateApprovedOrigin", []))

    @jsii.member(jsii_name="toDisassociateInstanceStorageConfig")
    def to_disassociate_instance_storage_config(self) -> "Connect":
        '''(experimental) Grants permissions to disassociate instance storage for an existing Amazon Connect instance.

        The associated required actions grant permission to modify the settings for the instance.

        Access Level: Write

        Possible conditions:

        - .ifStorageResourceType()

        https://docs.aws.amazon.com/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDisassociateInstanceStorageConfig", []))

    @jsii.member(jsii_name="toDisassociateLambdaFunction")
    def to_disassociate_lambda_function(self) -> "Connect":
        '''(experimental) Grants permissions to disassociate a Lambda function for an existing Amazon Connect instance.

        The associated required actions grant permission to modify the settings for the instance.

        Access Level: Write

        Dependent actions:

        - lambda:RemovePermission

        https://docs.aws.amazon.com/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDisassociateLambdaFunction", []))

    @jsii.member(jsii_name="toDisassociateLexBot")
    def to_disassociate_lex_bot(self) -> "Connect":
        '''(experimental) Grants permissions to disassociate a Lex bot for an existing Amazon Connect instance.

        The associated required actions grant permission to modify the settings for the instance.

        Access Level: Write

        Dependent actions:

        - iam:AttachRolePolicy
        - iam:CreateServiceLinkedRole
        - iam:PutRolePolicy

        https://docs.aws.amazon.com/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDisassociateLexBot", []))

    @jsii.member(jsii_name="toDisassociateQueueQuickConnects")
    def to_disassociate_queue_quick_connects(self) -> "Connect":
        '''(experimental) Grants permissions to disassociate quick connects from a queue in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DisassociateQueueQuickConnects.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDisassociateQueueQuickConnects", []))

    @jsii.member(jsii_name="toDisassociateRoutingProfileQueues")
    def to_disassociate_routing_profile_queues(self) -> "Connect":
        '''(experimental) Grants permissions to disassociate queues from a routing profile in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DisassociateRoutingProfileQueues.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDisassociateRoutingProfileQueues", []))

    @jsii.member(jsii_name="toDisassociateSecurityKey")
    def to_disassociate_security_key(self) -> "Connect":
        '''(experimental) Grants permissions to disassociate the security key for an existing Amazon Connect instance.

        The associated required actions grant permission to modify the settings for the instance.

        Access Level: Write

        https://docs.aws.amazon.com/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDisassociateSecurityKey", []))

    @jsii.member(jsii_name="toGetContactAttributes")
    def to_get_contact_attributes(self) -> "Connect":
        '''(experimental) Grants permissions to retrieve the contact attributes for the specified contact.

        Access Level: Read

        https://docs.aws.amazon.com/connect/latest/APIReference/API_GetContactAttributes.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toGetContactAttributes", []))

    @jsii.member(jsii_name="toGetCurrentMetricData")
    def to_get_current_metric_data(self) -> "Connect":
        '''(experimental) Grants permissions to retrieve current metric data for the queues in an Amazon Connect instance.

        Access Level: Read

        https://docs.aws.amazon.com/connect/latest/APIReference/API_GetCurrentMetricData.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toGetCurrentMetricData", []))

    @jsii.member(jsii_name="toGetFederationToken")
    def to_get_federation_token(self) -> "Connect":
        '''(experimental) Grants permissions to federate into an Amazon Connect instance when using SAML-based authentication for identity management.

        Access Level: Read

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_GetFederationToken.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toGetFederationToken", []))

    @jsii.member(jsii_name="toGetFederationTokens")
    def to_get_federation_tokens(self) -> "Connect":
        '''(experimental) Grants permissions to federate into an Amazon Connect instance (Log in for emergency access functionality in the Amazon Connect console).

        Access Level: Write

        Dependent actions:

        - connect:DescribeInstance
        - connect:ListInstances
        - ds:DescribeDirectories

        https://docs.aws.amazon.com/connect/latest/APIReference/emergency-admin-login.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toGetFederationTokens", []))

    @jsii.member(jsii_name="toGetMetricData")
    def to_get_metric_data(self) -> "Connect":
        '''(experimental) Grants permissions to retrieve historical metric data for queues in an Amazon Connect instance.

        Access Level: Read

        https://docs.aws.amazon.com/connect/latest/APIReference/API_GetMetricData.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toGetMetricData", []))

    @jsii.member(jsii_name="toListApprovedOrigins")
    def to_list_approved_origins(self) -> "Connect":
        '''(experimental) Grants permissions to view approved origins of an existing Amazon Connect instance.

        Access Level: List

        https://docs.aws.amazon.com/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListApprovedOrigins", []))

    @jsii.member(jsii_name="toListContactFlows")
    def to_list_contact_flows(self) -> "Connect":
        '''(experimental) Grants permissions to list contact flow resources in an Amazon Connect instance.

        Access Level: List

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ListContactFlows.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListContactFlows", []))

    @jsii.member(jsii_name="toListHoursOfOperations")
    def to_list_hours_of_operations(self) -> "Connect":
        '''(experimental) Grants permissions to list hours of operation resources in an Amazon Connect instance.

        Access Level: List

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ListHoursOfOperations.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListHoursOfOperations", []))

    @jsii.member(jsii_name="toListInstanceAttributes")
    def to_list_instance_attributes(self) -> "Connect":
        '''(experimental) Grants permissions to view the attributes of an existing Amazon Connect instance.

        Access Level: List

        https://docs.aws.amazon.com/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListInstanceAttributes", []))

    @jsii.member(jsii_name="toListInstances")
    def to_list_instances(self) -> "Connect":
        '''(experimental) Grants permissions to view the Amazon Connect instances associated with an AWS account.

        Access Level: List

        Dependent actions:

        - ds:DescribeDirectories

        https://docs.aws.amazon.com/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListInstances", []))

    @jsii.member(jsii_name="toListInstanceStorageConfigs")
    def to_list_instance_storage_configs(self) -> "Connect":
        '''(experimental) Grants permissions to view storage configurations of an existing Amazon Connect instance.

        Access Level: List

        https://docs.aws.amazon.com/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListInstanceStorageConfigs", []))

    @jsii.member(jsii_name="toListLambdaFunctions")
    def to_list_lambda_functions(self) -> "Connect":
        '''(experimental) Grants permissions to view the Lambda functions of an existing Amazon Connect instance.

        Access Level: List

        https://docs.aws.amazon.com/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListLambdaFunctions", []))

    @jsii.member(jsii_name="toListLexBots")
    def to_list_lex_bots(self) -> "Connect":
        '''(experimental) Grants permissions to view the Lex bots of an existing Amazon Connect instance.

        Access Level: List

        https://docs.aws.amazon.com/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListLexBots", []))

    @jsii.member(jsii_name="toListPhoneNumbers")
    def to_list_phone_numbers(self) -> "Connect":
        '''(experimental) Grants permissions to list phone number resources in an Amazon Connect instance.

        Access Level: List

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ListPhoneNumbers.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListPhoneNumbers", []))

    @jsii.member(jsii_name="toListPrompts")
    def to_list_prompts(self) -> "Connect":
        '''(experimental) Grants permissions to list prompt resources in an Amazon Connect instance.

        Access Level: List

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ListPrompts.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListPrompts", []))

    @jsii.member(jsii_name="toListQueueQuickConnects")
    def to_list_queue_quick_connects(self) -> "Connect":
        '''(experimental) Grants permissions to list quick connect resources in a queue in an Amazon Connect instance.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ListQueueQuickConnects.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListQueueQuickConnects", []))

    @jsii.member(jsii_name="toListQueues")
    def to_list_queues(self) -> "Connect":
        '''(experimental) Grants permissions to list queue resources in an Amazon Connect instance.

        Access Level: List

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ListQueues.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListQueues", []))

    @jsii.member(jsii_name="toListQuickConnects")
    def to_list_quick_connects(self) -> "Connect":
        '''(experimental) Grants permissions to list quick connect resources in an Amazon Connect instance.

        Access Level: List

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ListQuickConnects.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListQuickConnects", []))

    @jsii.member(jsii_name="toListRoutingProfileQueues")
    def to_list_routing_profile_queues(self) -> "Connect":
        '''(experimental) Grants permissions to list queue resources in a routing profile in an Amazon Connect instance.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ListRoutingProfileQueues.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListRoutingProfileQueues", []))

    @jsii.member(jsii_name="toListRoutingProfiles")
    def to_list_routing_profiles(self) -> "Connect":
        '''(experimental) Grants permissions to list routing profile resources in an Amazon Connect instance.

        Access Level: List

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ListRoutingProfiles.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListRoutingProfiles", []))

    @jsii.member(jsii_name="toListSecurityKeys")
    def to_list_security_keys(self) -> "Connect":
        '''(experimental) Grants permissions to view the security keys of an existing Amazon Connect instance.

        Access Level: List

        https://docs.aws.amazon.com/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListSecurityKeys", []))

    @jsii.member(jsii_name="toListSecurityProfiles")
    def to_list_security_profiles(self) -> "Connect":
        '''(experimental) Grants permissions to list security profile resources in an Amazon Connect instance.

        Access Level: List

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ListSecurityProfiles.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListSecurityProfiles", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Connect":
        '''(experimental) Grants permissions to list tags for an Amazon Connect resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListUserHierarchyGroups")
    def to_list_user_hierarchy_groups(self) -> "Connect":
        '''(experimental) Grants permissions to list the hierarchy group resources in an Amazon Connect instance.

        Access Level: List

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ListUserHierarchyGroups.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListUserHierarchyGroups", []))

    @jsii.member(jsii_name="toListUsers")
    def to_list_users(self) -> "Connect":
        '''(experimental) Grants permissions to list user resources in an Amazon Connect instance.

        Access Level: List

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ListUsers.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListUsers", []))

    @jsii.member(jsii_name="toResumeContactRecording")
    def to_resume_contact_recording(self) -> "Connect":
        '''(experimental) Grants permissions to resume recording for the specified contact.

        Access Level: Write

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ResumeContactRecording.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toResumeContactRecording", []))

    @jsii.member(jsii_name="toStartChatContact")
    def to_start_chat_contact(self) -> "Connect":
        '''(experimental) Grants permissions to initiate a chat using the Amazon Connect API.

        Access Level: Write

        https://docs.aws.amazon.com/connect/latest/APIReference/API_StartChatContact.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toStartChatContact", []))

    @jsii.member(jsii_name="toStartContactRecording")
    def to_start_contact_recording(self) -> "Connect":
        '''(experimental) Grants permissions to start recording for the specified contact.

        Access Level: Write

        https://docs.aws.amazon.com/connect/latest/APIReference/API_StartContactRecording.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toStartContactRecording", []))

    @jsii.member(jsii_name="toStartOutboundVoiceContact")
    def to_start_outbound_voice_contact(self) -> "Connect":
        '''(experimental) Grants permissions to initiate outbound calls using the Amazon Connect API.

        Access Level: Write

        https://docs.aws.amazon.com/connect/latest/APIReference/API_StartOutboundVoiceContact.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toStartOutboundVoiceContact", []))

    @jsii.member(jsii_name="toStartTaskContact")
    def to_start_task_contact(self) -> "Connect":
        '''(experimental) Grants permissions to initiate a task using the Amazon Connect API.

        Access Level: Write

        https://docs.aws.amazon.com/connect/latest/APIReference/API_StartTaskContact.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toStartTaskContact", []))

    @jsii.member(jsii_name="toStopContact")
    def to_stop_contact(self) -> "Connect":
        '''(experimental) Grants permissions to stop contacts that were initiated using the Amazon Connect API.

        If you use this operation on an active contact the contact ends, even if the agent is active on a call with a customer.

        Access Level: Write

        https://docs.aws.amazon.com/connect/latest/APIReference/API_StopContact.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toStopContact", []))

    @jsii.member(jsii_name="toStopContactRecording")
    def to_stop_contact_recording(self) -> "Connect":
        '''(experimental) Grants permissions to stop recording for the specified contact.

        Access Level: Write

        https://docs.aws.amazon.com/connect/latest/APIReference/API_StopContactRecording.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toStopContactRecording", []))

    @jsii.member(jsii_name="toSuspendContactRecording")
    def to_suspend_contact_recording(self) -> "Connect":
        '''(experimental) Grants permissions to suspend recording for the specified contact.

        Access Level: Write

        https://docs.aws.amazon.com/connect/latest/APIReference/API_SuspendContactRecording.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toSuspendContactRecording", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Connect":
        '''(experimental) Grants permissions to tag an Amazon Connect resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Connect":
        '''(experimental) Grants permissions to untag an Amazon Connect resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateContactAttributes")
    def to_update_contact_attributes(self) -> "Connect":
        '''(experimental) Grants permissions to create or update the contact attributes associated with the specified contact.

        Access Level: Write

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateContactAttributes.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateContactAttributes", []))

    @jsii.member(jsii_name="toUpdateContactFlowContent")
    def to_update_contact_flow_content(self) -> "Connect":
        '''(experimental) Grants permissions to update contact flow content in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateContactFlowContent.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateContactFlowContent", []))

    @jsii.member(jsii_name="toUpdateContactFlowName")
    def to_update_contact_flow_name(self) -> "Connect":
        '''(experimental) Grants permissions to update the name and description of a contact flow in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateContactFlowName.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateContactFlowName", []))

    @jsii.member(jsii_name="toUpdateInstanceAttribute")
    def to_update_instance_attribute(self) -> "Connect":
        '''(experimental) Grants permissions to update the attribute for an existing Amazon Connect instance.

        The associated required actions grant permission to modify the settings for the instance.

        Access Level: Write

        Possible conditions:

        - .ifAttributeType()

        Dependent actions:

        - ds:DescribeDirectories
        - iam:AttachRolePolicy
        - iam:CreateServiceLinkedRole
        - iam:PutRolePolicy
        - logs:CreateLogGroup

        https://docs.aws.amazon.com/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateInstanceAttribute", []))

    @jsii.member(jsii_name="toUpdateInstanceStorageConfig")
    def to_update_instance_storage_config(self) -> "Connect":
        '''(experimental) Grants permissions to update the storage configuration for an existing Amazon Connect instance.

        The associated required actions grant permission to modify the settings for the instance.

        Access Level: Write

        Possible conditions:

        - .ifStorageResourceType()

        Dependent actions:

        - ds:DescribeDirectories
        - firehose:DescribeDeliveryStream
        - iam:AttachRolePolicy
        - iam:CreateServiceLinkedRole
        - iam:PutRolePolicy
        - kinesis:DescribeStream
        - kms:CreateGrant
        - kms:DescribeKey
        - s3:GetBucketAcl
        - s3:GetBucketLocation

        https://docs.aws.amazon.com/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateInstanceStorageConfig", []))

    @jsii.member(jsii_name="toUpdateQueueHoursOfOperation")
    def to_update_queue_hours_of_operation(self) -> "Connect":
        '''(experimental) Grants permissions to update queue hours of operation in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateQueueHoursOfOperation.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateQueueHoursOfOperation", []))

    @jsii.member(jsii_name="toUpdateQueueMaxContacts")
    def to_update_queue_max_contacts(self) -> "Connect":
        '''(experimental) Grants permissions to update queue capacity in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateQueueMaxContacts.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateQueueMaxContacts", []))

    @jsii.member(jsii_name="toUpdateQueueName")
    def to_update_queue_name(self) -> "Connect":
        '''(experimental) Grants permissions to update a queue name and description in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateQueueName.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateQueueName", []))

    @jsii.member(jsii_name="toUpdateQueueOutboundCallerConfig")
    def to_update_queue_outbound_caller_config(self) -> "Connect":
        '''(experimental) Grants permissions to update queue outbound caller config in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateQueueOutboundCallerConfig.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateQueueOutboundCallerConfig", []))

    @jsii.member(jsii_name="toUpdateQueueStatus")
    def to_update_queue_status(self) -> "Connect":
        '''(experimental) Grants permissions to update queue status in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateQueueStatus.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateQueueStatus", []))

    @jsii.member(jsii_name="toUpdateQuickConnectConfig")
    def to_update_quick_connect_config(self) -> "Connect":
        '''(experimental) Grants permissions to update the configuration of a quick connect in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateQuickConnectConfig.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateQuickConnectConfig", []))

    @jsii.member(jsii_name="toUpdateQuickConnectName")
    def to_update_quick_connect_name(self) -> "Connect":
        '''(experimental) Grants permissions to update a quick connect name and description in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateQuickConnectName.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateQuickConnectName", []))

    @jsii.member(jsii_name="toUpdateRoutingProfileConcurrency")
    def to_update_routing_profile_concurrency(self) -> "Connect":
        '''(experimental) Grants permissions to update the concurrency in a routing profile in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateRoutingProfileConcurrency.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateRoutingProfileConcurrency", []))

    @jsii.member(jsii_name="toUpdateRoutingProfileDefaultOutboundQueue")
    def to_update_routing_profile_default_outbound_queue(self) -> "Connect":
        '''(experimental) Grants permissions to update the outbound queue in a routing profile in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateRoutingProfileDefaultOutboundQueue.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateRoutingProfileDefaultOutboundQueue", []))

    @jsii.member(jsii_name="toUpdateRoutingProfileName")
    def to_update_routing_profile_name(self) -> "Connect":
        '''(experimental) Grants permissions to update a routing profile name and description in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateRoutingProfileName.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateRoutingProfileName", []))

    @jsii.member(jsii_name="toUpdateRoutingProfileQueues")
    def to_update_routing_profile_queues(self) -> "Connect":
        '''(experimental) Grants permissions to update the queues in routing profile in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateRoutingProfileQueues.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateRoutingProfileQueues", []))

    @jsii.member(jsii_name="toUpdateUserHierarchy")
    def to_update_user_hierarchy(self) -> "Connect":
        '''(experimental) Grants permissions to update a hierarchy group for a user in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateUserHierarchy.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateUserHierarchy", []))

    @jsii.member(jsii_name="toUpdateUserHierarchyGroupName")
    def to_update_user_hierarchy_group_name(self) -> "Connect":
        '''(experimental) Grants permissions to update a user hierarchy group name in an Amazon Connect instance.

        Access Level: Write

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateUserHierarchyGroupName.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateUserHierarchyGroupName", []))

    @jsii.member(jsii_name="toUpdateUserHierarchyStructure")
    def to_update_user_hierarchy_structure(self) -> "Connect":
        '''(experimental) Grants permissions to update user hierarchy structure in an Amazon Connect instance.

        Access Level: Write

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateUserHierarchyStructure.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateUserHierarchyStructure", []))

    @jsii.member(jsii_name="toUpdateUserIdentityInfo")
    def to_update_user_identity_info(self) -> "Connect":
        '''(experimental) Grants permissions to update identity information for a user in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateUserIdentityInfo.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateUserIdentityInfo", []))

    @jsii.member(jsii_name="toUpdateUserPhoneConfig")
    def to_update_user_phone_config(self) -> "Connect":
        '''(experimental) Grants permissions to update phone configuration settings for a user in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateUserPhoneConfig.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateUserPhoneConfig", []))

    @jsii.member(jsii_name="toUpdateUserRoutingProfile")
    def to_update_user_routing_profile(self) -> "Connect":
        '''(experimental) Grants permissions to update a routing profile for a user in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateUserRoutingProfile.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateUserRoutingProfile", []))

    @jsii.member(jsii_name="toUpdateUserSecurityProfiles")
    def to_update_user_security_profiles(self) -> "Connect":
        '''(experimental) Grants permissions to update security profiles for a user in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateUserSecurityProfiles.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateUserSecurityProfiles", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Cur(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Cur"):
    '''(experimental) Statement provider for service `cur <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscostandusagereport.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `cur <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscostandusagereport.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Cur, self, [sid])

    @jsii.member(jsii_name="onCur")
    def on_cur(
        self,
        report_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cur":
        '''(experimental) Adds a resource of type cur to the statement.

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-reports.html#enhanced-reports

        :param report_name: - Identifier for the reportName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Cur", jsii.invoke(self, "onCur", [report_name, account, region, partition]))

    @jsii.member(jsii_name="toDeleteReportDefinition")
    def to_delete_report_definition(self) -> "Cur":
        '''(experimental) Delete Cost and Usage Report Definition.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/delete-report-definition.html

        :stability: experimental
        '''
        return typing.cast("Cur", jsii.invoke(self, "toDeleteReportDefinition", []))

    @jsii.member(jsii_name="toDescribeReportDefinitions")
    def to_describe_report_definitions(self) -> "Cur":
        '''(experimental) Get Cost and Usage Report Definitions.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/describe-report-definitions.html

        :stability: experimental
        '''
        return typing.cast("Cur", jsii.invoke(self, "toDescribeReportDefinitions", []))

    @jsii.member(jsii_name="toModifyReportDefinition")
    def to_modify_report_definition(self) -> "Cur":
        '''(experimental) Modify Cost and Usage Report Definition.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/modify-report-definition.html

        :stability: experimental
        '''
        return typing.cast("Cur", jsii.invoke(self, "toModifyReportDefinition", []))

    @jsii.member(jsii_name="toPutReportDefinition")
    def to_put_report_definition(self) -> "Cur":
        '''(experimental) Write Cost and Usage Report Definition.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/put-report-definition.html

        :stability: experimental
        '''
        return typing.cast("Cur", jsii.invoke(self, "toPutReportDefinition", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Databrew(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Databrew",
):
    '''(experimental) Statement provider for service `databrew <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsgluedatabrew.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `databrew <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsgluedatabrew.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Databrew, self, [sid])

    @jsii.member(jsii_name="onDataset")
    def on_dataset(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Databrew":
        '''(experimental) Adds a resource of type Dataset to the statement.

        https://docs.aws.amazon.com/databrew/latest/dg/datasets.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "onDataset", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onJob")
    def on_job(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Databrew":
        '''(experimental) Adds a resource of type Job to the statement.

        https://docs.aws.amazon.com/databrew/latest/dg/jobs.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "onJob", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onProject")
    def on_project(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Databrew":
        '''(experimental) Adds a resource of type Project to the statement.

        https://docs.aws.amazon.com/databrew/latest/dg/projects.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "onProject", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onRecipe")
    def on_recipe(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Databrew":
        '''(experimental) Adds a resource of type Recipe to the statement.

        https://docs.aws.amazon.com/databrew/latest/dg/recipes.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "onRecipe", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onSchedule")
    def on_schedule(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Databrew":
        '''(experimental) Adds a resource of type Schedule to the statement.

        https://docs.aws.amazon.com/databrew/latest/dg/jobs.html#jobs.scheduling

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "onSchedule", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toBatchDeleteRecipeVersion")
    def to_batch_delete_recipe_version(self) -> "Databrew":
        '''(experimental) Grants permission to delete one or more recipe versions.

        Access Level: Write

        https://docs.aws.amazon.com/databrew/latest/dg/API_BatchDeleteRecipeVersion.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toBatchDeleteRecipeVersion", []))

    @jsii.member(jsii_name="toCreateDataset")
    def to_create_dataset(self) -> "Databrew":
        '''(experimental) Grants permission to create a dataset.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/databrew/latest/dg/API_CreateDataset.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toCreateDataset", []))

    @jsii.member(jsii_name="toCreateProfileJob")
    def to_create_profile_job(self) -> "Databrew":
        '''(experimental) Grants permission to create a profile job.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/databrew/latest/dg/API_CreateProfileJob.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toCreateProfileJob", []))

    @jsii.member(jsii_name="toCreateProject")
    def to_create_project(self) -> "Databrew":
        '''(experimental) Grants permission to create a project.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/databrew/latest/dg/API_CreateProject.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toCreateProject", []))

    @jsii.member(jsii_name="toCreateRecipe")
    def to_create_recipe(self) -> "Databrew":
        '''(experimental) Grants permission to create a recipe.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/databrew/latest/dg/API_CreateRecipe.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toCreateRecipe", []))

    @jsii.member(jsii_name="toCreateRecipeJob")
    def to_create_recipe_job(self) -> "Databrew":
        '''(experimental) Grants permission to create a recipe job.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/databrew/latest/dg/API_CreateRecipeJob.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toCreateRecipeJob", []))

    @jsii.member(jsii_name="toCreateSchedule")
    def to_create_schedule(self) -> "Databrew":
        '''(experimental) Grants permission to create a schedule.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/databrew/latest/dg/API_CreateSchedule.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toCreateSchedule", []))

    @jsii.member(jsii_name="toDeleteDataset")
    def to_delete_dataset(self) -> "Databrew":
        '''(experimental) Grants permission to delete a dataset.

        Access Level: Write

        https://docs.aws.amazon.com/databrew/latest/dg/API_DeleteDataset.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toDeleteDataset", []))

    @jsii.member(jsii_name="toDeleteJob")
    def to_delete_job(self) -> "Databrew":
        '''(experimental) Grants permission to delete a job.

        Access Level: Write

        https://docs.aws.amazon.com/databrew/latest/dg/API_DeleteJob.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toDeleteJob", []))

    @jsii.member(jsii_name="toDeleteProject")
    def to_delete_project(self) -> "Databrew":
        '''(experimental) Grants permission to delete a project.

        Access Level: Write

        https://docs.aws.amazon.com/databrew/latest/dg/API_DeleteProject.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toDeleteProject", []))

    @jsii.member(jsii_name="toDeleteRecipeVersion")
    def to_delete_recipe_version(self) -> "Databrew":
        '''(experimental) Grants permission to delete a recipe version.

        Access Level: Write

        https://docs.aws.amazon.com/databrew/latest/dg/API_DeleteRecipeVersion.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toDeleteRecipeVersion", []))

    @jsii.member(jsii_name="toDeleteSchedule")
    def to_delete_schedule(self) -> "Databrew":
        '''(experimental) Grants permission to delete a schedule.

        Access Level: Write

        https://docs.aws.amazon.com/databrew/latest/dg/API_DeleteSchedule.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toDeleteSchedule", []))

    @jsii.member(jsii_name="toDescribeDataset")
    def to_describe_dataset(self) -> "Databrew":
        '''(experimental) Grants permission to view details about a dataset.

        Access Level: Read

        https://docs.aws.amazon.com/databrew/latest/dg/API_DescribeDataset.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toDescribeDataset", []))

    @jsii.member(jsii_name="toDescribeJob")
    def to_describe_job(self) -> "Databrew":
        '''(experimental) Grants permission to view details about a job.

        Access Level: Read

        https://docs.aws.amazon.com/databrew/latest/dg/API_DescribeJob.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toDescribeJob", []))

    @jsii.member(jsii_name="toDescribeJobRun")
    def to_describe_job_run(self) -> "Databrew":
        '''(experimental) Grants permission to view details about job run for a given job.

        Access Level: Read

        https://docs.aws.amazon.com/databrew/latest/dg/API_DescribeJobRun.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toDescribeJobRun", []))

    @jsii.member(jsii_name="toDescribeProject")
    def to_describe_project(self) -> "Databrew":
        '''(experimental) Grants permission to view details about a project.

        Access Level: Read

        https://docs.aws.amazon.com/databrew/latest/dg/API_DescribeProject.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toDescribeProject", []))

    @jsii.member(jsii_name="toDescribeRecipe")
    def to_describe_recipe(self) -> "Databrew":
        '''(experimental) Grants permission to view details about a recipe.

        Access Level: Read

        https://docs.aws.amazon.com/databrew/latest/dg/API_DescribeRecipe.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toDescribeRecipe", []))

    @jsii.member(jsii_name="toDescribeSchedule")
    def to_describe_schedule(self) -> "Databrew":
        '''(experimental) Grants permission to view details about a schedule.

        Access Level: Read

        https://docs.aws.amazon.com/databrew/latest/dg/API_DescribeSchedule.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toDescribeSchedule", []))

    @jsii.member(jsii_name="toListDatasets")
    def to_list_datasets(self) -> "Databrew":
        '''(experimental) Grants permission to list datasets in your account.

        Access Level: Read

        https://docs.aws.amazon.com/databrew/latest/dg/API_ListDatasets.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toListDatasets", []))

    @jsii.member(jsii_name="toListJobRuns")
    def to_list_job_runs(self) -> "Databrew":
        '''(experimental) Grants permission to list job runs for a given job.

        Access Level: Read

        https://docs.aws.amazon.com/databrew/latest/dg/API_ListJobRuns.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toListJobRuns", []))

    @jsii.member(jsii_name="toListJobs")
    def to_list_jobs(self) -> "Databrew":
        '''(experimental) Grants permission to list jobs in your account.

        Access Level: Read

        https://docs.aws.amazon.com/databrew/latest/dg/API_ListJobs.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toListJobs", []))

    @jsii.member(jsii_name="toListProjects")
    def to_list_projects(self) -> "Databrew":
        '''(experimental) Grants permission to list projects in your account.

        Access Level: Read

        https://docs.aws.amazon.com/databrew/latest/dg/API_ListProjects.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toListProjects", []))

    @jsii.member(jsii_name="toListRecipes")
    def to_list_recipes(self) -> "Databrew":
        '''(experimental) Grants permission to list recipes in your account.

        Access Level: Read

        https://docs.aws.amazon.com/databrew/latest/dg/API_ListRecipes.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toListRecipes", []))

    @jsii.member(jsii_name="toListRecipeVersions")
    def to_list_recipe_versions(self) -> "Databrew":
        '''(experimental) Grants permission to list versions in your recipe.

        Access Level: Read

        https://docs.aws.amazon.com/databrew/latest/dg/API_ListRecipeVersions.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toListRecipeVersions", []))

    @jsii.member(jsii_name="toListSchedules")
    def to_list_schedules(self) -> "Databrew":
        '''(experimental) Grants permission to list schedules in your account.

        Access Level: Read

        https://docs.aws.amazon.com/databrew/latest/dg/API_ListSchedules.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toListSchedules", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Databrew":
        '''(experimental) Grants permission to retrieve tags associated with a resource.

        Access Level: Read

        https://docs.aws.amazon.com/databrew/latest/dg/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPublishRecipe")
    def to_publish_recipe(self) -> "Databrew":
        '''(experimental) Grants permission to publish a major verison of a recipe.

        Access Level: Write

        https://docs.aws.amazon.com/databrew/latest/dg/API_PublishRecipe.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toPublishRecipe", []))

    @jsii.member(jsii_name="toSendProjectSessionAction")
    def to_send_project_session_action(self) -> "Databrew":
        '''(experimental) Grants permission to submit an action to the interactive session for a project.

        Access Level: Write

        https://docs.aws.amazon.com/databrew/latest/dg/API_SendProjectSessionAction.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toSendProjectSessionAction", []))

    @jsii.member(jsii_name="toStartJobRun")
    def to_start_job_run(self) -> "Databrew":
        '''(experimental) Grants permission to start running a job.

        Access Level: Write

        https://docs.aws.amazon.com/databrew/latest/dg/API_StartJobRun.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toStartJobRun", []))

    @jsii.member(jsii_name="toStartProjectSession")
    def to_start_project_session(self) -> "Databrew":
        '''(experimental) Grants permission to start an interactive session for a project.

        Access Level: Write

        https://docs.aws.amazon.com/databrew/latest/dg/API_StartProjectSession.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toStartProjectSession", []))

    @jsii.member(jsii_name="toStopJobRun")
    def to_stop_job_run(self) -> "Databrew":
        '''(experimental) Grants permission to stop a job run for a job.

        Access Level: Write

        https://docs.aws.amazon.com/databrew/latest/dg/API_StopJobRun.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toStopJobRun", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Databrew":
        '''(experimental) Grants permission to add tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/databrew/latest/dg/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Databrew":
        '''(experimental) Grants permission to remove tags associated with a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/databrew/latest/dg/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateDataset")
    def to_update_dataset(self) -> "Databrew":
        '''(experimental) Grants permission to modify a dataset.

        Access Level: Write

        https://docs.aws.amazon.com/databrew/latest/dg/API_UpdateDataset.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toUpdateDataset", []))

    @jsii.member(jsii_name="toUpdateProfileJob")
    def to_update_profile_job(self) -> "Databrew":
        '''(experimental) Grants permission to modify a profile job.

        Access Level: Write

        https://docs.aws.amazon.com/databrew/latest/dg/API_UpdateProfileJob.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toUpdateProfileJob", []))

    @jsii.member(jsii_name="toUpdateProject")
    def to_update_project(self) -> "Databrew":
        '''(experimental) Grants permission to modify a project.

        Access Level: Write

        https://docs.aws.amazon.com/databrew/latest/dg/API_UpdateProject.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toUpdateProject", []))

    @jsii.member(jsii_name="toUpdateRecipe")
    def to_update_recipe(self) -> "Databrew":
        '''(experimental) Grants permission to modify a recipe.

        Access Level: Write

        https://docs.aws.amazon.com/databrew/latest/dg/API_UpdateRecipe.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toUpdateRecipe", []))

    @jsii.member(jsii_name="toUpdateRecipeJob")
    def to_update_recipe_job(self) -> "Databrew":
        '''(experimental) Grants permission to modify a recipe job.

        Access Level: Write

        https://docs.aws.amazon.com/databrew/latest/dg/API_UpdateRecipeJob.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toUpdateRecipeJob", []))

    @jsii.member(jsii_name="toUpdateSchedule")
    def to_update_schedule(self) -> "Databrew":
        '''(experimental) Grants permission to modify a schedule.

        Access Level: Write

        https://docs.aws.amazon.com/databrew/latest/dg/API_UpdateSchedule.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toUpdateSchedule", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Dataexchange(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Dataexchange",
):
    '''(experimental) Statement provider for service `dataexchange <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdataexchange.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `dataexchange <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdataexchange.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Dataexchange, self, [sid])

    @jsii.member(jsii_name="ifJobType")
    def if_job_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Dataexchange":
        '''(experimental) Indicates that the action can only be performed on the specified job type.

        https://docs.aws.amazon.com/data-exchange/latest/userguide/access-control.html

        Applies to resource types:

        - jobs

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "ifJobType", [value, operator]))

    @jsii.member(jsii_name="onAssets")
    def on_assets(
        self,
        data_set_id: builtins.str,
        revision_id: builtins.str,
        asset_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dataexchange":
        '''(experimental) Adds a resource of type assets to the statement.

        https://docs.aws.amazon.com/data-exchange/latest/userguide/data-sets.html#assets

        :param data_set_id: - Identifier for the dataSetId.
        :param revision_id: - Identifier for the revisionId.
        :param asset_id: - Identifier for the assetId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "onAssets", [data_set_id, revision_id, asset_id, account, region, partition]))

    @jsii.member(jsii_name="onDataSets")
    def on_data_sets(
        self,
        data_set_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dataexchange":
        '''(experimental) Adds a resource of type data-sets to the statement.

        https://docs.aws.amazon.com/data-exchange/latest/userguide/data-sets.html

        :param data_set_id: - Identifier for the dataSetId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "onDataSets", [data_set_id, account, region, partition]))

    @jsii.member(jsii_name="onJobs")
    def on_jobs(
        self,
        job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dataexchange":
        '''(experimental) Adds a resource of type jobs to the statement.

        https://docs.aws.amazon.com/data-exchange/latest/userguide/jobs.html

        :param job_id: - Identifier for the jobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifJobType()

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "onJobs", [job_id, account, region, partition]))

    @jsii.member(jsii_name="onRevisions")
    def on_revisions(
        self,
        data_set_id: builtins.str,
        revision_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dataexchange":
        '''(experimental) Adds a resource of type revisions to the statement.

        https://docs.aws.amazon.com/data-exchange/latest/userguide/data-sets.html#revisions

        :param data_set_id: - Identifier for the dataSetId.
        :param revision_id: - Identifier for the revisionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "onRevisions", [data_set_id, revision_id, account, region, partition]))

    @jsii.member(jsii_name="toCancelJob")
    def to_cancel_job(self) -> "Dataexchange":
        '''(experimental) Grants permissions to cancel a job.

        Access Level: Write

        https://docs.aws.amazon.com/data-exchange/latest/apireference/v1-jobs.html#CancelJob

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toCancelJob", []))

    @jsii.member(jsii_name="toCreateAsset")
    def to_create_asset(self) -> "Dataexchange":
        '''(experimental) Grants permission to create an asset (for example, in a Job).

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/data-exchange/latest/apireference/v1-data-sets-datasetid-revisions.html#CreateAsset

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toCreateAsset", []))

    @jsii.member(jsii_name="toCreateDataSet")
    def to_create_data_set(self) -> "Dataexchange":
        '''(experimental) Grants permission to create a data set.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/data-exchange/latest/apireference/v1-data-sets.html#CreateDataSet

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toCreateDataSet", []))

    @jsii.member(jsii_name="toCreateJob")
    def to_create_job(self) -> "Dataexchange":
        '''(experimental) Grants permissions to create a job to import or export assets.

        Access Level: Write

        https://docs.aws.amazon.com/data-exchange/latest/apireference/v1-jobs.html#CreateJob

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toCreateJob", []))

    @jsii.member(jsii_name="toCreateRevision")
    def to_create_revision(self) -> "Dataexchange":
        '''(experimental) Grants permission to create a revision.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/data-exchange/latest/apireference/v1-data-sets-datasetid-revisions.html#CreateRevision

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toCreateRevision", []))

    @jsii.member(jsii_name="toDeleteAsset")
    def to_delete_asset(self) -> "Dataexchange":
        '''(experimental) Grants permissions to delete an asset.

        Access Level: Write

        https://docs.aws.amazon.com/data-exchange/latest/apireference/v1-data-sets-datasetid-revisions-revisionid-assets-assetid.html#DeleteAsset

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toDeleteAsset", []))

    @jsii.member(jsii_name="toDeleteDataSet")
    def to_delete_data_set(self) -> "Dataexchange":
        '''(experimental) Grants permissions to delete a data set.

        Access Level: Write

        https://docs.aws.amazon.com/data-exchange/latest/apireference/v1-data-sets-datasetid.html#DeleteDataSet

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toDeleteDataSet", []))

    @jsii.member(jsii_name="toDeleteRevision")
    def to_delete_revision(self) -> "Dataexchange":
        '''(experimental) Grants permissions to delete a revision.

        Access Level: Write

        https://docs.aws.amazon.com/data-exchange/latest/apireference/v1-data-sets-datasetid-revisions-revisionid.html#DeleteRevision

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toDeleteRevision", []))

    @jsii.member(jsii_name="toGetAsset")
    def to_get_asset(self) -> "Dataexchange":
        '''(experimental) Grants permissions to get information about an asset and to export it (for example, in a Job).

        Access Level: Read

        https://docs.aws.amazon.com/data-exchange/latest/apireference/v1-data-sets-datasetid-revisions-revisionid-assets-assetid.html#GetAsset

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toGetAsset", []))

    @jsii.member(jsii_name="toGetDataSet")
    def to_get_data_set(self) -> "Dataexchange":
        '''(experimental) Grants permission to get information about a data set.

        Access Level: Read

        https://docs.aws.amazon.com/data-exchange/latest/apireference/v1-data-sets-datasetid.html#GetDataSet

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toGetDataSet", []))

    @jsii.member(jsii_name="toGetJob")
    def to_get_job(self) -> "Dataexchange":
        '''(experimental) Grants permissions to get information about a job.

        Access Level: Read

        https://docs.aws.amazon.com/data-exchange/latest/apireference/v1-jobs.html#GetJob

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toGetJob", []))

    @jsii.member(jsii_name="toGetRevision")
    def to_get_revision(self) -> "Dataexchange":
        '''(experimental) Grants permission to get information about a revision.

        Access Level: Read

        https://docs.aws.amazon.com/data-exchange/latest/apireference/v1-data-sets-datasetid-revisions-revisionid.html#GetRevision

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toGetRevision", []))

    @jsii.member(jsii_name="toListDataSetRevisions")
    def to_list_data_set_revisions(self) -> "Dataexchange":
        '''(experimental) Grants permissions to list the revisions of a data set.

        Access Level: List

        https://docs.aws.amazon.com/data-exchange/latest/apireference/v1-data-sets-datasetid-revisions.html#ListDataSetRevisions

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toListDataSetRevisions", []))

    @jsii.member(jsii_name="toListDataSets")
    def to_list_data_sets(self) -> "Dataexchange":
        '''(experimental) Grants permission to list data sets for the account.

        Access Level: List

        https://docs.aws.amazon.com/data-exchange/latest/apireference/v1-data-sets.html#ListDataSets

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toListDataSets", []))

    @jsii.member(jsii_name="toListJobs")
    def to_list_jobs(self) -> "Dataexchange":
        '''(experimental) Grants permissions to list jobs for the account.

        Access Level: List

        https://docs.aws.amazon.com/data-exchange/latest/apireference/v1-jobs.html#ListJobs

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toListJobs", []))

    @jsii.member(jsii_name="toListRevisionAssets")
    def to_list_revision_assets(self) -> "Dataexchange":
        '''(experimental) Grants permissions to get list the assets of a revision.

        Access Level: List

        https://docs.aws.amazon.com/data-exchange/latest/apireference/v1-data-sets-datasetid-revisions-revisionid-assets.html#ListRevisionAssets

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toListRevisionAssets", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Dataexchange":
        '''(experimental) Grants permission to list the tags that you associated with the specified resource.

        Access Level: Read

        https://docs.aws.amazon.com/data-exchange/latest/apireference/tags-resource-arn.html#ListTagsForResource

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toStartJob")
    def to_start_job(self) -> "Dataexchange":
        '''(experimental) Grants permissions to start a job.

        Access Level: Write

        https://docs.aws.amazon.com/data-exchange/latest/apireference/v1-jobs.html#StartJob

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toStartJob", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Dataexchange":
        '''(experimental) Grants permission to add one or more tags to a specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/data-exchange/latest/apireference/tags-resource-arn.html#TagResource

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Dataexchange":
        '''(experimental) Grants permission to remove one or more tags from a specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/data-exchange/latest/apireference/tags-resource-arn.html#UntagResource

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAsset")
    def to_update_asset(self) -> "Dataexchange":
        '''(experimental) Grants permissions to get update information about an asset.

        Access Level: Write

        https://docs.aws.amazon.com/data-exchange/latest/apireference/v1-data-sets-datasetid-revisions-revisionid-assets-assetid.html#UpdateAsset

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toUpdateAsset", []))

    @jsii.member(jsii_name="toUpdateDataSet")
    def to_update_data_set(self) -> "Dataexchange":
        '''(experimental) Grants permissions to update information about a data set.

        Access Level: Write

        https://docs.aws.amazon.com/data-exchange/latest/apireference/v1-data-sets-datasetid.html#UpdateDataSet

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toUpdateDataSet", []))

    @jsii.member(jsii_name="toUpdateRevision")
    def to_update_revision(self) -> "Dataexchange":
        '''(experimental) Grants permissions to update information about a revision.

        Access Level: Write

        https://docs.aws.amazon.com/data-exchange/latest/apireference/v1-data-sets-datasetid-revisions-revisionid.html#UpdateRevision

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toUpdateRevision", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Datapipeline(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Datapipeline",
):
    '''(experimental) Statement provider for service `datapipeline <https://docs.aws.amazon.com/service-authorization/latest/reference/list_datapipeline.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `datapipeline <https://docs.aws.amazon.com/service-authorization/latest/reference/list_datapipeline.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Datapipeline, self, [sid])

    @jsii.member(jsii_name="ifPipelineCreator")
    def if_pipeline_creator(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Datapipeline":
        '''(experimental) The IAM user that created the pipeline.

        https://docs.aws.amazon.com/datapipeline/latest/DeveloperGuide/dp-example-tag-policies.html#ex3

        Applies to actions:

        - .toActivatePipeline()
        - .toAddTags()
        - .toDeactivatePipeline()
        - .toDeletePipeline()
        - .toDescribeObjects()
        - .toDescribePipelines()
        - .toEvaluateExpression()
        - .toGetPipelineDefinition()
        - .toPutPipelineDefinition()
        - .toQueryObjects()
        - .toRemoveTags()
        - .toSetStatus()
        - .toValidatePipelineDefinition()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "ifPipelineCreator", [value, operator]))

    @jsii.member(jsii_name="ifTag")
    def if_tag(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Datapipeline":
        '''(experimental) A customer-specified key/value pair that can be attached to a resource.

        https://docs.aws.amazon.com/datapipeline/latest/DeveloperGuide/dp-iam-resourcebased-access.html#dp-control-access-tags

        Applies to actions:

        - .toActivatePipeline()
        - .toAddTags()
        - .toCreatePipeline()
        - .toDeactivatePipeline()
        - .toDeletePipeline()
        - .toDescribeObjects()
        - .toDescribePipelines()
        - .toEvaluateExpression()
        - .toGetPipelineDefinition()
        - .toPutPipelineDefinition()
        - .toQueryObjects()
        - .toRemoveTags()
        - .toSetStatus()
        - .toValidatePipelineDefinition()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "ifTag", [value, operator]))

    @jsii.member(jsii_name="ifWorkerGroup")
    def if_worker_group(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Datapipeline":
        '''(experimental) The name of a worker group for which a Task Runner retrieves work.

        https://docs.aws.amazon.com/datapipeline/latest/DeveloperGuide/dp-iam-resourcebased-access.html#dp-control-access-workergroup

        Applies to actions:

        - .toActivatePipeline()
        - .toDeactivatePipeline()
        - .toGetPipelineDefinition()
        - .toPollForTask()
        - .toPutPipelineDefinition()
        - .toValidatePipelineDefinition()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "ifWorkerGroup", [value, operator]))

    @jsii.member(jsii_name="toActivatePipeline")
    def to_activate_pipeline(self) -> "Datapipeline":
        '''(experimental) Validates the specified pipeline and starts processing pipeline tasks. If the pipeline does not pass validation, activation fails.

        Access Level: Write

        Possible conditions:

        - .ifPipelineCreator()
        - .ifTag()
        - .ifWorkerGroup()

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_ActivatePipeline.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toActivatePipeline", []))

    @jsii.member(jsii_name="toAddTags")
    def to_add_tags(self) -> "Datapipeline":
        '''(experimental) Adds or modifies tags for the specified pipeline.

        Access Level: Tagging

        Possible conditions:

        - .ifPipelineCreator()
        - .ifTag()

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_AddTags.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toAddTags", []))

    @jsii.member(jsii_name="toCreatePipeline")
    def to_create_pipeline(self) -> "Datapipeline":
        '''(experimental) Creates a new, empty pipeline.

        Access Level: Write

        Possible conditions:

        - .ifTag()

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_CreatePipeline.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toCreatePipeline", []))

    @jsii.member(jsii_name="toDeactivatePipeline")
    def to_deactivate_pipeline(self) -> "Datapipeline":
        '''(experimental) Deactivates the specified running pipeline.

        Access Level: Write

        Possible conditions:

        - .ifPipelineCreator()
        - .ifTag()
        - .ifWorkerGroup()

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_DeactivatePipeline.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toDeactivatePipeline", []))

    @jsii.member(jsii_name="toDeletePipeline")
    def to_delete_pipeline(self) -> "Datapipeline":
        '''(experimental) Deletes a pipeline, its pipeline definition, and its run history.

        Access Level: Write

        Possible conditions:

        - .ifPipelineCreator()
        - .ifTag()

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_DeletePipeline.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toDeletePipeline", []))

    @jsii.member(jsii_name="toDescribeObjects")
    def to_describe_objects(self) -> "Datapipeline":
        '''(experimental) Gets the object definitions for a set of objects associated with the pipeline.

        Access Level: Read

        Possible conditions:

        - .ifPipelineCreator()
        - .ifTag()

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_DescribeObjects.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toDescribeObjects", []))

    @jsii.member(jsii_name="toDescribePipelines")
    def to_describe_pipelines(self) -> "Datapipeline":
        '''(experimental) Retrieves metadata about one or more pipelines.

        Access Level: List

        Possible conditions:

        - .ifPipelineCreator()
        - .ifTag()

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_DescribePipelines.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toDescribePipelines", []))

    @jsii.member(jsii_name="toEvaluateExpression")
    def to_evaluate_expression(self) -> "Datapipeline":
        '''(experimental) Task runners call EvaluateExpression to evaluate a string in the context of the specified object.

        Access Level: Read

        Possible conditions:

        - .ifPipelineCreator()
        - .ifTag()

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_EvaluateExpression.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toEvaluateExpression", []))

    @jsii.member(jsii_name="toGetAccountLimits")
    def to_get_account_limits(self) -> "Datapipeline":
        '''(experimental) Description for GetAccountLimits.

        Access Level: List

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_GetAccountLimits.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toGetAccountLimits", []))

    @jsii.member(jsii_name="toGetPipelineDefinition")
    def to_get_pipeline_definition(self) -> "Datapipeline":
        '''(experimental) Gets the definition of the specified pipeline.

        Access Level: Read

        Possible conditions:

        - .ifPipelineCreator()
        - .ifTag()
        - .ifWorkerGroup()

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_GetPipelineDefinition.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toGetPipelineDefinition", []))

    @jsii.member(jsii_name="toListPipelines")
    def to_list_pipelines(self) -> "Datapipeline":
        '''(experimental) Lists the pipeline identifiers for all active pipelines that you have permission to access.

        Access Level: List

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_ListPipelines.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toListPipelines", []))

    @jsii.member(jsii_name="toPollForTask")
    def to_poll_for_task(self) -> "Datapipeline":
        '''(experimental) Task runners call PollForTask to receive a task to perform from AWS Data Pipeline.

        Access Level: Write

        Possible conditions:

        - .ifWorkerGroup()

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_PollForTask.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toPollForTask", []))

    @jsii.member(jsii_name="toPutAccountLimits")
    def to_put_account_limits(self) -> "Datapipeline":
        '''(experimental) Description for PutAccountLimits.

        Access Level: Write

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_PutAccountLimits.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toPutAccountLimits", []))

    @jsii.member(jsii_name="toPutPipelineDefinition")
    def to_put_pipeline_definition(self) -> "Datapipeline":
        '''(experimental) Adds tasks, schedules, and preconditions to the specified pipeline.

        Access Level: Write

        Possible conditions:

        - .ifPipelineCreator()
        - .ifTag()
        - .ifWorkerGroup()

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_PutPipelineDefinition.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toPutPipelineDefinition", []))

    @jsii.member(jsii_name="toQueryObjects")
    def to_query_objects(self) -> "Datapipeline":
        '''(experimental) Queries the specified pipeline for the names of objects that match the specified set of conditions.

        Access Level: Read

        Possible conditions:

        - .ifPipelineCreator()
        - .ifTag()

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_QueryObjects.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toQueryObjects", []))

    @jsii.member(jsii_name="toRemoveTags")
    def to_remove_tags(self) -> "Datapipeline":
        '''(experimental) Removes existing tags from the specified pipeline.

        Access Level: Tagging

        Possible conditions:

        - .ifPipelineCreator()
        - .ifTag()

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_RemoveTags.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toRemoveTags", []))

    @jsii.member(jsii_name="toReportTaskProgress")
    def to_report_task_progress(self) -> "Datapipeline":
        '''(experimental) Task runners call ReportTaskProgress when assigned a task to acknowledge that it has the task.

        Access Level: Write

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_ReportTaskProgress.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toReportTaskProgress", []))

    @jsii.member(jsii_name="toReportTaskRunnerHeartbeat")
    def to_report_task_runner_heartbeat(self) -> "Datapipeline":
        '''(experimental) Task runners call ReportTaskRunnerHeartbeat every 15 minutes to indicate that they are operational.

        Access Level: Write

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_ReportTaskRunnerHeartbeat.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toReportTaskRunnerHeartbeat", []))

    @jsii.member(jsii_name="toSetStatus")
    def to_set_status(self) -> "Datapipeline":
        '''(experimental) Requests that the status of the specified physical or logical pipeline objects be updated in the specified pipeline.

        Access Level: Write

        Possible conditions:

        - .ifPipelineCreator()
        - .ifTag()

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_SetStatus.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toSetStatus", []))

    @jsii.member(jsii_name="toSetTaskStatus")
    def to_set_task_status(self) -> "Datapipeline":
        '''(experimental) Task runners call SetTaskStatus to notify AWS Data Pipeline that a task is completed and provide information about the final status.

        Access Level: Write

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_SetTaskStatus.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toSetTaskStatus", []))

    @jsii.member(jsii_name="toValidatePipelineDefinition")
    def to_validate_pipeline_definition(self) -> "Datapipeline":
        '''(experimental) Validates the specified pipeline definition to ensure that it is well formed and can be run without error.

        Access Level: Read

        Possible conditions:

        - .ifPipelineCreator()
        - .ifTag()
        - .ifWorkerGroup()

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_ValidatePipelineDefinition.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toValidatePipelineDefinition", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Datasync(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Datasync",
):
    '''(experimental) Statement provider for service `datasync <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdatasync.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `datasync <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdatasync.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Datasync, self, [sid])

    @jsii.member(jsii_name="onAgent")
    def on_agent(
        self,
        agent_id: builtins.str,
        account_id: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Datasync":
        '''(experimental) Adds a resource of type agent to the statement.

        https://docs.aws.amazon.com/datasync/latest/userguide/agent.html

        :param agent_id: - Identifier for the agentId.
        :param account_id: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "onAgent", [agent_id, account_id, region, partition]))

    @jsii.member(jsii_name="onLocation")
    def on_location(
        self,
        location_id: builtins.str,
        account_id: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Datasync":
        '''(experimental) Adds a resource of type location to the statement.

        https://docs.aws.amazon.com/datasync/latest/userguide/location.html

        :param location_id: - Identifier for the locationId.
        :param account_id: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "onLocation", [location_id, account_id, region, partition]))

    @jsii.member(jsii_name="onTask")
    def on_task(
        self,
        task_id: builtins.str,
        account_id: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Datasync":
        '''(experimental) Adds a resource of type task to the statement.

        https://docs.aws.amazon.com/datasync/latest/userguide/task.html

        :param task_id: - Identifier for the taskId.
        :param account_id: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "onTask", [task_id, account_id, region, partition]))

    @jsii.member(jsii_name="onTaskexecution")
    def on_taskexecution(
        self,
        task_id: builtins.str,
        execution_id: builtins.str,
        account_id: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Datasync":
        '''(experimental) Adds a resource of type taskexecution to the statement.

        https://docs.aws.amazon.com/datasync/latest/userguide/taskexecution.html

        :param task_id: - Identifier for the taskId.
        :param execution_id: - Identifier for the executionId.
        :param account_id: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "onTaskexecution", [task_id, execution_id, account_id, region, partition]))

    @jsii.member(jsii_name="toCancelTaskExecution")
    def to_cancel_task_execution(self) -> "Datasync":
        '''(experimental) Grants permission to cancel execution of a sync task.

        Access Level: Write

        https://docs.aws.amazon.com/datasync/latest/userguide/API_CancelTaskExecution.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toCancelTaskExecution", []))

    @jsii.member(jsii_name="toCreateAgent")
    def to_create_agent(self) -> "Datasync":
        '''(experimental) Grants permission to activate an agent that you have deployed on your host.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/datasync/latest/userguide/API_CreateAgent.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toCreateAgent", []))

    @jsii.member(jsii_name="toCreateLocationEfs")
    def to_create_location_efs(self) -> "Datasync":
        '''(experimental) Grants permission to create an endpoint for an Amazon EFS file system.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/datasync/latest/userguide/API_CreateLocationEfs.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toCreateLocationEfs", []))

    @jsii.member(jsii_name="toCreateLocationFsxWindows")
    def to_create_location_fsx_windows(self) -> "Datasync":
        '''(experimental) Grants permission to create an endpoint for an Amazon FSx Windows File Server file system.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/datasync/latest/userguide/API_CreateLocationFsxWindows.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toCreateLocationFsxWindows", []))

    @jsii.member(jsii_name="toCreateLocationNfs")
    def to_create_location_nfs(self) -> "Datasync":
        '''(experimental) Grants permission to create an endpoint for a NFS file system.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/datasync/latest/userguide/API_CreateLocationNfs.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toCreateLocationNfs", []))

    @jsii.member(jsii_name="toCreateLocationObjectStorage")
    def to_create_location_object_storage(self) -> "Datasync":
        '''(experimental) Grants permission to create an endpoint for a self-managed object storage bucket.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/datasync/latest/userguide/API_CreateLocationObjectStorage.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toCreateLocationObjectStorage", []))

    @jsii.member(jsii_name="toCreateLocationS3")
    def to_create_location_s3(self) -> "Datasync":
        '''(experimental) Grants permission to create an endpoint for an Amazon S3 bucket.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/datasync/latest/userguide/API_CreateLocationS3.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toCreateLocationS3", []))

    @jsii.member(jsii_name="toCreateLocationSmb")
    def to_create_location_smb(self) -> "Datasync":
        '''(experimental) Grants permission to create an endpoint for an SMB file system.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/datasync/latest/userguide/API_CreateLocationSmb.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toCreateLocationSmb", []))

    @jsii.member(jsii_name="toCreateTask")
    def to_create_task(self) -> "Datasync":
        '''(experimental) Grants permission to create a sync task.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/datasync/latest/userguide/API_CreateTask.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toCreateTask", []))

    @jsii.member(jsii_name="toDeleteAgent")
    def to_delete_agent(self) -> "Datasync":
        '''(experimental) Grants permission to delete an agent.

        Access Level: Write

        https://docs.aws.amazon.com/datasync/latest/userguide/API_DeleteAgent.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toDeleteAgent", []))

    @jsii.member(jsii_name="toDeleteLocation")
    def to_delete_location(self) -> "Datasync":
        '''(experimental) Grants permission to delete a location used by AWS DataSync.

        Access Level: Write

        https://docs.aws.amazon.com/datasync/latest/userguide/API_DeleteLocation.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toDeleteLocation", []))

    @jsii.member(jsii_name="toDeleteTask")
    def to_delete_task(self) -> "Datasync":
        '''(experimental) Grants permission to delete a sync task.

        Access Level: Write

        https://docs.aws.amazon.com/datasync/latest/userguide/API_DeleteTask.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toDeleteTask", []))

    @jsii.member(jsii_name="toDescribeAgent")
    def to_describe_agent(self) -> "Datasync":
        '''(experimental) Grants permission to view metadata such as name, network interfaces, and the status (that is, whether the agent is running or not) about a sync agent.

        Access Level: Read

        https://docs.aws.amazon.com/datasync/latest/userguide/API_DescribeAgent.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toDescribeAgent", []))

    @jsii.member(jsii_name="toDescribeLocationEfs")
    def to_describe_location_efs(self) -> "Datasync":
        '''(experimental) Grants permission to view metadata, such as the path information about an Amazon EFS sync location.

        Access Level: Read

        https://docs.aws.amazon.com/datasync/latest/userguide/API_DescribeLocationEfs.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toDescribeLocationEfs", []))

    @jsii.member(jsii_name="toDescribeLocationFsxWindows")
    def to_describe_location_fsx_windows(self) -> "Datasync":
        '''(experimental) Grants permission to view metadata, such as the path information about an Amazon FSx Windows sync location.

        Access Level: Read

        https://docs.aws.amazon.com/datasync/latest/userguide/API_DescribeLocationFsxWindows.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toDescribeLocationFsxWindows", []))

    @jsii.member(jsii_name="toDescribeLocationNfs")
    def to_describe_location_nfs(self) -> "Datasync":
        '''(experimental) Grants permission to view metadata, such as the path information, about a NFS sync location.

        Access Level: Read

        https://docs.aws.amazon.com/datasync/latest/userguide/API_DescribeLocationNfs.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toDescribeLocationNfs", []))

    @jsii.member(jsii_name="toDescribeLocationObjectStorage")
    def to_describe_location_object_storage(self) -> "Datasync":
        '''(experimental) Grants permission to view metadata about a self-managed object storage server location.

        Access Level: Read

        https://docs.aws.amazon.com/datasync/latest/userguide/API_DescribeLocationObjectStorage.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toDescribeLocationObjectStorage", []))

    @jsii.member(jsii_name="toDescribeLocationS3")
    def to_describe_location_s3(self) -> "Datasync":
        '''(experimental) Grants permission to view metadata, such as bucket name, about an Amazon S3 bucket sync location.

        Access Level: Read

        https://docs.aws.amazon.com/datasync/latest/userguide/API_DescribeLocationS3.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toDescribeLocationS3", []))

    @jsii.member(jsii_name="toDescribeLocationSmb")
    def to_describe_location_smb(self) -> "Datasync":
        '''(experimental) Grants permission to view metadata, such as the path information, about an SMB sync location.

        Access Level: Read

        https://docs.aws.amazon.com/datasync/latest/userguide/API_DescribeLocationSmb.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toDescribeLocationSmb", []))

    @jsii.member(jsii_name="toDescribeTask")
    def to_describe_task(self) -> "Datasync":
        '''(experimental) Grants permission to view metadata about a sync task.

        Access Level: Read

        https://docs.aws.amazon.com/datasync/latest/userguide/API_DescribeTask.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toDescribeTask", []))

    @jsii.member(jsii_name="toDescribeTaskExecution")
    def to_describe_task_execution(self) -> "Datasync":
        '''(experimental) Grants permission to view metadata about a sync task that is being executed.

        Access Level: Read

        https://docs.aws.amazon.com/datasync/latest/userguide/API_DescribeTaskExecution.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toDescribeTaskExecution", []))

    @jsii.member(jsii_name="toListAgents")
    def to_list_agents(self) -> "Datasync":
        '''(experimental) Grants permission to list agents owned by an AWS account in a region specified in the request.

        Access Level: List

        https://docs.aws.amazon.com/datasync/latest/userguide/API_ListAgents.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toListAgents", []))

    @jsii.member(jsii_name="toListLocations")
    def to_list_locations(self) -> "Datasync":
        '''(experimental) Grants permission to list source and destination sync locations.

        Access Level: List

        https://docs.aws.amazon.com/datasync/latest/userguide/API_ListLocations.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toListLocations", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Datasync":
        '''(experimental) Grants permission to list tags that have been added to the specified resource.

        Access Level: Read

        https://docs.aws.amazon.com/datasync/latest/userguide/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTaskExecutions")
    def to_list_task_executions(self) -> "Datasync":
        '''(experimental) Grants permission to list executed sync tasks.

        Access Level: List

        https://docs.aws.amazon.com/datasync/latest/userguide/API_ListTaskExecutions.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toListTaskExecutions", []))

    @jsii.member(jsii_name="toListTasks")
    def to_list_tasks(self) -> "Datasync":
        '''(experimental) Grants permission to list of all the sync tasks.

        Access Level: List

        https://docs.aws.amazon.com/datasync/latest/userguide/API_ListTasks.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toListTasks", []))

    @jsii.member(jsii_name="toStartTaskExecution")
    def to_start_task_execution(self) -> "Datasync":
        '''(experimental) Grants permission to start a specific invocation of a sync task.

        Access Level: Write

        https://docs.aws.amazon.com/datasync/latest/userguide/API_StartTaskExecution.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toStartTaskExecution", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Datasync":
        '''(experimental) Grants permission to apply a key-value pair to an AWS resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/datasync/latest/userguide/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Datasync":
        '''(experimental) Grants permission to remove one or more tags from the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/datasync/latest/userguide/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAgent")
    def to_update_agent(self) -> "Datasync":
        '''(experimental) Grants permission to update the name of an agent.

        Access Level: Write

        https://docs.aws.amazon.com/datasync/latest/userguide/API_UpdateAgent.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toUpdateAgent", []))

    @jsii.member(jsii_name="toUpdateTask")
    def to_update_task(self) -> "Datasync":
        '''(experimental) Grants permission to update metadata associated with a sync task.

        Access Level: Write

        https://docs.aws.amazon.com/datasync/latest/userguide/API_UpdateTask.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toUpdateTask", []))

    @jsii.member(jsii_name="toUpdateTaskExecution")
    def to_update_task_execution(self) -> "Datasync":
        '''(experimental) Grants permission to update execution of a sync task.

        Access Level: Write

        https://docs.aws.amazon.com/datasync/latest/userguide/API_UpdateTaskExecution.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toUpdateTaskExecution", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Dax(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Dax"):
    '''(experimental) Statement provider for service `dax <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazondynamodbacceleratordax.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `dax <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazondynamodbacceleratordax.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Dax, self, [sid])

    @jsii.member(jsii_name="ifEnclosingOperation")
    def if_enclosing_operation(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Dax":
        '''(experimental) Used to block Transactions APIs calls and allow the non-Transaction APIs calls and vice-versa.

        Applies to actions:

        - .toDeleteItem()
        - .toGetItem()
        - .toPutItem()
        - .toUpdateItem()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "ifEnclosingOperation", [value, operator]))

    @jsii.member(jsii_name="onApplication")
    def on_application(
        self,
        cluster_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dax":
        '''(experimental) Adds a resource of type application to the statement.

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DAX.access-control.html

        :param cluster_name: - Identifier for the clusterName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "onApplication", [cluster_name, account, region, partition]))

    @jsii.member(jsii_name="toBatchGetItem")
    def to_batch_get_item(self) -> "Dax":
        '''(experimental) The BatchGetItem action returns the attributes of one or more items from one or more tables.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_BatchGetItem.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toBatchGetItem", []))

    @jsii.member(jsii_name="toBatchWriteItem")
    def to_batch_write_item(self) -> "Dax":
        '''(experimental) The BatchWriteItem action operation puts or deletes multiple items in one or more tables.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_BatchWriteItem.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toBatchWriteItem", []))

    @jsii.member(jsii_name="toConditionCheckItem")
    def to_condition_check_item(self) -> "Dax":
        '''(experimental) The ConditionCheckItem operation checks the existence of a set of attributes for the item with the given primary key.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ConditionCheckItem.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toConditionCheckItem", []))

    @jsii.member(jsii_name="toCreateCluster")
    def to_create_cluster(self) -> "Dax":
        '''(experimental) The CreateCluster action creates a DAX cluster.

        Access Level: Write

        Dependent actions:

        - dax:CreateParameterGroup
        - dax:CreateSubnetGroup
        - ec2:CreateNetworkInterface
        - ec2:DeleteNetworkInterface
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSecurityGroups
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs
        - iam:GetRole
        - iam:PassRole

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_CreateCluster.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toCreateCluster", []))

    @jsii.member(jsii_name="toCreateParameterGroup")
    def to_create_parameter_group(self) -> "Dax":
        '''(experimental) The CreateParameterGroup action creates collection of parameters that you apply to all of the nodes in a DAX cluster.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_CreateParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toCreateParameterGroup", []))

    @jsii.member(jsii_name="toCreateSubnetGroup")
    def to_create_subnet_group(self) -> "Dax":
        '''(experimental) The CreateSubnetGroup action creates a new subnet group.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_CreateSubnetGroup.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toCreateSubnetGroup", []))

    @jsii.member(jsii_name="toDecreaseReplicationFactor")
    def to_decrease_replication_factor(self) -> "Dax":
        '''(experimental) The DecreaseReplicationFactor action removes one or more nodes from a DAX cluster.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_DecreaseReplicationFactor.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toDecreaseReplicationFactor", []))

    @jsii.member(jsii_name="toDeleteCluster")
    def to_delete_cluster(self) -> "Dax":
        '''(experimental) The DeleteCluster action deletes a previously provisioned DAX cluster.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_DeleteCluster.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toDeleteCluster", []))

    @jsii.member(jsii_name="toDeleteItem")
    def to_delete_item(self) -> "Dax":
        '''(experimental) The DeleteItem action deletes a single item in a table by primary key.

        Access Level: Write

        Possible conditions:

        - .ifEnclosingOperation()

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DeleteItem.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toDeleteItem", []))

    @jsii.member(jsii_name="toDeleteParameterGroup")
    def to_delete_parameter_group(self) -> "Dax":
        '''(experimental) The DeleteParameterGroup action deletes the specified parameter group.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_DeleteParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toDeleteParameterGroup", []))

    @jsii.member(jsii_name="toDeleteSubnetGroup")
    def to_delete_subnet_group(self) -> "Dax":
        '''(experimental) The DeleteSubnetGroup action deletes a subnet group.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_DeleteSubnetGroup.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toDeleteSubnetGroup", []))

    @jsii.member(jsii_name="toDescribeClusters")
    def to_describe_clusters(self) -> "Dax":
        '''(experimental) The DescribeClusters action returns information about all provisioned DAX clusters.

        Access Level: List

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_DescribeClusters.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toDescribeClusters", []))

    @jsii.member(jsii_name="toDescribeDefaultParameters")
    def to_describe_default_parameters(self) -> "Dax":
        '''(experimental) The DescribeDefaultParameters action returns the default system parameter information for DAX.

        Access Level: List

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_DescribeDefaultParameters.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toDescribeDefaultParameters", []))

    @jsii.member(jsii_name="toDescribeEvents")
    def to_describe_events(self) -> "Dax":
        '''(experimental) The DescribeEvents action returns events related to DAX clusters and parameter groups.

        Access Level: List

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_DescribeEvents.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toDescribeEvents", []))

    @jsii.member(jsii_name="toDescribeParameterGroups")
    def to_describe_parameter_groups(self) -> "Dax":
        '''(experimental) The DescribeParameterGroups action returns a list of parameter group descriptions.

        Access Level: List

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_DescribeParameterGroups.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toDescribeParameterGroups", []))

    @jsii.member(jsii_name="toDescribeParameters")
    def to_describe_parameters(self) -> "Dax":
        '''(experimental) The DescribeParameters action returns the detailed parameter list for a particular parameter group.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_DescribeParameters.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toDescribeParameters", []))

    @jsii.member(jsii_name="toDescribeSubnetGroups")
    def to_describe_subnet_groups(self) -> "Dax":
        '''(experimental) The DescribeSubnetGroups action returns a list of subnet group descriptions.

        Access Level: List

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_DescribeSubnetGroups.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toDescribeSubnetGroups", []))

    @jsii.member(jsii_name="toGetItem")
    def to_get_item(self) -> "Dax":
        '''(experimental) The GetItem action returns a set of attributes for the item with the given primary key.

        Access Level: Read

        Possible conditions:

        - .ifEnclosingOperation()

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_GetItem.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toGetItem", []))

    @jsii.member(jsii_name="toIncreaseReplicationFactor")
    def to_increase_replication_factor(self) -> "Dax":
        '''(experimental) The IncreaseReplicationFactor action adds one or more nodes to a DAX cluster.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_IncreaseReplicationFactor.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toIncreaseReplicationFactor", []))

    @jsii.member(jsii_name="toListTags")
    def to_list_tags(self) -> "Dax":
        '''(experimental) The ListTags action returns a list all of the tags for a DAX cluster.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_ListTags.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toListTags", []))

    @jsii.member(jsii_name="toPutItem")
    def to_put_item(self) -> "Dax":
        '''(experimental) The PutItem action creates a new item, or replaces an old item with a new item.

        Access Level: Write

        Possible conditions:

        - .ifEnclosingOperation()

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_PutItem.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toPutItem", []))

    @jsii.member(jsii_name="toQuery")
    def to_query(self) -> "Dax":
        '''(experimental) The Query action finds items based on primary key values.

        You can query any table or secondary index that has a composite primary key (a partition key and a sort key).

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_Query.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toQuery", []))

    @jsii.member(jsii_name="toRebootNode")
    def to_reboot_node(self) -> "Dax":
        '''(experimental) The RebootNode action reboots a single node of a DAX cluster.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_RebootNode.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toRebootNode", []))

    @jsii.member(jsii_name="toScan")
    def to_scan(self) -> "Dax":
        '''(experimental) The Scan action returns one or more items and item attributes by accessing every item in a table or a secondary index.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_Scan.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toScan", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Dax":
        '''(experimental) The TagResource action associates a set of tags with a DAX resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Dax":
        '''(experimental) The UntagResource action removes the association of tags from a DAX resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateCluster")
    def to_update_cluster(self) -> "Dax":
        '''(experimental) The UpdateCluster action modifies the settings for a DAX cluster.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_UpdateCluster.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toUpdateCluster", []))

    @jsii.member(jsii_name="toUpdateItem")
    def to_update_item(self) -> "Dax":
        '''(experimental) The UpdateItem action edits an existing item's attributes, or adds a new item to the table if it does not already exist.

        Access Level: Write

        Possible conditions:

        - .ifEnclosingOperation()

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_UpdateItem.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toUpdateItem", []))

    @jsii.member(jsii_name="toUpdateParameterGroup")
    def to_update_parameter_group(self) -> "Dax":
        '''(experimental) The UpdateParameterGroup action modifies the parameters of a parameter group.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_UpdateParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toUpdateParameterGroup", []))

    @jsii.member(jsii_name="toUpdateSubnetGroup")
    def to_update_subnet_group(self) -> "Dax":
        '''(experimental) The UpdateSubnetGroup action modifies an existing subnet group.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_UpdateSubnetGroup.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toUpdateSubnetGroup", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Dbqms(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Dbqms"):
    '''(experimental) Statement provider for service `dbqms <https://docs.aws.amazon.com/service-authorization/latest/reference/list_databasequerymetadataservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `dbqms <https://docs.aws.amazon.com/service-authorization/latest/reference/list_databasequerymetadataservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Dbqms, self, [sid])

    @jsii.member(jsii_name="toCreateFavoriteQuery")
    def to_create_favorite_query(self) -> "Dbqms":
        '''(experimental) Grants permission to create a new favorite query.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/dbqms-api.html#CreateFavoriteQuery

        :stability: experimental
        '''
        return typing.cast("Dbqms", jsii.invoke(self, "toCreateFavoriteQuery", []))

    @jsii.member(jsii_name="toCreateQueryHistory")
    def to_create_query_history(self) -> "Dbqms":
        '''(experimental) Grants permission to add a query to the history.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Dbqms", jsii.invoke(self, "toCreateQueryHistory", []))

    @jsii.member(jsii_name="toCreateTab")
    def to_create_tab(self) -> "Dbqms":
        '''(experimental) Grants permission to create a new query tab.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/dbqms-api.html#CreateTab

        :stability: experimental
        '''
        return typing.cast("Dbqms", jsii.invoke(self, "toCreateTab", []))

    @jsii.member(jsii_name="toDeleteFavoriteQueries")
    def to_delete_favorite_queries(self) -> "Dbqms":
        '''(experimental) Grants permission to delete saved queries.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/dbqms-api.html#DeleteFavoriteQueries

        :stability: experimental
        '''
        return typing.cast("Dbqms", jsii.invoke(self, "toDeleteFavoriteQueries", []))

    @jsii.member(jsii_name="toDeleteQueryHistory")
    def to_delete_query_history(self) -> "Dbqms":
        '''(experimental) Grants permission to delete a historical query.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/dbqms-api.html#DeleteQueryHistory

        :stability: experimental
        '''
        return typing.cast("Dbqms", jsii.invoke(self, "toDeleteQueryHistory", []))

    @jsii.member(jsii_name="toDeleteTab")
    def to_delete_tab(self) -> "Dbqms":
        '''(experimental) Grants permission to delete query tab.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/dbqms-api.html#DeleteTab

        :stability: experimental
        '''
        return typing.cast("Dbqms", jsii.invoke(self, "toDeleteTab", []))

    @jsii.member(jsii_name="toDescribeFavoriteQueries")
    def to_describe_favorite_queries(self) -> "Dbqms":
        '''(experimental) Grants permission to list saved queries and associated metadata.

        Access Level: List

        https://docs.aws.amazon.com/qldb/latest/developerguide/dbqms-api.html#DescribeFavoriteQueries

        :stability: experimental
        '''
        return typing.cast("Dbqms", jsii.invoke(self, "toDescribeFavoriteQueries", []))

    @jsii.member(jsii_name="toDescribeQueryHistory")
    def to_describe_query_history(self) -> "Dbqms":
        '''(experimental) Grants permission to list history of queries that were run.

        Access Level: List

        https://docs.aws.amazon.com/qldb/latest/developerguide/dbqms-api.html#DescribeQueryHistory

        :stability: experimental
        '''
        return typing.cast("Dbqms", jsii.invoke(self, "toDescribeQueryHistory", []))

    @jsii.member(jsii_name="toDescribeTabs")
    def to_describe_tabs(self) -> "Dbqms":
        '''(experimental) Grants permission to list query tabs and associated metadata.

        Access Level: List

        https://docs.aws.amazon.com/qldb/latest/developerguide/dbqms-api.html#DescribeTabs

        :stability: experimental
        '''
        return typing.cast("Dbqms", jsii.invoke(self, "toDescribeTabs", []))

    @jsii.member(jsii_name="toGetQueryString")
    def to_get_query_string(self) -> "Dbqms":
        '''(experimental) Grants permission to retrieve favorite or history query string by id.

        Access Level: Read

        https://docs.aws.amazon.com/qldb/latest/developerguide/dbqms-api.html#GetQueryString

        :stability: experimental
        '''
        return typing.cast("Dbqms", jsii.invoke(self, "toGetQueryString", []))

    @jsii.member(jsii_name="toUpdateFavoriteQuery")
    def to_update_favorite_query(self) -> "Dbqms":
        '''(experimental) Grants permission to update saved query and description.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/dbqms-api.html#UpdateFavoriteQuery

        :stability: experimental
        '''
        return typing.cast("Dbqms", jsii.invoke(self, "toUpdateFavoriteQuery", []))

    @jsii.member(jsii_name="toUpdateQueryHistory")
    def to_update_query_history(self) -> "Dbqms":
        '''(experimental) Grants permission to update the query history.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/dbqms-api.html#UpdateQueryHistory

        :stability: experimental
        '''
        return typing.cast("Dbqms", jsii.invoke(self, "toUpdateQueryHistory", []))

    @jsii.member(jsii_name="toUpdateTab")
    def to_update_tab(self) -> "Dbqms":
        '''(experimental) Grants permission to update query tab.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/dbqms-api.html#UpdateTab

        :stability: experimental
        '''
        return typing.cast("Dbqms", jsii.invoke(self, "toUpdateTab", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Deepcomposer(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Deepcomposer",
):
    '''(experimental) Statement provider for service `deepcomposer <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdeepcomposer.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `deepcomposer <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdeepcomposer.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Deepcomposer, self, [sid])

    @jsii.member(jsii_name="onAudio")
    def on_audio(
        self,
        audio_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Deepcomposer":
        '''(experimental) Adds a resource of type audio to the statement.

        https://docs.aws.amazon.com/latest/devguide/get-started.htmlget-started-compose-with-trained-model.html

        :param audio_id: - Identifier for the audioId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "onAudio", [audio_id, account, region, partition]))

    @jsii.member(jsii_name="onComposition")
    def on_composition(
        self,
        composition_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Deepcomposer":
        '''(experimental) Adds a resource of type composition to the statement.

        https://docs.aws.amazon.com/latest/devguide/get-started.htmlget-started-compose-with-trained-model.html

        :param composition_id: - Identifier for the compositionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "onComposition", [composition_id, account, region, partition]))

    @jsii.member(jsii_name="onModel")
    def on_model(
        self,
        model_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Deepcomposer":
        '''(experimental) Adds a resource of type model to the statement.

        https://docs.aws.amazon.com/latest/devguide/get-started.htmlget-started-train-custom-model.html

        :param model_id: - Identifier for the modelId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "onModel", [model_id, account, region, partition]))

    @jsii.member(jsii_name="toAssociateCoupon")
    def to_associate_coupon(self) -> "Deepcomposer":
        '''(experimental) Associates a DeepComposer coupon (or DSN) with the account associated with the sender of the request.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "toAssociateCoupon", []))

    @jsii.member(jsii_name="toCreateAudio")
    def to_create_audio(self) -> "Deepcomposer":
        '''(experimental) Creates an audio file by converting the midi composition into a wav or mp3 file.

        Access Level: Write

        https://docs.aws.amazon.com/latest/devguide/get-started.htmlget-started-compose-with-trained-model.html

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "toCreateAudio", []))

    @jsii.member(jsii_name="toCreateComposition")
    def to_create_composition(self) -> "Deepcomposer":
        '''(experimental) Creates a multi-track midi composition.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/latest/devguide/get-started.htmlget-started-compose-with-trained-model.html

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "toCreateComposition", []))

    @jsii.member(jsii_name="toCreateModel")
    def to_create_model(self) -> "Deepcomposer":
        '''(experimental) Starts creating/training a generative-model that is able to perform inference against the user-provided piano-melody to create a multi-track midi composition.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/latest/devguide/get-started.htmlget-started-train-custom-model.html

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "toCreateModel", []))

    @jsii.member(jsii_name="toDeleteComposition")
    def to_delete_composition(self) -> "Deepcomposer":
        '''(experimental) Deletes the composition.

        Access Level: Write

        https://docs.aws.amazon.com/latest/devguide/get-started.htmlget-started-compose-with-trained-model.html

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "toDeleteComposition", []))

    @jsii.member(jsii_name="toDeleteModel")
    def to_delete_model(self) -> "Deepcomposer":
        '''(experimental) Deletes the model.

        Access Level: Write

        https://docs.aws.amazon.com/latest/devguide/get-started.htmlget-started-train-custom-model.html

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "toDeleteModel", []))

    @jsii.member(jsii_name="toGetComposition")
    def to_get_composition(self) -> "Deepcomposer":
        '''(experimental) Returns information about the composition.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/latest/devguide/get-started.htmlget-started-compose-with-trained-model.html

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "toGetComposition", []))

    @jsii.member(jsii_name="toGetModel")
    def to_get_model(self) -> "Deepcomposer":
        '''(experimental) Returns information about the model.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/latest/devguide/get-started.htmlget-started-train-custom-model.html

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "toGetModel", []))

    @jsii.member(jsii_name="toGetSampleModel")
    def to_get_sample_model(self) -> "Deepcomposer":
        '''(experimental) Returns information about the sample/pre-trained DeepComposer model.

        Access Level: Read

        https://docs.aws.amazon.com/latest/devguide/get-started.htmlget-started-compose-with-trained-model.html

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "toGetSampleModel", []))

    @jsii.member(jsii_name="toListCompositions")
    def to_list_compositions(self) -> "Deepcomposer":
        '''(experimental) Returns a list of all the compositions owned by the sender of the request.

        Access Level: List

        https://docs.aws.amazon.com/latest/devguide/get-started.htmlget-started-compose-with-trained-model.html

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "toListCompositions", []))

    @jsii.member(jsii_name="toListModels")
    def to_list_models(self) -> "Deepcomposer":
        '''(experimental) Returns a list of all the models owned by the sender of the request.

        Access Level: List

        https://docs.aws.amazon.com/latest/devguide/get-started.htmlget-started-train-custom-model.html

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "toListModels", []))

    @jsii.member(jsii_name="toListSampleModels")
    def to_list_sample_models(self) -> "Deepcomposer":
        '''(experimental) Returns a list of all the sample/pre-trained models provided by the DeepComposer service.

        Access Level: List

        https://docs.aws.amazon.com/latest/devguide/get-started.htmlget-started-compose-with-trained-model.html

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "toListSampleModels", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Deepcomposer":
        '''(experimental) Grants permission to lists tag for a resource.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTrainingTopics")
    def to_list_training_topics(self) -> "Deepcomposer":
        '''(experimental) Returns a list of all the training options or topic for creating/training a model.

        Access Level: List

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "toListTrainingTopics", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Deepcomposer":
        '''(experimental) Grants permission to tag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Deepcomposer":
        '''(experimental) Grants permission to untag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateComposition")
    def to_update_composition(self) -> "Deepcomposer":
        '''(experimental) Modifies the mutable properties associated with a composition.

        Access Level: Write

        https://docs.aws.amazon.com/latest/devguide/get-started.htmlget-started-compose-with-trained-model.html

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "toUpdateComposition", []))

    @jsii.member(jsii_name="toUpdateModel")
    def to_update_model(self) -> "Deepcomposer":
        '''(experimental) Modifies the mutable properties associated with a model.

        Access Level: Write

        https://docs.aws.amazon.com/latest/devguide/get-started.htmlget-started-train-custom-model.html

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "toUpdateModel", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Deeplens(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Deeplens",
):
    '''(experimental) Statement provider for service `deeplens <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdeeplens.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `deeplens <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdeeplens.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Deeplens, self, [sid])

    @jsii.member(jsii_name="onDevice")
    def on_device(
        self,
        device_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Deeplens":
        '''(experimental) Adds a resource of type device to the statement.

        :param device_name: - Identifier for the deviceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "onDevice", [device_name, account, region, partition]))

    @jsii.member(jsii_name="onModel")
    def on_model(
        self,
        model_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Deeplens":
        '''(experimental) Adds a resource of type model to the statement.

        :param model_name: - Identifier for the modelName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "onModel", [model_name, account, region, partition]))

    @jsii.member(jsii_name="onProject")
    def on_project(
        self,
        project_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Deeplens":
        '''(experimental) Adds a resource of type project to the statement.

        :param project_name: - Identifier for the projectName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "onProject", [project_name, account, region, partition]))

    @jsii.member(jsii_name="toAssociateServiceRoleToAccount")
    def to_associate_service_role_to_account(self) -> "Deeplens":
        '''(experimental) Associates the user's account with IAM roles controlling various permissions needed by AWS DeepLens for proper functionality.

        Access Level: Permissions management

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toAssociateServiceRoleToAccount", []))

    @jsii.member(jsii_name="toBatchGetDevice")
    def to_batch_get_device(self) -> "Deeplens":
        '''(experimental) Retrieves a list of AWS DeepLens devices.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toBatchGetDevice", []))

    @jsii.member(jsii_name="toBatchGetModel")
    def to_batch_get_model(self) -> "Deeplens":
        '''(experimental) Retrieves a list of AWS DeepLens Models.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toBatchGetModel", []))

    @jsii.member(jsii_name="toBatchGetProject")
    def to_batch_get_project(self) -> "Deeplens":
        '''(experimental) Retrieves a list of AWS DeepLens Projects.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toBatchGetProject", []))

    @jsii.member(jsii_name="toCreateDeviceCertificates")
    def to_create_device_certificates(self) -> "Deeplens":
        '''(experimental) Creates a certificate package that is used to successfully authenticate and Register an AWS DeepLens device.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toCreateDeviceCertificates", []))

    @jsii.member(jsii_name="toCreateModel")
    def to_create_model(self) -> "Deeplens":
        '''(experimental) Creates a new AWS DeepLens Model.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toCreateModel", []))

    @jsii.member(jsii_name="toCreateProject")
    def to_create_project(self) -> "Deeplens":
        '''(experimental) Creates a new AWS DeepLens Project.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toCreateProject", []))

    @jsii.member(jsii_name="toDeleteModel")
    def to_delete_model(self) -> "Deeplens":
        '''(experimental) Deletes an AWS DeepLens Model.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toDeleteModel", []))

    @jsii.member(jsii_name="toDeleteProject")
    def to_delete_project(self) -> "Deeplens":
        '''(experimental) Deletes an AWS DeepLens Project.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toDeleteProject", []))

    @jsii.member(jsii_name="toDeployProject")
    def to_deploy_project(self) -> "Deeplens":
        '''(experimental) Deploys an AWS DeepLens project to a registered AWS DeepLens device.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toDeployProject", []))

    @jsii.member(jsii_name="toDeregisterDevice")
    def to_deregister_device(self) -> "Deeplens":
        '''(experimental) Begins a device de-registration workflow for a registered AWS DeepLens device.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toDeregisterDevice", []))

    @jsii.member(jsii_name="toGetAssociatedResources")
    def to_get_associated_resources(self) -> "Deeplens":
        '''(experimental) Retrieves the account level resources associated with the user's account.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toGetAssociatedResources", []))

    @jsii.member(jsii_name="toGetDeploymentStatus")
    def to_get_deployment_status(self) -> "Deeplens":
        '''(experimental) Retrieves the the deployment status of a particular AWS DeepLens device, along with any associated metadata.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toGetDeploymentStatus", []))

    @jsii.member(jsii_name="toGetDevice")
    def to_get_device(self) -> "Deeplens":
        '''(experimental) Retrieves information about an AWS DeepLens device.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toGetDevice", []))

    @jsii.member(jsii_name="toGetModel")
    def to_get_model(self) -> "Deeplens":
        '''(experimental) Retrieves an AWS DeepLens Model.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toGetModel", []))

    @jsii.member(jsii_name="toGetProject")
    def to_get_project(self) -> "Deeplens":
        '''(experimental) Retrieves an AWS DeepLens Project.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toGetProject", []))

    @jsii.member(jsii_name="toImportProjectFromTemplate")
    def to_import_project_from_template(self) -> "Deeplens":
        '''(experimental) Creates a new AWS DeepLens project from a sample project template.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toImportProjectFromTemplate", []))

    @jsii.member(jsii_name="toListDeployments")
    def to_list_deployments(self) -> "Deeplens":
        '''(experimental) Retrieves a list of AWS DeepLens Deployment identifiers.

        Access Level: List

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toListDeployments", []))

    @jsii.member(jsii_name="toListDevices")
    def to_list_devices(self) -> "Deeplens":
        '''(experimental) Retrieves a list of AWS DeepLens device identifiers.

        Access Level: List

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toListDevices", []))

    @jsii.member(jsii_name="toListModels")
    def to_list_models(self) -> "Deeplens":
        '''(experimental) Retrieves a list of AWS DeepLens Model identifiers.

        Access Level: List

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toListModels", []))

    @jsii.member(jsii_name="toListProjects")
    def to_list_projects(self) -> "Deeplens":
        '''(experimental) Retrieves a list of AWS DeepLens Project identifiers.

        Access Level: List

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toListProjects", []))

    @jsii.member(jsii_name="toRegisterDevice")
    def to_register_device(self) -> "Deeplens":
        '''(experimental) Begins a device registration workflow for an AWS DeepLens device.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toRegisterDevice", []))

    @jsii.member(jsii_name="toRemoveProject")
    def to_remove_project(self) -> "Deeplens":
        '''(experimental) Removes a deployed AWS DeepLens project from an AWS DeepLens device.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toRemoveProject", []))

    @jsii.member(jsii_name="toUpdateProject")
    def to_update_project(self) -> "Deeplens":
        '''(experimental) Updates an existing AWS DeepLens Project.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toUpdateProject", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Deepracer(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Deepracer",
):
    '''(experimental) Statement provider for service `deepracer <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdeepracer.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `deepracer <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdeepracer.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Deepracer, self, [sid])

    @jsii.member(jsii_name="onEvaluationJob")
    def on_evaluation_job(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Deepracer":
        '''(experimental) Adds a resource of type evaluation_job to the statement.

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-get-started-test-in-simulator.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "onEvaluationJob", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onLeaderboard")
    def on_leaderboard(
        self,
        resource_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Deepracer":
        '''(experimental) Adds a resource of type leaderboard to the statement.

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-submit-model-to-leaderboard.html

        :param resource_id: - Identifier for the resourceId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "onLeaderboard", [resource_id, region, partition]))

    @jsii.member(jsii_name="onLeaderboardEvaluationJob")
    def on_leaderboard_evaluation_job(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Deepracer":
        '''(experimental) Adds a resource of type leaderboard_evaluation_job to the statement.

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-submit-model-to-leaderboard.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "onLeaderboardEvaluationJob", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onReinforcementLearningModel")
    def on_reinforcement_learning_model(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Deepracer":
        '''(experimental) Adds a resource of type reinforcement_learning_model to the statement.

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-get-started-training-model.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "onReinforcementLearningModel", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onTrack")
    def on_track(
        self,
        resource_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Deepracer":
        '''(experimental) Adds a resource of type track to the statement.

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-console-train-evaluate-models.html

        :param resource_id: - Identifier for the resourceId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "onTrack", [resource_id, region, partition]))

    @jsii.member(jsii_name="onTrainingJob")
    def on_training_job(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Deepracer":
        '''(experimental) Adds a resource of type training_job to the statement.

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-get-started-training-model.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "onTrainingJob", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toCloneReinforcementLearningModel")
    def to_clone_reinforcement_learning_model(self) -> "Deepracer":
        '''(experimental) Grants permission to clone existing DeepRacer models.

        Access Level: Write

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-console-train-evaluate-models.html#deepracer-clone-trained-model

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toCloneReinforcementLearningModel", []))

    @jsii.member(jsii_name="toCreateAccountResources")
    def to_create_account_resources(self) -> "Deepracer":
        '''(experimental) Grants permission to create resources needed by DeepRacer on behalf of the user.

        Access Level: Write

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-get-started-training-model.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toCreateAccountResources", []))

    @jsii.member(jsii_name="toCreateLeaderboardSubmission")
    def to_create_leaderboard_submission(self) -> "Deepracer":
        '''(experimental) Grants permission to submit DeepRacer models to be evaluated for leaderboards.

        Access Level: Write

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-submit-model-to-leaderboard.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toCreateLeaderboardSubmission", []))

    @jsii.member(jsii_name="toCreateReinforcementLearningModel")
    def to_create_reinforcement_learning_model(self) -> "Deepracer":
        '''(experimental) Grants permission to create reinforcement learning models for DeepRacer.

        Access Level: Write

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-get-started-training-model.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toCreateReinforcementLearningModel", []))

    @jsii.member(jsii_name="toDeleteAccountResources")
    def to_delete_account_resources(self) -> "Deepracer":
        '''(experimental) Grants permission to delete resources created by DeepRacer on behalf of the user.

        Access Level: Write

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-get-started-training-model.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toDeleteAccountResources", []))

    @jsii.member(jsii_name="toDeleteModel")
    def to_delete_model(self) -> "Deepracer":
        '''(experimental) Grants permission to delete DeepRacer models.

        Access Level: Write

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-get-started-training-model.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toDeleteModel", []))

    @jsii.member(jsii_name="toGetAccountResources")
    def to_get_account_resources(self) -> "Deepracer":
        '''(experimental) Grants permission to retrieve the resources created by DeepRacer on behalf of the user.

        Access Level: Read

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-get-started-training-model.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toGetAccountResources", []))

    @jsii.member(jsii_name="toGetAlias")
    def to_get_alias(self) -> "Deepracer":
        '''(experimental) Grants permission to retrieve the user's alias for submitting DeepRacer models to leaderboards.

        Access Level: Read

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-submit-model-to-leaderboard.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toGetAlias", []))

    @jsii.member(jsii_name="toGetEvaluation")
    def to_get_evaluation(self) -> "Deepracer":
        '''(experimental) Grants permission to retrieve information about existing DeepRacer models' evaluation jobs.

        Access Level: Read

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-get-started-test-in-simulator.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toGetEvaluation", []))

    @jsii.member(jsii_name="toGetLatestUserSubmission")
    def to_get_latest_user_submission(self) -> "Deepracer":
        '''(experimental) Grants permission to retrieve information about how the latest submitted DeepRacer model for a user performed on a leaderboard.

        Access Level: Read

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-submit-model-to-leaderboard.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toGetLatestUserSubmission", []))

    @jsii.member(jsii_name="toGetLeaderboard")
    def to_get_leaderboard(self) -> "Deepracer":
        '''(experimental) Grants permission to retrieve information about leaderboards.

        Access Level: Read

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-submit-model-to-leaderboard.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toGetLeaderboard", []))

    @jsii.member(jsii_name="toGetModel")
    def to_get_model(self) -> "Deepracer":
        '''(experimental) Grants permission to retrieve information about existing DeepRacer models.

        Access Level: Read

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-get-started-training-model.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toGetModel", []))

    @jsii.member(jsii_name="toGetRankedUserSubmission")
    def to_get_ranked_user_submission(self) -> "Deepracer":
        '''(experimental) Grants permission to retrieve information about the performance of a user's DeepRacer model that got placed on a leaderboard.

        Access Level: Read

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-submit-model-to-leaderboard.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toGetRankedUserSubmission", []))

    @jsii.member(jsii_name="toGetTrack")
    def to_get_track(self) -> "Deepracer":
        '''(experimental) Grants permission to retrieve information about DeepRacer tracks.

        Access Level: Read

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-console-train-evaluate-models.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toGetTrack", []))

    @jsii.member(jsii_name="toGetTrainingJob")
    def to_get_training_job(self) -> "Deepracer":
        '''(experimental) Grants permission to retrieve information about existing DeepRacer models' training job.

        Access Level: Read

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-get-started-training-model.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toGetTrainingJob", []))

    @jsii.member(jsii_name="toListEvaluations")
    def to_list_evaluations(self) -> "Deepracer":
        '''(experimental) Grants permission to list DeepRacer models' evaluation jobs.

        Access Level: List

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-get-started-test-in-simulator.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toListEvaluations", []))

    @jsii.member(jsii_name="toListLeaderboards")
    def to_list_leaderboards(self) -> "Deepracer":
        '''(experimental) Grants permission to list all the available leaderboards.

        Access Level: List

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-submit-model-to-leaderboard.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toListLeaderboards", []))

    @jsii.member(jsii_name="toListLeaderboardSubmissions")
    def to_list_leaderboard_submissions(self) -> "Deepracer":
        '''(experimental) Grants permission to list all the submissions of DeepRacer models of a user on a leaderboard.

        Access Level: List

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-submit-model-to-leaderboard.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toListLeaderboardSubmissions", []))

    @jsii.member(jsii_name="toListModels")
    def to_list_models(self) -> "Deepracer":
        '''(experimental) Grants permission to list all existing DeepRacer models.

        Access Level: List

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-get-started-training-model.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toListModels", []))

    @jsii.member(jsii_name="toListTracks")
    def to_list_tracks(self) -> "Deepracer":
        '''(experimental) Grants permission to list all DeepRacer tracks.

        Access Level: List

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-console-train-evaluate-models.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toListTracks", []))

    @jsii.member(jsii_name="toListTrainingJobs")
    def to_list_training_jobs(self) -> "Deepracer":
        '''(experimental) Grants permission to list DeepRacer models' training jobs.

        Access Level: List

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-get-started-training-model.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toListTrainingJobs", []))

    @jsii.member(jsii_name="toSetAlias")
    def to_set_alias(self) -> "Deepracer":
        '''(experimental) Grants permission to set the user's alias for submitting DeepRacer models to leaderboards.

        Access Level: Write

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-submit-model-to-leaderboard.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toSetAlias", []))

    @jsii.member(jsii_name="toStartEvaluation")
    def to_start_evaluation(self) -> "Deepracer":
        '''(experimental) Grants permission to evaluate DeepRacer models in a simulated environment.

        Access Level: Write

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-get-started-test-in-simulator.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toStartEvaluation", []))

    @jsii.member(jsii_name="toStopEvaluation")
    def to_stop_evaluation(self) -> "Deepracer":
        '''(experimental) Grants permission to stop DeepRacer model evaluations.

        Access Level: Write

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-get-started-test-in-simulator.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toStopEvaluation", []))

    @jsii.member(jsii_name="toStopTrainingReinforcementLearningModel")
    def to_stop_training_reinforcement_learning_model(self) -> "Deepracer":
        '''(experimental) Grants permission to stop training DeepRacer models.

        Access Level: Write

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-get-started-training-model.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toStopTrainingReinforcementLearningModel", []))

    @jsii.member(jsii_name="toTestRewardFunction")
    def to_test_reward_function(self) -> "Deepracer":
        '''(experimental) Grants permission to test reward functions for correctness.

        Access Level: Write

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-console-train-evaluate-models.html#deepracer-train-models-define-reward-function

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toTestRewardFunction", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Detective(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Detective",
):
    '''(experimental) Statement provider for service `detective <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazondetective.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `detective <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazondetective.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Detective, self, [sid])

    @jsii.member(jsii_name="onGraph")
    def on_graph(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Detective":
        '''(experimental) Adds a resource of type Graph to the statement.

        https://docs.aws.amazon.com/detective/latest/adminguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-resources

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "onGraph", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toAcceptInvitation")
    def to_accept_invitation(self) -> "Detective":
        '''(experimental) Grants permission to accept an invitation to become a member of a behavior graph.

        Access Level: Write

        https://docs.aws.amazon.com/detective/latest/APIReference/API_AcceptInvitation.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toAcceptInvitation", []))

    @jsii.member(jsii_name="toCreateGraph")
    def to_create_graph(self) -> "Detective":
        '''(experimental) Grants permission to create a behavior graph and begin to aggregate security information.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/detective/latest/APIReference/API_CreateGraph.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toCreateGraph", []))

    @jsii.member(jsii_name="toCreateMembers")
    def to_create_members(self) -> "Detective":
        '''(experimental) Grants permission to request the membership of one or more accounts in a behavior graph managed by this account.

        Access Level: Write

        https://docs.aws.amazon.com/detective/latest/APIReference/API_CreateMembers.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toCreateMembers", []))

    @jsii.member(jsii_name="toDeleteGraph")
    def to_delete_graph(self) -> "Detective":
        '''(experimental) Grants permission to delete a behavior graph and stop aggregating security information.

        Access Level: Write

        https://docs.aws.amazon.com/detective/latest/APIReference/API_DeleteGraph.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toDeleteGraph", []))

    @jsii.member(jsii_name="toDeleteMembers")
    def to_delete_members(self) -> "Detective":
        '''(experimental) Grants permission to remove member accounts from a behavior graph managed by this account.

        Access Level: Write

        https://docs.aws.amazon.com/detective/latest/APIReference/API_DeleteMembers.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toDeleteMembers", []))

    @jsii.member(jsii_name="toDisassociateMembership")
    def to_disassociate_membership(self) -> "Detective":
        '''(experimental) Grants permission to remove the association of this account with a behavior graph.

        Access Level: Write

        https://docs.aws.amazon.com/detective/latest/APIReference/API_DisassociateMembership.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toDisassociateMembership", []))

    @jsii.member(jsii_name="toGetFreeTrialEligibility")
    def to_get_free_trial_eligibility(self) -> "Detective":
        '''(experimental) Grants permission to retrieve a behavior graph's eligibility for a free trial period.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toGetFreeTrialEligibility", []))

    @jsii.member(jsii_name="toGetGraphIngestState")
    def to_get_graph_ingest_state(self) -> "Detective":
        '''(experimental) Grants permission to retrieve the data ingestion state of a behavior graph.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toGetGraphIngestState", []))

    @jsii.member(jsii_name="toGetMembers")
    def to_get_members(self) -> "Detective":
        '''(experimental) Grants permission to retrieve details on specified members of a behavior graph.

        Access Level: Read

        https://docs.aws.amazon.com/detective/latest/APIReference/API_GetMembers.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toGetMembers", []))

    @jsii.member(jsii_name="toGetPricingInformation")
    def to_get_pricing_information(self) -> "Detective":
        '''(experimental) Grants permission to retrieve information about Amazon Detective's pricing.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toGetPricingInformation", []))

    @jsii.member(jsii_name="toGetUsageInformation")
    def to_get_usage_information(self) -> "Detective":
        '''(experimental) Grants permission to list usage information of a behavior graph.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toGetUsageInformation", []))

    @jsii.member(jsii_name="toListGraphs")
    def to_list_graphs(self) -> "Detective":
        '''(experimental) Grants permission to list behavior graphs managed by this account.

        Access Level: List

        https://docs.aws.amazon.com/detective/latest/APIReference/API_ListGraphs.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toListGraphs", []))

    @jsii.member(jsii_name="toListInvitations")
    def to_list_invitations(self) -> "Detective":
        '''(experimental) Grants permission to retrieve details on the behavior graphs to which this account has been invited to join.

        Access Level: List

        https://docs.aws.amazon.com/detective/latest/APIReference/API_ListInvitations.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toListInvitations", []))

    @jsii.member(jsii_name="toListMembers")
    def to_list_members(self) -> "Detective":
        '''(experimental) Grants permission to retrieve details on all members of a behavior graph.

        Access Level: List

        https://docs.aws.amazon.com/detective/latest/APIReference/API_ListMembers.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toListMembers", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Detective":
        '''(experimental) Grants permission to list the tag values that are assigned to a behavior graph.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/detective/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toRejectInvitation")
    def to_reject_invitation(self) -> "Detective":
        '''(experimental) Grants permission to reject an invitation to become a member of a behavior graph.

        Access Level: Write

        https://docs.aws.amazon.com/detective/latest/APIReference/API_RejectInvitation.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toRejectInvitation", []))

    @jsii.member(jsii_name="toSearchGraph")
    def to_search_graph(self) -> "Detective":
        '''(experimental) Grants permission to search the data stored in a behavior graph.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toSearchGraph", []))

    @jsii.member(jsii_name="toStartMonitoringMember")
    def to_start_monitoring_member(self) -> "Detective":
        '''(experimental) Grants permission to start data ingest for a member account that has a status of ACCEPTED_BUT_DISABLED.

        Access Level: Write

        https://docs.aws.amazon.com/detective/latest/APIReference/API_StartMonitoringMember.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toStartMonitoringMember", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Detective":
        '''(experimental) Grants permission to assign tag values to a behavior graph.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/detective/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Detective":
        '''(experimental) Grants permission to remove tag values from a behavior graph.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/detective/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toUntagResource", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Devicefarm(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Devicefarm",
):
    '''(experimental) Statement provider for service `devicefarm <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdevicefarm.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `devicefarm <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdevicefarm.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Devicefarm, self, [sid])

    @jsii.member(jsii_name="onArtifact")
    def on_artifact(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Devicefarm":
        '''(experimental) Adds a resource of type artifact to the statement.

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_Artifact.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "onArtifact", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onDevice")
    def on_device(
        self,
        resource_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Devicefarm":
        '''(experimental) Adds a resource of type device to the statement.

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_Device.html

        :param resource_id: - Identifier for the resourceId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "onDevice", [resource_id, region, partition]))

    @jsii.member(jsii_name="onDeviceinstance")
    def on_deviceinstance(
        self,
        resource_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Devicefarm":
        '''(experimental) Adds a resource of type deviceinstance to the statement.

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_DeviceInstance.html

        :param resource_id: - Identifier for the resourceId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "onDeviceinstance", [resource_id, region, partition]))

    @jsii.member(jsii_name="onDevicepool")
    def on_devicepool(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Devicefarm":
        '''(experimental) Adds a resource of type devicepool to the statement.

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_DevicePool.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "onDevicepool", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onInstanceprofile")
    def on_instanceprofile(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Devicefarm":
        '''(experimental) Adds a resource of type instanceprofile to the statement.

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_InstanceProfile.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "onInstanceprofile", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onJob")
    def on_job(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Devicefarm":
        '''(experimental) Adds a resource of type job to the statement.

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_Job.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "onJob", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onNetworkprofile")
    def on_networkprofile(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Devicefarm":
        '''(experimental) Adds a resource of type networkprofile to the statement.

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_NetworkProfile.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "onNetworkprofile", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onProject")
    def on_project(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Devicefarm":
        '''(experimental) Adds a resource of type project to the statement.

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_Project.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "onProject", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onRun")
    def on_run(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Devicefarm":
        '''(experimental) Adds a resource of type run to the statement.

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_Run.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "onRun", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onSample")
    def on_sample(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Devicefarm":
        '''(experimental) Adds a resource of type sample to the statement.

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_Sample.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "onSample", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onSession")
    def on_session(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Devicefarm":
        '''(experimental) Adds a resource of type session to the statement.

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_RemoteAccessSession.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "onSession", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onSuite")
    def on_suite(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Devicefarm":
        '''(experimental) Adds a resource of type suite to the statement.

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_Suite.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "onSuite", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onTest")
    def on_test(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Devicefarm":
        '''(experimental) Adds a resource of type test to the statement.

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_Test.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "onTest", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onTestgridProject")
    def on_testgrid_project(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Devicefarm":
        '''(experimental) Adds a resource of type testgrid-project to the statement.

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_TestGridProject.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "onTestgridProject", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onTestgridSession")
    def on_testgrid_session(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Devicefarm":
        '''(experimental) Adds a resource of type testgrid-session to the statement.

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_TestGridSession.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "onTestgridSession", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onUpload")
    def on_upload(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Devicefarm":
        '''(experimental) Adds a resource of type upload to the statement.

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_Upload.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "onUpload", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onVpceconfiguration")
    def on_vpceconfiguration(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Devicefarm":
        '''(experimental) Adds a resource of type vpceconfiguration to the statement.

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_VPCEConfiguration.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "onVpceconfiguration", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateDevicePool")
    def to_create_device_pool(self) -> "Devicefarm":
        '''(experimental) Grants permission to create a device pool within a project.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_CreateDevicePool.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toCreateDevicePool", []))

    @jsii.member(jsii_name="toCreateInstanceProfile")
    def to_create_instance_profile(self) -> "Devicefarm":
        '''(experimental) Grants permission to create a device instance profile.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_CreateInstanceProfile.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toCreateInstanceProfile", []))

    @jsii.member(jsii_name="toCreateNetworkProfile")
    def to_create_network_profile(self) -> "Devicefarm":
        '''(experimental) Grants permission to create a network profile within a project.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_CreateNetworkProfile.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toCreateNetworkProfile", []))

    @jsii.member(jsii_name="toCreateProject")
    def to_create_project(self) -> "Devicefarm":
        '''(experimental) Grants permission to create a project for mobile testing.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_CreateProject.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toCreateProject", []))

    @jsii.member(jsii_name="toCreateRemoteAccessSession")
    def to_create_remote_access_session(self) -> "Devicefarm":
        '''(experimental) Grants permission to start a remote access session to a device instance.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_CreateRemoteAccessSession.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toCreateRemoteAccessSession", []))

    @jsii.member(jsii_name="toCreateTestGridProject")
    def to_create_test_grid_project(self) -> "Devicefarm":
        '''(experimental) Grants permission to create a project for desktop testing.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_CreateTestGridProject.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toCreateTestGridProject", []))

    @jsii.member(jsii_name="toCreateTestGridUrl")
    def to_create_test_grid_url(self) -> "Devicefarm":
        '''(experimental) Grants permission to generate a new pre-signed url used to access our test grid service.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_CreateTestGridUrl.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toCreateTestGridUrl", []))

    @jsii.member(jsii_name="toCreateUpload")
    def to_create_upload(self) -> "Devicefarm":
        '''(experimental) Grants permission to upload a new file or app within a project.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_CreateUpload.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toCreateUpload", []))

    @jsii.member(jsii_name="toCreateVPCEConfiguration")
    def to_create_vpce_configuration(self) -> "Devicefarm":
        '''(experimental) Grants permission to create an Amazon Virtual Private Cloud (VPC) endpoint configuration.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_CreateVPCEConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toCreateVPCEConfiguration", []))

    @jsii.member(jsii_name="toDeleteDevicePool")
    def to_delete_device_pool(self) -> "Devicefarm":
        '''(experimental) Grants permission to delete a user-generated device pool.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_DeleteDevicePool.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toDeleteDevicePool", []))

    @jsii.member(jsii_name="toDeleteInstanceProfile")
    def to_delete_instance_profile(self) -> "Devicefarm":
        '''(experimental) Grants permission to delete a user-generated instance profile.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_DeleteInstanceProfile.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toDeleteInstanceProfile", []))

    @jsii.member(jsii_name="toDeleteNetworkProfile")
    def to_delete_network_profile(self) -> "Devicefarm":
        '''(experimental) Grants permission to delete a user-generated network profile.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/DeleteNetworkProfile.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toDeleteNetworkProfile", []))

    @jsii.member(jsii_name="toDeleteProject")
    def to_delete_project(self) -> "Devicefarm":
        '''(experimental) Grants permission to delete a mobile testing project.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_DeleteProject.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toDeleteProject", []))

    @jsii.member(jsii_name="toDeleteRemoteAccessSession")
    def to_delete_remote_access_session(self) -> "Devicefarm":
        '''(experimental) Grants permission to delete a completed remote access session and its results.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_DeleteRemoteAccessSession.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toDeleteRemoteAccessSession", []))

    @jsii.member(jsii_name="toDeleteRun")
    def to_delete_run(self) -> "Devicefarm":
        '''(experimental) Grants permission to delete a run.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_DeleteRun.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toDeleteRun", []))

    @jsii.member(jsii_name="toDeleteTestGridProject")
    def to_delete_test_grid_project(self) -> "Devicefarm":
        '''(experimental) Grants permission to delete a desktop testing project.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_DeleteTestGridProject.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toDeleteTestGridProject", []))

    @jsii.member(jsii_name="toDeleteUpload")
    def to_delete_upload(self) -> "Devicefarm":
        '''(experimental) Grants permission to delete a user-uploaded file.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_DeleteUpload.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toDeleteUpload", []))

    @jsii.member(jsii_name="toDeleteVPCEConfiguration")
    def to_delete_vpce_configuration(self) -> "Devicefarm":
        '''(experimental) Grants permission to delete an Amazon Virtual Private Cloud (VPC) endpoint configuration.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_DeleteVPCEConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toDeleteVPCEConfiguration", []))

    @jsii.member(jsii_name="toGetAccountSettings")
    def to_get_account_settings(self) -> "Devicefarm":
        '''(experimental) Grants permission to retrieve the number of unmetered iOS and/or unmetered Android devices purchased by the account.

        Access Level: Read

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetAccountSettings.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toGetAccountSettings", []))

    @jsii.member(jsii_name="toGetDevice")
    def to_get_device(self) -> "Devicefarm":
        '''(experimental) Grants permission to retrieve the information of a unique device type.

        Access Level: Read

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetDevice.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toGetDevice", []))

    @jsii.member(jsii_name="toGetDeviceInstance")
    def to_get_device_instance(self) -> "Devicefarm":
        '''(experimental) Grants permission to retireve the information of a device instance.

        Access Level: Read

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetDeviceInstance.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toGetDeviceInstance", []))

    @jsii.member(jsii_name="toGetDevicePool")
    def to_get_device_pool(self) -> "Devicefarm":
        '''(experimental) Grants permission to retireve the information of a device pool.

        Access Level: Read

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetDevicePool.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toGetDevicePool", []))

    @jsii.member(jsii_name="toGetDevicePoolCompatibility")
    def to_get_device_pool_compatibility(self) -> "Devicefarm":
        '''(experimental) Grants permission to retrieve information about the compatibility of a test and/or app with a device pool.

        Access Level: Read

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetDevicePoolCompatibility.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toGetDevicePoolCompatibility", []))

    @jsii.member(jsii_name="toGetInstanceProfile")
    def to_get_instance_profile(self) -> "Devicefarm":
        '''(experimental) Grants permission to retireve the information of an instance profile.

        Access Level: Read

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetInstanceProfile.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toGetInstanceProfile", []))

    @jsii.member(jsii_name="toGetJob")
    def to_get_job(self) -> "Devicefarm":
        '''(experimental) Grants permission to retireve the information of a job.

        Access Level: Read

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetJob.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toGetJob", []))

    @jsii.member(jsii_name="toGetNetworkProfile")
    def to_get_network_profile(self) -> "Devicefarm":
        '''(experimental) Grants permission to retireve the information of a network profile.

        Access Level: Read

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetNetworkProfile.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toGetNetworkProfile", []))

    @jsii.member(jsii_name="toGetOfferingStatus")
    def to_get_offering_status(self) -> "Devicefarm":
        '''(experimental) Grants permission to retrieve the current status and future status of all offerings purchased by an AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetOfferingStatus.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toGetOfferingStatus", []))

    @jsii.member(jsii_name="toGetProject")
    def to_get_project(self) -> "Devicefarm":
        '''(experimental) Grants permission to retrieve information about a mobile testing project.

        Access Level: Read

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetProject.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toGetProject", []))

    @jsii.member(jsii_name="toGetRemoteAccessSession")
    def to_get_remote_access_session(self) -> "Devicefarm":
        '''(experimental) Grants permission to retireve the link to a currently running remote access session.

        Access Level: Read

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetRemoteAccessSession.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toGetRemoteAccessSession", []))

    @jsii.member(jsii_name="toGetRun")
    def to_get_run(self) -> "Devicefarm":
        '''(experimental) Grants permission to retireve the information of a run.

        Access Level: Read

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetRun.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toGetRun", []))

    @jsii.member(jsii_name="toGetSuite")
    def to_get_suite(self) -> "Devicefarm":
        '''(experimental) Grants permission to retireve the information of a testing suite.

        Access Level: Read

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetSuite.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toGetSuite", []))

    @jsii.member(jsii_name="toGetTest")
    def to_get_test(self) -> "Devicefarm":
        '''(experimental) Grants permission to retireve the information of a test case.

        Access Level: Read

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetTest.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toGetTest", []))

    @jsii.member(jsii_name="toGetTestGridProject")
    def to_get_test_grid_project(self) -> "Devicefarm":
        '''(experimental) Grants permission to retrieve information about a desktop testing project.

        Access Level: Read

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetTestGridProject.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toGetTestGridProject", []))

    @jsii.member(jsii_name="toGetTestGridSession")
    def to_get_test_grid_session(self) -> "Devicefarm":
        '''(experimental) Grants permission to retireve the information of a test grid session.

        Access Level: Read

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetTestGridSession.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toGetTestGridSession", []))

    @jsii.member(jsii_name="toGetUpload")
    def to_get_upload(self) -> "Devicefarm":
        '''(experimental) Grants permission to retireve the information of an uploaded file.

        Access Level: Read

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetUpload.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toGetUpload", []))

    @jsii.member(jsii_name="toGetVPCEConfiguration")
    def to_get_vpce_configuration(self) -> "Devicefarm":
        '''(experimental) Grants permission to retireve the information of an Amazon Virtual Private Cloud (VPC) endpoint configuration.

        Access Level: Read

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetVPCEConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toGetVPCEConfiguration", []))

    @jsii.member(jsii_name="toInstallToRemoteAccessSession")
    def to_install_to_remote_access_session(self) -> "Devicefarm":
        '''(experimental) Grants permission to install an application to a device in a remote access session.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_InstallToRemoteAccessSession.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toInstallToRemoteAccessSession", []))

    @jsii.member(jsii_name="toListArtifacts")
    def to_list_artifacts(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the artifacts in a project.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListArtifacts.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListArtifacts", []))

    @jsii.member(jsii_name="toListDeviceInstances")
    def to_list_device_instances(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the information of device instances.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListDeviceInstances.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListDeviceInstances", []))

    @jsii.member(jsii_name="toListDevicePools")
    def to_list_device_pools(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the information of device pools.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListDevicePools.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListDevicePools", []))

    @jsii.member(jsii_name="toListDevices")
    def to_list_devices(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the information of unique device types.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListDevices.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListDevices", []))

    @jsii.member(jsii_name="toListInstanceProfiles")
    def to_list_instance_profiles(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the information of device instance profiles.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListInstanceProfiles.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListInstanceProfiles", []))

    @jsii.member(jsii_name="toListJobs")
    def to_list_jobs(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the information of jobs within a run.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListJobs.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListJobs", []))

    @jsii.member(jsii_name="toListNetworkProfiles")
    def to_list_network_profiles(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the information of network profiles within a project.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListNetworkProfiles.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListNetworkProfiles", []))

    @jsii.member(jsii_name="toListOfferingPromotions")
    def to_list_offering_promotions(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the offering promotions.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListOfferingPromotions.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListOfferingPromotions", []))

    @jsii.member(jsii_name="toListOfferings")
    def to_list_offerings(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the products or offerings that the user can manage through the API.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListOfferings.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListOfferings", []))

    @jsii.member(jsii_name="toListOfferingTransactions")
    def to_list_offering_transactions(self) -> "Devicefarm":
        '''(experimental) Grants permission to list all of the historical purchases, renewals, and system renewal transactions for an AWS account.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListOfferingTransactions.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListOfferingTransactions", []))

    @jsii.member(jsii_name="toListProjects")
    def to_list_projects(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the information of mobile testing projects for an AWS account.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListProjects.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListProjects", []))

    @jsii.member(jsii_name="toListRemoteAccessSessions")
    def to_list_remote_access_sessions(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the information of currently running remote access sessions.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListRemoteAccessSessions.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListRemoteAccessSessions", []))

    @jsii.member(jsii_name="toListRuns")
    def to_list_runs(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the information of runs within a project.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListRuns.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListRuns", []))

    @jsii.member(jsii_name="toListSamples")
    def to_list_samples(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the information of samples within a project.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListSamples.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListSamples", []))

    @jsii.member(jsii_name="toListSuites")
    def to_list_suites(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the information of testing suites within a job.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListSuites.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListSuites", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the tags of a resource.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTestGridProjects")
    def to_list_test_grid_projects(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the information of desktop testing projects for an AWS account.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListTestGridProjects.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListTestGridProjects", []))

    @jsii.member(jsii_name="toListTestGridSessionActions")
    def to_list_test_grid_session_actions(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the session actions performed during a test grid session.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListTestGridSessionActions.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListTestGridSessionActions", []))

    @jsii.member(jsii_name="toListTestGridSessionArtifacts")
    def to_list_test_grid_session_artifacts(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the artifacts generated by a test grid session.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListTestGridSessionArtifacts.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListTestGridSessionArtifacts", []))

    @jsii.member(jsii_name="toListTestGridSessions")
    def to_list_test_grid_sessions(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the sessions within a test grid project.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListTestGridSessions.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListTestGridSessions", []))

    @jsii.member(jsii_name="toListTests")
    def to_list_tests(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the information of tests within a testing suite.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListTests.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListTests", []))

    @jsii.member(jsii_name="toListUniqueProblems")
    def to_list_unique_problems(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the information of unique problems within a run.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListUniqueProblems.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListUniqueProblems", []))

    @jsii.member(jsii_name="toListUploads")
    def to_list_uploads(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the information of uploads within a project.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListUploads.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListUploads", []))

    @jsii.member(jsii_name="toListVPCEConfigurations")
    def to_list_vpce_configurations(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the information of Amazon Virtual Private Cloud (VPC) endpoint configurations.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListVPCEConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListVPCEConfigurations", []))

    @jsii.member(jsii_name="toPurchaseOffering")
    def to_purchase_offering(self) -> "Devicefarm":
        '''(experimental) Grants permission to purchase offerings for an AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_PurchaseOffering.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toPurchaseOffering", []))

    @jsii.member(jsii_name="toRenewOffering")
    def to_renew_offering(self) -> "Devicefarm":
        '''(experimental) Grants permission to set the quantity of devices to renew for an offering.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_RenewOffering.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toRenewOffering", []))

    @jsii.member(jsii_name="toScheduleRun")
    def to_schedule_run(self) -> "Devicefarm":
        '''(experimental) Grants permission to schedule a run.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ScheduleRun.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toScheduleRun", []))

    @jsii.member(jsii_name="toStopJob")
    def to_stop_job(self) -> "Devicefarm":
        '''(experimental) Grants permission to terminate a running job.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_StopJob.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toStopJob", []))

    @jsii.member(jsii_name="toStopRemoteAccessSession")
    def to_stop_remote_access_session(self) -> "Devicefarm":
        '''(experimental) Grants permission to terminate a running remote access session.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_StopRemoteAccessSession.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toStopRemoteAccessSession", []))

    @jsii.member(jsii_name="toStopRun")
    def to_stop_run(self) -> "Devicefarm":
        '''(experimental) Grants permission to terminate a running test run.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_StopRun.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toStopRun", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Devicefarm":
        '''(experimental) Grants permission to add tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Devicefarm":
        '''(experimental) Grants permission to remove tags from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateDeviceInstance")
    def to_update_device_instance(self) -> "Devicefarm":
        '''(experimental) Grants permission to modify an existing device instance.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_UpdateDeviceInstance.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toUpdateDeviceInstance", []))

    @jsii.member(jsii_name="toUpdateDevicePool")
    def to_update_device_pool(self) -> "Devicefarm":
        '''(experimental) Grants permission to modify an existing device pool.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_UpdateDevicePool.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toUpdateDevicePool", []))

    @jsii.member(jsii_name="toUpdateInstanceProfile")
    def to_update_instance_profile(self) -> "Devicefarm":
        '''(experimental) Grants permission to modify an existing instance profile.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_UpdateInstanceProfile.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toUpdateInstanceProfile", []))

    @jsii.member(jsii_name="toUpdateNetworkProfile")
    def to_update_network_profile(self) -> "Devicefarm":
        '''(experimental) Grants permission to modify an existing network profile.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_UpdateNetworkProfile.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toUpdateNetworkProfile", []))

    @jsii.member(jsii_name="toUpdateProject")
    def to_update_project(self) -> "Devicefarm":
        '''(experimental) Grants permission to modify an existing mobile testing project.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_UpdateProject.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toUpdateProject", []))

    @jsii.member(jsii_name="toUpdateTestGridProject")
    def to_update_test_grid_project(self) -> "Devicefarm":
        '''(experimental) Grants permission to modify an existing desktop testing project.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_UpdateTestGridProject.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toUpdateTestGridProject", []))

    @jsii.member(jsii_name="toUpdateUpload")
    def to_update_upload(self) -> "Devicefarm":
        '''(experimental) Grants permission to modify an existing upload.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_UpdateUpload.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toUpdateUpload", []))

    @jsii.member(jsii_name="toUpdateVPCEConfiguration")
    def to_update_vpce_configuration(self) -> "Devicefarm":
        '''(experimental) Grants permission to modify an existing Amazon Virtual Private Cloud (VPC) endpoint configuration.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_UpdateVPCEConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toUpdateVPCEConfiguration", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class DevopsGuru(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.DevopsGuru",
):
    '''(experimental) Statement provider for service `devops-guru <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazondevopsguru.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `devops-guru <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazondevopsguru.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(DevopsGuru, self, [sid])

    @jsii.member(jsii_name="onTopic")
    def on_topic(
        self,
        topic_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "DevopsGuru":
        '''(experimental) Adds a resource of type topic to the statement.

        https://docs.aws.amazon.com/devops-guru/latest/userguide/CreateTopic.html

        :param topic_name: - Identifier for the topicName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "onTopic", [topic_name, account, region, partition]))

    @jsii.member(jsii_name="toAddNotificationChannel")
    def to_add_notification_channel(self) -> "DevopsGuru":
        '''(experimental) Grants permission to add a notification channel to DevOps Guru.

        Access Level: Write

        Dependent actions:

        - sns:GetTopicAttributes
        - sns:SetTopicAttributes

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_AddNotificationChannel.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toAddNotificationChannel", []))

    @jsii.member(jsii_name="toDescribeAccountHealth")
    def to_describe_account_health(self) -> "DevopsGuru":
        '''(experimental) Grants permission to view the health of operations in your AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_DescribeAccountHealth.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toDescribeAccountHealth", []))

    @jsii.member(jsii_name="toDescribeAccountOverview")
    def to_describe_account_overview(self) -> "DevopsGuru":
        '''(experimental) Grants permission to view the health of operations within a time range in your AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_DescribeAccountOverview.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toDescribeAccountOverview", []))

    @jsii.member(jsii_name="toDescribeAnomaly")
    def to_describe_anomaly(self) -> "DevopsGuru":
        '''(experimental) Grants permission to list the details of a specified anomaly.

        Access Level: Read

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_DescribeAnomaly.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toDescribeAnomaly", []))

    @jsii.member(jsii_name="toDescribeInsight")
    def to_describe_insight(self) -> "DevopsGuru":
        '''(experimental) Grants permission to list the details of a specified insight.

        Access Level: Read

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_DescribeInsight.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toDescribeInsight", []))

    @jsii.member(jsii_name="toDescribeResourceCollectionHealth")
    def to_describe_resource_collection_health(self) -> "DevopsGuru":
        '''(experimental) Grants permission to view the health of operations for each AWS CloudFormation stack specified in DevOps Guru.

        Access Level: Read

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_DescribeResourceCollectionHealth.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toDescribeResourceCollectionHealth", []))

    @jsii.member(jsii_name="toDescribeServiceIntegration")
    def to_describe_service_integration(self) -> "DevopsGuru":
        '''(experimental) Grants permission to view the integration status of services that can be integrated with DevOps Guru.

        Access Level: Read

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_DescribeServiceIntegration.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toDescribeServiceIntegration", []))

    @jsii.member(jsii_name="toGetResourceCollection")
    def to_get_resource_collection(self) -> "DevopsGuru":
        '''(experimental) Grants permission to list AWS CloudFormation stacks that DevOps Guru is configured to use.

        Access Level: Read

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_GetResourceCollection.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toGetResourceCollection", []))

    @jsii.member(jsii_name="toListAnomaliesForInsight")
    def to_list_anomalies_for_insight(self) -> "DevopsGuru":
        '''(experimental) Grants permission to list anomalies of a given insight in your account.

        Access Level: List

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_ListAnomaliesForInsight.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toListAnomaliesForInsight", []))

    @jsii.member(jsii_name="toListEvents")
    def to_list_events(self) -> "DevopsGuru":
        '''(experimental) Grants permission to list resource events that are evaluated by DevOps Guru.

        Access Level: List

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_ListEvents.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toListEvents", []))

    @jsii.member(jsii_name="toListInsights")
    def to_list_insights(self) -> "DevopsGuru":
        '''(experimental) Grants permission to list insights in your account.

        Access Level: List

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_ListInsights.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toListInsights", []))

    @jsii.member(jsii_name="toListNotificationChannels")
    def to_list_notification_channels(self) -> "DevopsGuru":
        '''(experimental) Grants permission to list notification channels configured for DevOps Guru in your account.

        Access Level: List

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_ListNotificationChannels.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toListNotificationChannels", []))

    @jsii.member(jsii_name="toListRecommendations")
    def to_list_recommendations(self) -> "DevopsGuru":
        '''(experimental) Grants permission to list a specified insight's recommendations.

        Access Level: List

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_ListRecommendations.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toListRecommendations", []))

    @jsii.member(jsii_name="toPutFeedback")
    def to_put_feedback(self) -> "DevopsGuru":
        '''(experimental) Grants permission to submit a feedback to DevOps Guru.

        Access Level: Write

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_PutFeedback.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toPutFeedback", []))

    @jsii.member(jsii_name="toRemoveNotificationChannel")
    def to_remove_notification_channel(self) -> "DevopsGuru":
        '''(experimental) Grants permission to remove a notification channel from DevOps Guru.

        Access Level: Write

        Dependent actions:

        - sns:GetTopicAttributes
        - sns:SetTopicAttributes

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_RemoveNotificationChannel.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toRemoveNotificationChannel", []))

    @jsii.member(jsii_name="toSearchInsights")
    def to_search_insights(self) -> "DevopsGuru":
        '''(experimental) Grants permission to search insights in your account.

        Access Level: List

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_SearchInsights.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toSearchInsights", []))

    @jsii.member(jsii_name="toUpdateResourceCollection")
    def to_update_resource_collection(self) -> "DevopsGuru":
        '''(experimental) Grants permission to update the list of AWS CloudFormation stacks that are used to specify which AWS resources in your account are analyzed by DevOps Guru.

        Access Level: Write

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_UpdateResourceCollection.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toUpdateResourceCollection", []))

    @jsii.member(jsii_name="toUpdateServiceIntegration")
    def to_update_service_integration(self) -> "DevopsGuru":
        '''(experimental) Grants permissions to enable or disable a service that integrates with DevOps Guru.

        Access Level: Write

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_UpdateServiceIntegration.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toUpdateServiceIntegration", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Directconnect(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Directconnect",
):
    '''(experimental) Statement provider for service `directconnect <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdirectconnect.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `directconnect <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdirectconnect.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Directconnect, self, [sid])

    @jsii.member(jsii_name="onDxcon")
    def on_dxcon(
        self,
        connection_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Directconnect":
        '''(experimental) Adds a resource of type dxcon to the statement.

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_Connection.html

        :param connection_id: - Identifier for the connectionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "onDxcon", [connection_id, account, region, partition]))

    @jsii.member(jsii_name="onDxGateway")
    def on_dx_gateway(
        self,
        direct_connect_gateway_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Directconnect":
        '''(experimental) Adds a resource of type dx-gateway to the statement.

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DirectConnectGateway.html

        :param direct_connect_gateway_id: - Identifier for the directConnectGatewayId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "onDxGateway", [direct_connect_gateway_id, account, partition]))

    @jsii.member(jsii_name="onDxlag")
    def on_dxlag(
        self,
        lag_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Directconnect":
        '''(experimental) Adds a resource of type dxlag to the statement.

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_Lag.html

        :param lag_id: - Identifier for the lagId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "onDxlag", [lag_id, account, region, partition]))

    @jsii.member(jsii_name="onDxvif")
    def on_dxvif(
        self,
        virtual_interface_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Directconnect":
        '''(experimental) Adds a resource of type dxvif to the statement.

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_VirtualInterface.html

        :param virtual_interface_id: - Identifier for the virtualInterfaceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "onDxvif", [virtual_interface_id, account, region, partition]))

    @jsii.member(jsii_name="toAcceptDirectConnectGatewayAssociationProposal")
    def to_accept_direct_connect_gateway_association_proposal(self) -> "Directconnect":
        '''(experimental) Accepts a proposal request to attach a virtual private gateway to a Direct Connect gateway.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_AcceptDirectConnectGatewayAssociationProposal.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toAcceptDirectConnectGatewayAssociationProposal", []))

    @jsii.member(jsii_name="toAllocateConnectionOnInterconnect")
    def to_allocate_connection_on_interconnect(self) -> "Directconnect":
        '''(experimental) Creates a hosted connection on an interconnect.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_AllocateConnectionOnInterconnect.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toAllocateConnectionOnInterconnect", []))

    @jsii.member(jsii_name="toAllocateHostedConnection")
    def to_allocate_hosted_connection(self) -> "Directconnect":
        '''(experimental) Creates a new hosted connection between a AWS Direct Connect partner's network and a specific AWS Direct Connect location.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_AllocateHostedConnection.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toAllocateHostedConnection", []))

    @jsii.member(jsii_name="toAllocatePrivateVirtualInterface")
    def to_allocate_private_virtual_interface(self) -> "Directconnect":
        '''(experimental) Provisions a private virtual interface to be owned by a different customer.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_AllocatePrivateVirtualInterface.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toAllocatePrivateVirtualInterface", []))

    @jsii.member(jsii_name="toAllocatePublicVirtualInterface")
    def to_allocate_public_virtual_interface(self) -> "Directconnect":
        '''(experimental) Provisions a public virtual interface to be owned by a different customer.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_AllocatePublicVirtualInterface.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toAllocatePublicVirtualInterface", []))

    @jsii.member(jsii_name="toAllocateTransitVirtualInterface")
    def to_allocate_transit_virtual_interface(self) -> "Directconnect":
        '''(experimental) Provisions a transit virtual interface to be owned by a different customer.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_AllocateTransitVirtualInterface.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toAllocateTransitVirtualInterface", []))

    @jsii.member(jsii_name="toAssociateConnectionWithLag")
    def to_associate_connection_with_lag(self) -> "Directconnect":
        '''(experimental) Associates a connection with a LAG.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_AssociateConnectionWithLag.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toAssociateConnectionWithLag", []))

    @jsii.member(jsii_name="toAssociateHostedConnection")
    def to_associate_hosted_connection(self) -> "Directconnect":
        '''(experimental) Associates a hosted connection and its virtual interfaces with a link aggregation group (LAG) or interconnect.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_AssociateHostedConnection.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toAssociateHostedConnection", []))

    @jsii.member(jsii_name="toAssociateVirtualInterface")
    def to_associate_virtual_interface(self) -> "Directconnect":
        '''(experimental) Associates a virtual interface with a specified link aggregation group (LAG) or connection.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_AssociateVirtualInterface.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toAssociateVirtualInterface", []))

    @jsii.member(jsii_name="toConfirmConnection")
    def to_confirm_connection(self) -> "Directconnect":
        '''(experimental) Confirm the creation of a hosted connection on an interconnect.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_ConfirmConnection.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toConfirmConnection", []))

    @jsii.member(jsii_name="toConfirmPrivateVirtualInterface")
    def to_confirm_private_virtual_interface(self) -> "Directconnect":
        '''(experimental) Accept ownership of a private virtual interface created by another customer.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_ConfirmPrivateVirtualInterface.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toConfirmPrivateVirtualInterface", []))

    @jsii.member(jsii_name="toConfirmPublicVirtualInterface")
    def to_confirm_public_virtual_interface(self) -> "Directconnect":
        '''(experimental) Accept ownership of a public virtual interface created by another customer.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_ConfirmPublicVirtualInterface.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toConfirmPublicVirtualInterface", []))

    @jsii.member(jsii_name="toConfirmTransitVirtualInterface")
    def to_confirm_transit_virtual_interface(self) -> "Directconnect":
        '''(experimental) Accept ownership of a transit virtual interface created by another customer.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_ConfirmTransitVirtualInterface.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toConfirmTransitVirtualInterface", []))

    @jsii.member(jsii_name="toCreateBGPPeer")
    def to_create_bgp_peer(self) -> "Directconnect":
        '''(experimental) Creates a BGP peer on the specified virtual interface.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_CreateBGPPeer.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toCreateBGPPeer", []))

    @jsii.member(jsii_name="toCreateConnection")
    def to_create_connection(self) -> "Directconnect":
        '''(experimental) Creates a new connection between the customer network and a specific AWS Direct Connect location.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_CreateConnection.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toCreateConnection", []))

    @jsii.member(jsii_name="toCreateDirectConnectGateway")
    def to_create_direct_connect_gateway(self) -> "Directconnect":
        '''(experimental) Creates a Direct Connect gateway, which is an intermediate object that enables you to connect a set of virtual interfaces and virtual private gateways.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_CreateDirectConnectGateway.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toCreateDirectConnectGateway", []))

    @jsii.member(jsii_name="toCreateDirectConnectGatewayAssociation")
    def to_create_direct_connect_gateway_association(self) -> "Directconnect":
        '''(experimental) Creates an association between a Direct Connect gateway and a virtual private gateway.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_CreateDirectConnectGatewayAssociation.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toCreateDirectConnectGatewayAssociation", []))

    @jsii.member(jsii_name="toCreateDirectConnectGatewayAssociationProposal")
    def to_create_direct_connect_gateway_association_proposal(self) -> "Directconnect":
        '''(experimental) Creates a proposal to associate the specified virtual private gateway with the specified Direct Connect gateway.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_CreateDirectConnectGatewayAssociationProposal.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toCreateDirectConnectGatewayAssociationProposal", []))

    @jsii.member(jsii_name="toCreateInterconnect")
    def to_create_interconnect(self) -> "Directconnect":
        '''(experimental) Creates a new interconnect between a AWS Direct Connect partner's network and a specific AWS Direct Connect location.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_CreateInterconnect.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toCreateInterconnect", []))

    @jsii.member(jsii_name="toCreateLag")
    def to_create_lag(self) -> "Directconnect":
        '''(experimental) Creates a link aggregation group (LAG) with the specified number of bundled physical connections between the customer network and a specific AWS Direct Connect location.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_CreateLag.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toCreateLag", []))

    @jsii.member(jsii_name="toCreatePrivateVirtualInterface")
    def to_create_private_virtual_interface(self) -> "Directconnect":
        '''(experimental) Creates a new private virtual interface.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_CreatePrivateVirtualInterface.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toCreatePrivateVirtualInterface", []))

    @jsii.member(jsii_name="toCreatePublicVirtualInterface")
    def to_create_public_virtual_interface(self) -> "Directconnect":
        '''(experimental) Creates a new public virtual interface.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_CreatePublicVirtualInterface.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toCreatePublicVirtualInterface", []))

    @jsii.member(jsii_name="toCreateTransitVirtualInterface")
    def to_create_transit_virtual_interface(self) -> "Directconnect":
        '''(experimental) Creates a new transit virtual interface.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_CreateTransitVirtualInterface.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toCreateTransitVirtualInterface", []))

    @jsii.member(jsii_name="toDeleteBGPPeer")
    def to_delete_bgp_peer(self) -> "Directconnect":
        '''(experimental) Deletes the specified BGP peer on the specified virtual interface with the specified customer address and ASN.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DeleteBGPPeer.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDeleteBGPPeer", []))

    @jsii.member(jsii_name="toDeleteConnection")
    def to_delete_connection(self) -> "Directconnect":
        '''(experimental) Deletes the connection.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DeleteConnection.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDeleteConnection", []))

    @jsii.member(jsii_name="toDeleteDirectConnectGateway")
    def to_delete_direct_connect_gateway(self) -> "Directconnect":
        '''(experimental) Deletes the specified Direct Connect gateway.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DeleteDirectConnectGateway.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDeleteDirectConnectGateway", []))

    @jsii.member(jsii_name="toDeleteDirectConnectGatewayAssociation")
    def to_delete_direct_connect_gateway_association(self) -> "Directconnect":
        '''(experimental) Deletes the association between the specified Direct Connect gateway and virtual private gateway.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DeleteDirectConnectGatewayAssociation.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDeleteDirectConnectGatewayAssociation", []))

    @jsii.member(jsii_name="toDeleteDirectConnectGatewayAssociationProposal")
    def to_delete_direct_connect_gateway_association_proposal(self) -> "Directconnect":
        '''(experimental) Deletes the association proposal request between the specified Direct Connect gateway and virtual private gateway.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DeleteDirectConnectGatewayAssociationProposal.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDeleteDirectConnectGatewayAssociationProposal", []))

    @jsii.member(jsii_name="toDeleteInterconnect")
    def to_delete_interconnect(self) -> "Directconnect":
        '''(experimental) Deletes the specified interconnect.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DeleteInterconnect.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDeleteInterconnect", []))

    @jsii.member(jsii_name="toDeleteLag")
    def to_delete_lag(self) -> "Directconnect":
        '''(experimental) Deletes the specified link aggregation group (LAG).

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DeleteLag.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDeleteLag", []))

    @jsii.member(jsii_name="toDeleteVirtualInterface")
    def to_delete_virtual_interface(self) -> "Directconnect":
        '''(experimental) Deletes a virtual interface.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DeleteVirtualInterface.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDeleteVirtualInterface", []))

    @jsii.member(jsii_name="toDescribeConnectionLoa")
    def to_describe_connection_loa(self) -> "Directconnect":
        '''(experimental) Returns the LOA-CFA for a Connection.

        Access Level: Read

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeConnectionLoa.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDescribeConnectionLoa", []))

    @jsii.member(jsii_name="toDescribeConnections")
    def to_describe_connections(self) -> "Directconnect":
        '''(experimental) Displays all connections in this region.

        Access Level: Read

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeConnections.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDescribeConnections", []))

    @jsii.member(jsii_name="toDescribeConnectionsOnInterconnect")
    def to_describe_connections_on_interconnect(self) -> "Directconnect":
        '''(experimental) Return a list of connections that have been provisioned on the given interconnect.

        Access Level: Read

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeConnectionsOnInterconnect.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDescribeConnectionsOnInterconnect", []))

    @jsii.member(jsii_name="toDescribeDirectConnectGatewayAssociationProposals")
    def to_describe_direct_connect_gateway_association_proposals(
        self,
    ) -> "Directconnect":
        '''(experimental) Describes one or more association proposals for connection between a virtual private gateway and a Direct Connect gateway.

        Access Level: Read

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeDirectConnectGatewayAssociationProposals.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDescribeDirectConnectGatewayAssociationProposals", []))

    @jsii.member(jsii_name="toDescribeDirectConnectGatewayAssociations")
    def to_describe_direct_connect_gateway_associations(self) -> "Directconnect":
        '''(experimental) Lists the associations between your Direct Connect gateways and virtual private gateways.

        Access Level: Read

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeDirectConnectGatewayAssociations.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDescribeDirectConnectGatewayAssociations", []))

    @jsii.member(jsii_name="toDescribeDirectConnectGatewayAttachments")
    def to_describe_direct_connect_gateway_attachments(self) -> "Directconnect":
        '''(experimental) Lists the attachments between your Direct Connect gateways and virtual interfaces.

        Access Level: Read

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeDirectConnectGatewayAttachments.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDescribeDirectConnectGatewayAttachments", []))

    @jsii.member(jsii_name="toDescribeDirectConnectGateways")
    def to_describe_direct_connect_gateways(self) -> "Directconnect":
        '''(experimental) Lists all your Direct Connect gateways or only the specified Direct Connect gateway.

        Access Level: Read

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeDirectConnectGateways.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDescribeDirectConnectGateways", []))

    @jsii.member(jsii_name="toDescribeHostedConnections")
    def to_describe_hosted_connections(self) -> "Directconnect":
        '''(experimental) Lists the hosted connections that have been provisioned on the specified interconnect or link aggregation group (LAG).

        Access Level: Read

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeHostedConnections.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDescribeHostedConnections", []))

    @jsii.member(jsii_name="toDescribeInterconnectLoa")
    def to_describe_interconnect_loa(self) -> "Directconnect":
        '''(experimental) Returns the LOA-CFA for an Interconnect.

        Access Level: Read

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeInterconnectLoa.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDescribeInterconnectLoa", []))

    @jsii.member(jsii_name="toDescribeInterconnects")
    def to_describe_interconnects(self) -> "Directconnect":
        '''(experimental) Returns a list of interconnects owned by the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeInterconnects.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDescribeInterconnects", []))

    @jsii.member(jsii_name="toDescribeLags")
    def to_describe_lags(self) -> "Directconnect":
        '''(experimental) Describes all your link aggregation groups (LAG) or the specified LAG.

        Access Level: Read

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeLags.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDescribeLags", []))

    @jsii.member(jsii_name="toDescribeLoa")
    def to_describe_loa(self) -> "Directconnect":
        '''(experimental) Gets the LOA-CFA for a connection, interconnect, or link aggregation group (LAG).

        Access Level: Read

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeLoa.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDescribeLoa", []))

    @jsii.member(jsii_name="toDescribeLocations")
    def to_describe_locations(self) -> "Directconnect":
        '''(experimental) Returns the list of AWS Direct Connect locations in the current AWS region.

        Access Level: List

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeLocations.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDescribeLocations", []))

    @jsii.member(jsii_name="toDescribeTags")
    def to_describe_tags(self) -> "Directconnect":
        '''(experimental) Describes the tags associated with the specified AWS Direct Connect resources.

        Access Level: Read

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeTags.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDescribeTags", []))

    @jsii.member(jsii_name="toDescribeVirtualGateways")
    def to_describe_virtual_gateways(self) -> "Directconnect":
        '''(experimental) Returns a list of virtual private gateways owned by the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeVirtualGateways.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDescribeVirtualGateways", []))

    @jsii.member(jsii_name="toDescribeVirtualInterfaces")
    def to_describe_virtual_interfaces(self) -> "Directconnect":
        '''(experimental) Displays all virtual interfaces for an AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeVirtualInterfaces.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDescribeVirtualInterfaces", []))

    @jsii.member(jsii_name="toDisassociateConnectionFromLag")
    def to_disassociate_connection_from_lag(self) -> "Directconnect":
        '''(experimental) Disassociates a connection from a link aggregation group (LAG).

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DisassociateConnectionFromLag.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDisassociateConnectionFromLag", []))

    @jsii.member(jsii_name="toListVirtualInterfaceTestHistory")
    def to_list_virtual_interface_test_history(self) -> "Directconnect":
        '''(experimental) Lists the virtual interface failover test history.

        Access Level: List

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_ListVirtualInterfaceTestHistory.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toListVirtualInterfaceTestHistory", []))

    @jsii.member(jsii_name="toStartBgpFailoverTest")
    def to_start_bgp_failover_test(self) -> "Directconnect":
        '''(experimental) Starts the virtual interface failover test that verifies your configuration meets your resiliency requirements by placing the BGP peering session in the DOWN state.

        You can then send traffic to verify that there are no outages.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_StartBgpFailoverTest.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toStartBgpFailoverTest", []))

    @jsii.member(jsii_name="toStopBgpFailoverTest")
    def to_stop_bgp_failover_test(self) -> "Directconnect":
        '''(experimental) Stops the virtual interface failover test.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_StopBgpFailoverTest.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toStopBgpFailoverTest", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Directconnect":
        '''(experimental) Adds the specified tags to the specified AWS Direct Connect resource.

        Each resource can have a maximum of 50 tags.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Directconnect":
        '''(experimental) Removes one or more tags from the specified AWS Direct Connect resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateDirectConnectGatewayAssociation")
    def to_update_direct_connect_gateway_association(self) -> "Directconnect":
        '''(experimental) Updates the specified attributes of the Direct Connect gateway association.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_UpdateDirectConnectGatewayAssociation.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toUpdateDirectConnectGatewayAssociation", []))

    @jsii.member(jsii_name="toUpdateLag")
    def to_update_lag(self) -> "Directconnect":
        '''(experimental) Updates the attributes of the specified link aggregation group (LAG).

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_UpdateLag.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toUpdateLag", []))

    @jsii.member(jsii_name="toUpdateVirtualInterfaceAttributes")
    def to_update_virtual_interface_attributes(self) -> "Directconnect":
        '''(experimental) Updates the specified attributes of the specified virtual private interface.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_UpdateVirtualInterfaceAttributes.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toUpdateVirtualInterfaceAttributes", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Discovery(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Discovery",
):
    '''(experimental) Statement provider for service `discovery <https://docs.aws.amazon.com/service-authorization/latest/reference/list_applicationdiscovery.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `discovery <https://docs.aws.amazon.com/service-authorization/latest/reference/list_applicationdiscovery.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Discovery, self, [sid])

    @jsii.member(jsii_name="toAssociateConfigurationItemsToApplication")
    def to_associate_configuration_items_to_application(self) -> "Discovery":
        '''(experimental) Associates one or more configuration items with an application.

        Access Level: Write

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_AssociateConfigurationItemsToApplication.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toAssociateConfigurationItemsToApplication", []))

    @jsii.member(jsii_name="toBatchDeleteImportData")
    def to_batch_delete_import_data(self) -> "Discovery":
        '''(experimental) Deletes one or more Migration Hub import tasks, each identified by their import ID.

        Each import task has a number of records, which can identify servers or applications.

        Access Level: Write

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_BatchDeleteImportData.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toBatchDeleteImportData", []))

    @jsii.member(jsii_name="toCreateApplication")
    def to_create_application(self) -> "Discovery":
        '''(experimental) Creates an application with the given name and description.

        Access Level: Write

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_CreateApplication.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toCreateApplication", []))

    @jsii.member(jsii_name="toCreateTags")
    def to_create_tags(self) -> "Discovery":
        '''(experimental) Creates one or more tags for configuration items.

        Tags are metadata that help you categorize IT assets. This API accepts a list of multiple configuration items.

        Access Level: Tagging

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_CreateTags.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toCreateTags", []))

    @jsii.member(jsii_name="toDeleteApplications")
    def to_delete_applications(self) -> "Discovery":
        '''(experimental) Deletes a list of applications and their associations with configuration items.

        Access Level: Write

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_DeleteApplications.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toDeleteApplications", []))

    @jsii.member(jsii_name="toDeleteTags")
    def to_delete_tags(self) -> "Discovery":
        '''(experimental) Deletes the association between configuration items and one or more tags.

        This API accepts a list of multiple configuration items.

        Access Level: Tagging

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_DeleteTags.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toDeleteTags", []))

    @jsii.member(jsii_name="toDescribeAgents")
    def to_describe_agents(self) -> "Discovery":
        '''(experimental) Lists agents or the Connector by ID or lists all agents/Connectors associated with your user account if you did not specify an ID.

        Access Level: Read

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_DescribeAgents.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toDescribeAgents", []))

    @jsii.member(jsii_name="toDescribeConfigurations")
    def to_describe_configurations(self) -> "Discovery":
        '''(experimental) Retrieves attributes for a list of configuration item IDs.

        All of the supplied IDs must be for the same asset type (server, application, process, or connection). Output fields are specific to the asset type selected. For example, the output for a server configuration item includes a list of attributes about the server, such as host name, operating system, and number of network cards.

        Access Level: Read

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_DescribeConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toDescribeConfigurations", []))

    @jsii.member(jsii_name="toDescribeContinuousExports")
    def to_describe_continuous_exports(self) -> "Discovery":
        '''(experimental) Lists exports as specified by ID.

        All continuous exports associated with your user account can be listed if you call DescribeContinuousExports as is without passing any parameters.

        Access Level: Read

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_DescribeContinuousExports.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toDescribeContinuousExports", []))

    @jsii.member(jsii_name="toDescribeExportConfigurations")
    def to_describe_export_configurations(self) -> "Discovery":
        '''(experimental) Retrieves the status of a given export process. You can retrieve status from a maximum of 100 processes.

        Access Level: Read

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_DescribeExportConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toDescribeExportConfigurations", []))

    @jsii.member(jsii_name="toDescribeExportTasks")
    def to_describe_export_tasks(self) -> "Discovery":
        '''(experimental) Retrieve status of one or more export tasks. You can retrieve the status of up to 100 export tasks.

        Access Level: Read

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_DescribeExportTasks.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toDescribeExportTasks", []))

    @jsii.member(jsii_name="toDescribeImportTasks")
    def to_describe_import_tasks(self) -> "Discovery":
        '''(experimental) Returns an array of import tasks for your account, including status information, times, IDs, the Amazon S3 Object URL for the import file, and more.

        Access Level: List

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_DescribeImportTasks.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toDescribeImportTasks", []))

    @jsii.member(jsii_name="toDescribeTags")
    def to_describe_tags(self) -> "Discovery":
        '''(experimental) Retrieves a list of configuration items that are tagged with a specific tag.

        Or retrieves a list of all tags assigned to a specific configuration item.

        Access Level: Read

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_DescribeTags.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toDescribeTags", []))

    @jsii.member(jsii_name="toDisassociateConfigurationItemsFromApplication")
    def to_disassociate_configuration_items_from_application(self) -> "Discovery":
        '''(experimental) Disassociates one or more configuration items from an application.

        Access Level: Write

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_DisassociateConfigurationItemsFromApplication.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toDisassociateConfigurationItemsFromApplication", []))

    @jsii.member(jsii_name="toExportConfigurations")
    def to_export_configurations(self) -> "Discovery":
        '''(experimental) Exports all discovered configuration data to an Amazon S3 bucket or an application that enables you to view and evaluate the data.

        Data includes tags and tag associations, processes, connections, servers, and system performance.

        Access Level: Write

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_ExportConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toExportConfigurations", []))

    @jsii.member(jsii_name="toGetDiscoverySummary")
    def to_get_discovery_summary(self) -> "Discovery":
        '''(experimental) Retrieves a short summary of discovered assets.

        Access Level: Read

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_GetDiscoverySummary.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toGetDiscoverySummary", []))

    @jsii.member(jsii_name="toListConfigurations")
    def to_list_configurations(self) -> "Discovery":
        '''(experimental) Retrieves a list of configuration items according to criteria you specify in a filter.

        The filter criteria identify relationship requirements.

        Access Level: List

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_ListConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toListConfigurations", []))

    @jsii.member(jsii_name="toListServerNeighbors")
    def to_list_server_neighbors(self) -> "Discovery":
        '''(experimental) Retrieves a list of servers which are one network hop away from a specified server.

        Access Level: List

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_ListServerNeighbors.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toListServerNeighbors", []))

    @jsii.member(jsii_name="toStartContinuousExport")
    def to_start_continuous_export(self) -> "Discovery":
        '''(experimental) Start the continuous flow of agent's discovered data into Amazon Athena.

        Access Level: Write

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_StartContinuousExport.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toStartContinuousExport", []))

    @jsii.member(jsii_name="toStartDataCollectionByAgentIds")
    def to_start_data_collection_by_agent_ids(self) -> "Discovery":
        '''(experimental) Instructs the specified agents or Connectors to start collecting data.

        Access Level: Write

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_StartDataCollectionByAgentIds.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toStartDataCollectionByAgentIds", []))

    @jsii.member(jsii_name="toStartExportTask")
    def to_start_export_task(self) -> "Discovery":
        '''(experimental) Export the configuration data about discovered configuration items and relationships to an S3 bucket in a specified format.

        Access Level: Write

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_StartExportTask.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toStartExportTask", []))

    @jsii.member(jsii_name="toStartImportTask")
    def to_start_import_task(self) -> "Discovery":
        '''(experimental) Starts an import task.

        The Migration Hub import feature allows you to import details of your on-premises environment directly into AWS without having to use the Application Discovery Service (ADS) tools such as the Discovery Connector or Discovery Agent. This gives you the option to perform migration assessment and planning directly from your imported data including the ability to group your devices as applications and track their migration status.

        Access Level: Write

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_StartImportTask.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toStartImportTask", []))

    @jsii.member(jsii_name="toStopContinuousExport")
    def to_stop_continuous_export(self) -> "Discovery":
        '''(experimental) Stop the continuous flow of agent's discovered data into Amazon Athena.

        Access Level: Write

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_StopContinuousExport.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toStopContinuousExport", []))

    @jsii.member(jsii_name="toStopDataCollectionByAgentIds")
    def to_stop_data_collection_by_agent_ids(self) -> "Discovery":
        '''(experimental) Instructs the specified agents or Connectors to stop collecting data.

        Access Level: Write

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_StopDataCollectionByAgentIds.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toStopDataCollectionByAgentIds", []))

    @jsii.member(jsii_name="toUpdateApplication")
    def to_update_application(self) -> "Discovery":
        '''(experimental) Updates metadata about an application.

        Access Level: Write

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_UpdateApplication.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toUpdateApplication", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Dlm(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Dlm"):
    '''(experimental) Statement provider for service `dlm <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazondatalifecyclemanager.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `dlm <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazondatalifecyclemanager.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Dlm, self, [sid])

    @jsii.member(jsii_name="onPolicy")
    def on_policy(
        self,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dlm":
        '''(experimental) Adds a resource of type policy to the statement.

        https://docs.aws.amazon.com/dlm/latest/APIReference/API_LifecyclePolicy.html

        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Dlm", jsii.invoke(self, "onPolicy", [resource_name, account, region, partition]))

    @jsii.member(jsii_name="toCreateLifecyclePolicy")
    def to_create_lifecycle_policy(self) -> "Dlm":
        '''(experimental) Create a data lifecycle policy to manage the scheduled creation and retention of Amazon EBS snapshots.

        You may have up to 100 policies.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/dlm/latest/APIReference/API_CreateLifecyclePolicy.html

        :stability: experimental
        '''
        return typing.cast("Dlm", jsii.invoke(self, "toCreateLifecyclePolicy", []))

    @jsii.member(jsii_name="toDeleteLifecyclePolicy")
    def to_delete_lifecycle_policy(self) -> "Dlm":
        '''(experimental) Delete an existing data lifecycle policy.

        In addition, this action halts the creation and deletion of snapshots that the policy specified. Existing snapshots are not affected.

        Access Level: Write

        https://docs.aws.amazon.com/dlm/latest/APIReference/API_DeleteLifecyclePolicy.html

        :stability: experimental
        '''
        return typing.cast("Dlm", jsii.invoke(self, "toDeleteLifecyclePolicy", []))

    @jsii.member(jsii_name="toGetLifecyclePolicies")
    def to_get_lifecycle_policies(self) -> "Dlm":
        '''(experimental) Returns a list of summary descriptions of data lifecycle policies.

        Access Level: List

        https://docs.aws.amazon.com/dlm/latest/APIReference/API_GetLifecyclePolicies.html

        :stability: experimental
        '''
        return typing.cast("Dlm", jsii.invoke(self, "toGetLifecyclePolicies", []))

    @jsii.member(jsii_name="toGetLifecyclePolicy")
    def to_get_lifecycle_policy(self) -> "Dlm":
        '''(experimental) Returns a complete description of a single data lifecycle policy.

        Access Level: Read

        https://docs.aws.amazon.com/dlm/latest/APIReference/API_GetLifecyclePolicy.html

        :stability: experimental
        '''
        return typing.cast("Dlm", jsii.invoke(self, "toGetLifecyclePolicy", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Dlm":
        '''(experimental) Grants permission to list the tags associated with a resource.

        Access Level: Read

        https://docs.aws.amazon.com/dlm/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Dlm", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Dlm":
        '''(experimental) Grants permission to add or update tags of a resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/dlm/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Dlm", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Dlm":
        '''(experimental) Grants permission to remove associated with a resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/dlm/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Dlm", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateLifecyclePolicy")
    def to_update_lifecycle_policy(self) -> "Dlm":
        '''(experimental) Updates an existing data lifecycle policy.

        Access Level: Write

        https://docs.aws.amazon.com/dlm/latest/APIReference/API_UpdateLifecyclePolicy.html

        :stability: experimental
        '''
        return typing.cast("Dlm", jsii.invoke(self, "toUpdateLifecyclePolicy", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Dms(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Dms"):
    '''(experimental) Statement provider for service `dms <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdatabasemigrationservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `dms <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdatabasemigrationservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Dms, self, [sid])

    @jsii.member(jsii_name="ifCertTag")
    def if_cert_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Dms":
        '''(experimental) Filters access based on the presence of tag keys in the request for Certificate.

        Applies to resource types:

        - Certificate

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "ifCertTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifEndpointTag")
    def if_endpoint_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Dms":
        '''(experimental) Filters access based on the presence of tag keys in the request for Endpoint.

        Applies to resource types:

        - Endpoint

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "ifEndpointTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifEsTag")
    def if_es_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Dms":
        '''(experimental) Filters access based on the presence of tag keys in the request for EventSubscription.

        Applies to resource types:

        - EventSubscription

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "ifEsTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifRepTag")
    def if_rep_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Dms":
        '''(experimental) Filters access based on the presence of tag keys in the request for ReplicationInstance.

        Applies to resource types:

        - ReplicationInstance

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "ifRepTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifReqTag")
    def if_req_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Dms":
        '''(experimental) Filters access based on the presence of tag key-value pairs in the request.

        Applies to actions:

        - .toAddTagsToResource()
        - .toCreateEndpoint()
        - .toCreateEventSubscription()
        - .toCreateReplicationInstance()
        - .toCreateReplicationSubnetGroup()
        - .toCreateReplicationTask()

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "ifReqTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifSubgrpTag")
    def if_subgrp_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Dms":
        '''(experimental) Filters access based on the presence of tag keys in the request for ReplicationSubnetGroup.

        Applies to resource types:

        - ReplicationSubnetGroup

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "ifSubgrpTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifTaskTag")
    def if_task_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Dms":
        '''(experimental) Filters access based on the presence of tag keys in the request for ReplicationTask.

        Applies to resource types:

        - ReplicationTask

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "ifTaskTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="onCertificate")
    def on_certificate(
        self,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dms":
        '''(experimental) Adds a resource of type Certificate to the statement.

        https://docs.aws.amazon.com/dms/latest/APIReference/API_Certificate.html

        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifCertTag()

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "onCertificate", [resource_name, account, region, partition]))

    @jsii.member(jsii_name="onEndpoint")
    def on_endpoint(
        self,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dms":
        '''(experimental) Adds a resource of type Endpoint to the statement.

        https://docs.aws.amazon.com/dms/latest/APIReference/API_Endpoint.html

        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifEndpointTag()

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "onEndpoint", [resource_name, account, region, partition]))

    @jsii.member(jsii_name="onEventSubscription")
    def on_event_subscription(
        self,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dms":
        '''(experimental) Adds a resource of type EventSubscription to the statement.

        https://docs.aws.amazon.com/dms/latest/APIReference/API_EventSubscription.html

        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifEsTag()

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "onEventSubscription", [resource_name, account, region, partition]))

    @jsii.member(jsii_name="onReplicationInstance")
    def on_replication_instance(
        self,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dms":
        '''(experimental) Adds a resource of type ReplicationInstance to the statement.

        https://docs.aws.amazon.com/dms/latest/APIReference/API_ReplicationInstance.html

        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifRepTag()

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "onReplicationInstance", [resource_name, account, region, partition]))

    @jsii.member(jsii_name="onReplicationSubnetGroup")
    def on_replication_subnet_group(
        self,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dms":
        '''(experimental) Adds a resource of type ReplicationSubnetGroup to the statement.

        https://docs.aws.amazon.com/dms/latest/APIReference/API_ReplicationSubnetGroup.html

        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifSubgrpTag()

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "onReplicationSubnetGroup", [resource_name, account, region, partition]))

    @jsii.member(jsii_name="onReplicationTask")
    def on_replication_task(
        self,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dms":
        '''(experimental) Adds a resource of type ReplicationTask to the statement.

        https://docs.aws.amazon.com/dms/latest/APIReference/API_ReplicationTask.html

        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifTaskTag()

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "onReplicationTask", [resource_name, account, region, partition]))

    @jsii.member(jsii_name="onReplicationTaskAssessmentRun")
    def on_replication_task_assessment_run(
        self,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dms":
        '''(experimental) Adds a resource of type ReplicationTaskAssessmentRun to the statement.

        https://docs.aws.amazon.com/dms/latest/APIReference/API_ReplicationTaskAssessmentRun.html

        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "onReplicationTaskAssessmentRun", [resource_name, account, region, partition]))

    @jsii.member(jsii_name="onReplicationTaskIndividualAssessment")
    def on_replication_task_individual_assessment(
        self,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dms":
        '''(experimental) Adds a resource of type ReplicationTaskIndividualAssessment to the statement.

        https://docs.aws.amazon.com/dms/latest/APIReference/API_ReplicationTaskIndividualAssessment.html

        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "onReplicationTaskIndividualAssessment", [resource_name, account, region, partition]))

    @jsii.member(jsii_name="toAddTagsToResource")
    def to_add_tags_to_resource(self) -> "Dms":
        '''(experimental) Grants permission to add metadata tags to DMS resources, including replication instances, endpoints, security groups, and migration tasks.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        https://docs.aws.amazon.com/dms/latest/APIReference/API_AddTagsToResource.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toAddTagsToResource", []))

    @jsii.member(jsii_name="toApplyPendingMaintenanceAction")
    def to_apply_pending_maintenance_action(self) -> "Dms":
        '''(experimental) Grants permission to apply a pending maintenance action to a resource (for example, to a replication instance).

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_ApplyPendingMaintenanceAction.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toApplyPendingMaintenanceAction", []))

    @jsii.member(jsii_name="toCancelReplicationTaskAssessmentRun")
    def to_cancel_replication_task_assessment_run(self) -> "Dms":
        '''(experimental) Grants permission to cancel a single premigration assessment run.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_CancelReplicationTaskAssessmentRun.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toCancelReplicationTaskAssessmentRun", []))

    @jsii.member(jsii_name="toCreateEndpoint")
    def to_create_endpoint(self) -> "Dms":
        '''(experimental) Grants permission to create an endpoint using the provided settings.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        https://docs.aws.amazon.com/dms/latest/APIReference/API_CreateEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toCreateEndpoint", []))

    @jsii.member(jsii_name="toCreateEventSubscription")
    def to_create_event_subscription(self) -> "Dms":
        '''(experimental) Grants permission to create an AWS DMS event notification subscription.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        https://docs.aws.amazon.com/dms/latest/APIReference/API_CreateEventSubscription.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toCreateEventSubscription", []))

    @jsii.member(jsii_name="toCreateReplicationInstance")
    def to_create_replication_instance(self) -> "Dms":
        '''(experimental) Grants permission to create a replication instance using the specified parameters.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        https://docs.aws.amazon.com/dms/latest/APIReference/API_CreateReplicationInstance.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toCreateReplicationInstance", []))

    @jsii.member(jsii_name="toCreateReplicationSubnetGroup")
    def to_create_replication_subnet_group(self) -> "Dms":
        '''(experimental) Grants permission to create a replication subnet group given a list of the subnet IDs in a VPC.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        https://docs.aws.amazon.com/dms/latest/APIReference/API_CreateReplicationSubnetGroup.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toCreateReplicationSubnetGroup", []))

    @jsii.member(jsii_name="toCreateReplicationTask")
    def to_create_replication_task(self) -> "Dms":
        '''(experimental) Grants permission to create a replication task using the specified parameters.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        https://docs.aws.amazon.com/dms/latest/APIReference/API_CreateReplicationTask.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toCreateReplicationTask", []))

    @jsii.member(jsii_name="toDeleteCertificate")
    def to_delete_certificate(self) -> "Dms":
        '''(experimental) Grants permission to delete the specified certificate.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DeleteCertificate.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDeleteCertificate", []))

    @jsii.member(jsii_name="toDeleteEndpoint")
    def to_delete_endpoint(self) -> "Dms":
        '''(experimental) Grants permission to delete the specified endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DeleteEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDeleteEndpoint", []))

    @jsii.member(jsii_name="toDeleteEventSubscription")
    def to_delete_event_subscription(self) -> "Dms":
        '''(experimental) Grants permission to delete an AWS DMS event subscription.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DeleteEventSubscription.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDeleteEventSubscription", []))

    @jsii.member(jsii_name="toDeleteReplicationInstance")
    def to_delete_replication_instance(self) -> "Dms":
        '''(experimental) Grants permission to delete the specified replication instance.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DeleteReplicationInstance.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDeleteReplicationInstance", []))

    @jsii.member(jsii_name="toDeleteReplicationSubnetGroup")
    def to_delete_replication_subnet_group(self) -> "Dms":
        '''(experimental) Grants permission to deletes a subnet group.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DeleteReplicationSubnetGroup.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDeleteReplicationSubnetGroup", []))

    @jsii.member(jsii_name="toDeleteReplicationTask")
    def to_delete_replication_task(self) -> "Dms":
        '''(experimental) Grants permission to delete the specified replication task.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DeleteReplicationTask.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDeleteReplicationTask", []))

    @jsii.member(jsii_name="toDeleteReplicationTaskAssessmentRun")
    def to_delete_replication_task_assessment_run(self) -> "Dms":
        '''(experimental) Grants permission to delete the record of a single premigration assessment run.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DeleteReplicationTaskAssessmentRun.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDeleteReplicationTaskAssessmentRun", []))

    @jsii.member(jsii_name="toDescribeAccountAttributes")
    def to_describe_account_attributes(self) -> "Dms":
        '''(experimental) Grants permission to list all of the AWS DMS attributes for a customer account.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeAccountAttributes.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeAccountAttributes", []))

    @jsii.member(jsii_name="toDescribeApplicableIndividualAssessments")
    def to_describe_applicable_individual_assessments(self) -> "Dms":
        '''(experimental) Grants permission to list individual assessments that you can specify for a new premigration assessment run.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeApplicableIndividualAssessments.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeApplicableIndividualAssessments", []))

    @jsii.member(jsii_name="toDescribeCertificates")
    def to_describe_certificates(self) -> "Dms":
        '''(experimental) Grants permission to provide a description of the certificate.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeCertificates.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeCertificates", []))

    @jsii.member(jsii_name="toDescribeConnections")
    def to_describe_connections(self) -> "Dms":
        '''(experimental) Grants permission to describe the status of the connections that have been made between the replication instance and an endpoint.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeConnections.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeConnections", []))

    @jsii.member(jsii_name="toDescribeEndpoints")
    def to_describe_endpoints(self) -> "Dms":
        '''(experimental) Grants permission to return information about the endpoints for your account in the current region.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeEndpoints.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeEndpoints", []))

    @jsii.member(jsii_name="toDescribeEndpointTypes")
    def to_describe_endpoint_types(self) -> "Dms":
        '''(experimental) Grants permission to return information about the type of endpoints available.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeEndpointTypes.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeEndpointTypes", []))

    @jsii.member(jsii_name="toDescribeEventCategories")
    def to_describe_event_categories(self) -> "Dms":
        '''(experimental) Grants permission to list categories for all event source types, or, if specified, for a specified source type.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeEventCategories.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeEventCategories", []))

    @jsii.member(jsii_name="toDescribeEvents")
    def to_describe_events(self) -> "Dms":
        '''(experimental) Grants permission to list events for a given source identifier and source type.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeEvents.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeEvents", []))

    @jsii.member(jsii_name="toDescribeEventSubscriptions")
    def to_describe_event_subscriptions(self) -> "Dms":
        '''(experimental) Grants permission to list all the event subscriptions for a customer account.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeEventSubscriptions.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeEventSubscriptions", []))

    @jsii.member(jsii_name="toDescribeOrderableReplicationInstances")
    def to_describe_orderable_replication_instances(self) -> "Dms":
        '''(experimental) Grants permission to return information about the replication instance types that can be created in the specified region.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeOrderableReplicationInstances.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeOrderableReplicationInstances", []))

    @jsii.member(jsii_name="toDescribeRefreshSchemasStatus")
    def to_describe_refresh_schemas_status(self) -> "Dms":
        '''(experimental) Grants permission to returns the status of the RefreshSchemas operation.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeRefreshSchemasStatus.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeRefreshSchemasStatus", []))

    @jsii.member(jsii_name="toDescribeReplicationInstances")
    def to_describe_replication_instances(self) -> "Dms":
        '''(experimental) Grants permission to return information about replication instances for your account in the current region.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeReplicationInstances.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeReplicationInstances", []))

    @jsii.member(jsii_name="toDescribeReplicationInstanceTaskLogs")
    def to_describe_replication_instance_task_logs(self) -> "Dms":
        '''(experimental) Grants permission to return information about the task logs for the specified task.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeReplicationInstanceTaskLogs.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeReplicationInstanceTaskLogs", []))

    @jsii.member(jsii_name="toDescribeReplicationSubnetGroups")
    def to_describe_replication_subnet_groups(self) -> "Dms":
        '''(experimental) Grants permission to return information about the replication subnet groups.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeReplicationSubnetGroups.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeReplicationSubnetGroups", []))

    @jsii.member(jsii_name="toDescribeReplicationTaskAssessmentResults")
    def to_describe_replication_task_assessment_results(self) -> "Dms":
        '''(experimental) Grants permission to return the latest task assessment results from Amazon S3.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeReplicationTaskAssessmentResults.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeReplicationTaskAssessmentResults", []))

    @jsii.member(jsii_name="toDescribeReplicationTaskAssessmentRuns")
    def to_describe_replication_task_assessment_runs(self) -> "Dms":
        '''(experimental) Grants permission to return a paginated list of premigration assessment runs based on filter settings.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeReplicationTaskAssessmentRuns.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeReplicationTaskAssessmentRuns", []))

    @jsii.member(jsii_name="toDescribeReplicationTaskIndividualAssessments")
    def to_describe_replication_task_individual_assessments(self) -> "Dms":
        '''(experimental) Grants permission to return a paginated list of individual assessments based on filter settings.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeReplicationTaskIndividualAssessments.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeReplicationTaskIndividualAssessments", []))

    @jsii.member(jsii_name="toDescribeReplicationTasks")
    def to_describe_replication_tasks(self) -> "Dms":
        '''(experimental) Grants permission to return information about replication tasks for your account in the current region.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeReplicationTasks.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeReplicationTasks", []))

    @jsii.member(jsii_name="toDescribeSchemas")
    def to_describe_schemas(self) -> "Dms":
        '''(experimental) Grants permission to return information about the schema for the specified endpoint.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeSchemas.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeSchemas", []))

    @jsii.member(jsii_name="toDescribeTableStatistics")
    def to_describe_table_statistics(self) -> "Dms":
        '''(experimental) Grants permission to return table statistics on the database migration task, including table name, rows inserted, rows updated, and rows deleted.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeTableStatistics.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeTableStatistics", []))

    @jsii.member(jsii_name="toImportCertificate")
    def to_import_certificate(self) -> "Dms":
        '''(experimental) Grants permission to upload the specified certificate.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/dms/latest/APIReference/API_ImportCertificate.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toImportCertificate", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Dms":
        '''(experimental) Grants permission to list all tags for an AWS DMS resource.

        Access Level: List

        https://docs.aws.amazon.com/dms/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toModifyEndpoint")
    def to_modify_endpoint(self) -> "Dms":
        '''(experimental) Grants permission to modify the specified endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_ModifyEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toModifyEndpoint", []))

    @jsii.member(jsii_name="toModifyEventSubscription")
    def to_modify_event_subscription(self) -> "Dms":
        '''(experimental) Grants permission to modify an existing AWS DMS event notification subscription.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_ModifyEventSubscription.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toModifyEventSubscription", []))

    @jsii.member(jsii_name="toModifyReplicationInstance")
    def to_modify_replication_instance(self) -> "Dms":
        '''(experimental) Grants permission to modify the replication instance to apply new settings.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_ModifyReplicationInstance.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toModifyReplicationInstance", []))

    @jsii.member(jsii_name="toModifyReplicationSubnetGroup")
    def to_modify_replication_subnet_group(self) -> "Dms":
        '''(experimental) Grants permission to modify the settings for the specified replication subnet group.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_ModifyReplicationSubnetGroup.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toModifyReplicationSubnetGroup", []))

    @jsii.member(jsii_name="toModifyReplicationTask")
    def to_modify_replication_task(self) -> "Dms":
        '''(experimental) Grants permission to modify the specified replication task.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_ModifyReplicationTask.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toModifyReplicationTask", []))

    @jsii.member(jsii_name="toRebootReplicationInstance")
    def to_reboot_replication_instance(self) -> "Dms":
        '''(experimental) Grants permission to reboot a replication instance.

        Rebooting results in a momentary outage, until the replication instance becomes available again

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_RebootReplicationInstance.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toRebootReplicationInstance", []))

    @jsii.member(jsii_name="toRefreshSchemas")
    def to_refresh_schemas(self) -> "Dms":
        '''(experimental) Grants permission to populate the schema for the specified endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_RefreshSchemas.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toRefreshSchemas", []))

    @jsii.member(jsii_name="toReloadTables")
    def to_reload_tables(self) -> "Dms":
        '''(experimental) Grants permission to reload the target database table with the source data.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_ReloadTables.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toReloadTables", []))

    @jsii.member(jsii_name="toRemoveTagsFromResource")
    def to_remove_tags_from_resource(self) -> "Dms":
        '''(experimental) Grants permission to remove metadata tags from a DMS resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/dms/latest/APIReference/API_RemoveTagsFromResource.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toRemoveTagsFromResource", []))

    @jsii.member(jsii_name="toStartReplicationTask")
    def to_start_replication_task(self) -> "Dms":
        '''(experimental) Grants permission to start the replication task.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_StartReplicationTask.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toStartReplicationTask", []))

    @jsii.member(jsii_name="toStartReplicationTaskAssessment")
    def to_start_replication_task_assessment(self) -> "Dms":
        '''(experimental) Grants permission to start the replication task assessment for unsupported data types in the source database.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_StartReplicationTaskAssessment.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toStartReplicationTaskAssessment", []))

    @jsii.member(jsii_name="toStartReplicationTaskAssessmentRun")
    def to_start_replication_task_assessment_run(self) -> "Dms":
        '''(experimental) Grants permission to start a new premigration assessment run for one or more individual assessments of a migration task.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_StartReplicationTaskAssessmentRun.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toStartReplicationTaskAssessmentRun", []))

    @jsii.member(jsii_name="toStopReplicationTask")
    def to_stop_replication_task(self) -> "Dms":
        '''(experimental) Grants permission to stop the replication task.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_StopReplicationTask.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toStopReplicationTask", []))

    @jsii.member(jsii_name="toTestConnection")
    def to_test_connection(self) -> "Dms":
        '''(experimental) Grants permission to test the connection between the replication instance and the endpoint.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_TestConnection.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toTestConnection", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Ds(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Ds"):
    '''(experimental) Statement provider for service `ds <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdirectoryservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `ds <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdirectoryservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Ds, self, [sid])

    @jsii.member(jsii_name="onDirectory")
    def on_directory(
        self,
        directory_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ds":
        '''(experimental) Adds a resource of type directory to the statement.

        :param directory_id: - Identifier for the directoryId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "onDirectory", [directory_id, account, region, partition]))

    @jsii.member(jsii_name="toAcceptSharedDirectory")
    def to_accept_shared_directory(self) -> "Ds":
        '''(experimental) Accepts a directory sharing request that was sent from the directory owner account.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_AcceptSharedDirectory.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toAcceptSharedDirectory", []))

    @jsii.member(jsii_name="toAddIpRoutes")
    def to_add_ip_routes(self) -> "Ds":
        '''(experimental) Adds a CIDR address block to correctly route traffic to and from your Microsoft AD on Amazon Web Services.

        Access Level: Write

        Dependent actions:

        - ec2:AuthorizeSecurityGroupEgress
        - ec2:AuthorizeSecurityGroupIngress
        - ec2:DescribeSecurityGroups

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_AddIpRoutes.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toAddIpRoutes", []))

    @jsii.member(jsii_name="toAddTagsToResource")
    def to_add_tags_to_resource(self) -> "Ds":
        '''(experimental) Adds or overwrites one or more tags for the specified Amazon Directory Services directory.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_AddTagsToResource.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toAddTagsToResource", []))

    @jsii.member(jsii_name="toAuthorizeApplication")
    def to_authorize_application(self) -> "Ds":
        '''(experimental) Authorizes an application for your AWS Directory.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toAuthorizeApplication", []))

    @jsii.member(jsii_name="toCancelSchemaExtension")
    def to_cancel_schema_extension(self) -> "Ds":
        '''(experimental) Cancels an in-progress schema extension to a Microsoft AD directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_CancelSchemaExtension.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toCancelSchemaExtension", []))

    @jsii.member(jsii_name="toCheckAlias")
    def to_check_alias(self) -> "Ds":
        '''(experimental) Verifies that the alias is available for use.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toCheckAlias", []))

    @jsii.member(jsii_name="toConnectDirectory")
    def to_connect_directory(self) -> "Ds":
        '''(experimental) Creates an AD Connector to connect to an on-premises directory.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - ec2:AuthorizeSecurityGroupEgress
        - ec2:AuthorizeSecurityGroupIngress
        - ec2:CreateNetworkInterface
        - ec2:CreateSecurityGroup
        - ec2:CreateTags
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_ConnectDirectory.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toConnectDirectory", []))

    @jsii.member(jsii_name="toCreateAlias")
    def to_create_alias(self) -> "Ds":
        '''(experimental) Creates an alias for a directory and assigns the alias to the directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_CreateAlias.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toCreateAlias", []))

    @jsii.member(jsii_name="toCreateComputer")
    def to_create_computer(self) -> "Ds":
        '''(experimental) Creates a computer account in the specified directory, and joins the computer to the directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_CreateComputer.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toCreateComputer", []))

    @jsii.member(jsii_name="toCreateConditionalForwarder")
    def to_create_conditional_forwarder(self) -> "Ds":
        '''(experimental) Creates a conditional forwarder associated with your AWS directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_CreateConditionalForwarder.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toCreateConditionalForwarder", []))

    @jsii.member(jsii_name="toCreateDirectory")
    def to_create_directory(self) -> "Ds":
        '''(experimental) Creates a Simple AD directory.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - ec2:AuthorizeSecurityGroupEgress
        - ec2:AuthorizeSecurityGroupIngress
        - ec2:CreateNetworkInterface
        - ec2:CreateSecurityGroup
        - ec2:CreateTags
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_CreateDirectory.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toCreateDirectory", []))

    @jsii.member(jsii_name="toCreateIdentityPoolDirectory")
    def to_create_identity_pool_directory(self) -> "Ds":
        '''(experimental) Creates a IdentityPool Directory in the AWS cloud.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toCreateIdentityPoolDirectory", []))

    @jsii.member(jsii_name="toCreateLogSubscription")
    def to_create_log_subscription(self) -> "Ds":
        '''(experimental) Creates a subscription to forward real time Directory Service domain controller security logs to the specified CloudWatch log group in your AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_CreateLogSubscription.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toCreateLogSubscription", []))

    @jsii.member(jsii_name="toCreateMicrosoftAD")
    def to_create_microsoft_ad(self) -> "Ds":
        '''(experimental) Creates a Microsoft AD in the AWS cloud.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - ec2:AuthorizeSecurityGroupEgress
        - ec2:AuthorizeSecurityGroupIngress
        - ec2:CreateNetworkInterface
        - ec2:CreateSecurityGroup
        - ec2:CreateTags
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_CreateMicrosoftAD.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toCreateMicrosoftAD", []))

    @jsii.member(jsii_name="toCreateSnapshot")
    def to_create_snapshot(self) -> "Ds":
        '''(experimental) Creates a snapshot of a Simple AD or Microsoft AD directory in the AWS cloud.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_CreateSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toCreateSnapshot", []))

    @jsii.member(jsii_name="toCreateTrust")
    def to_create_trust(self) -> "Ds":
        '''(experimental) Initiates the creation of the AWS side of a trust relationship between a Microsoft AD in the AWS cloud and an external domain.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_CreateTrust.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toCreateTrust", []))

    @jsii.member(jsii_name="toDeleteConditionalForwarder")
    def to_delete_conditional_forwarder(self) -> "Ds":
        '''(experimental) Deletes a conditional forwarder that has been set up for your AWS directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DeleteConditionalForwarder.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDeleteConditionalForwarder", []))

    @jsii.member(jsii_name="toDeleteDirectory")
    def to_delete_directory(self) -> "Ds":
        '''(experimental) Deletes an AWS Directory Service directory.

        Access Level: Write

        Dependent actions:

        - ec2:DeleteNetworkInterface
        - ec2:DeleteSecurityGroup
        - ec2:DescribeNetworkInterfaces
        - ec2:RevokeSecurityGroupEgress
        - ec2:RevokeSecurityGroupIngress

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DeleteDirectory.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDeleteDirectory", []))

    @jsii.member(jsii_name="toDeleteLogSubscription")
    def to_delete_log_subscription(self) -> "Ds":
        '''(experimental) Deletes the specified log subscription.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DeleteLogSubscription.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDeleteLogSubscription", []))

    @jsii.member(jsii_name="toDeleteSnapshot")
    def to_delete_snapshot(self) -> "Ds":
        '''(experimental) Deletes a directory snapshot.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DeleteSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDeleteSnapshot", []))

    @jsii.member(jsii_name="toDeleteTrust")
    def to_delete_trust(self) -> "Ds":
        '''(experimental) Deletes an existing trust relationship between your Microsoft AD in the AWS cloud and an external domain.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/DeleteTrust.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDeleteTrust", []))

    @jsii.member(jsii_name="toDeregisterCertificate")
    def to_deregister_certificate(self) -> "Ds":
        '''(experimental) Deletes from the system the certificate that was registered for a secured LDAP connection.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DeregisterCertificate.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDeregisterCertificate", []))

    @jsii.member(jsii_name="toDeregisterEventTopic")
    def to_deregister_event_topic(self) -> "Ds":
        '''(experimental) Removes the specified directory as a publisher to the specified SNS topic.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DeregisterEventTopic.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDeregisterEventTopic", []))

    @jsii.member(jsii_name="toDescribeCertificate")
    def to_describe_certificate(self) -> "Ds":
        '''(experimental) Displays information about the certificate registered for a secured LDAP connection.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DescribeCertificate.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDescribeCertificate", []))

    @jsii.member(jsii_name="toDescribeConditionalForwarders")
    def to_describe_conditional_forwarders(self) -> "Ds":
        '''(experimental) Obtains information about the conditional forwarders for this account.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DescribeConditionalForwarders.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDescribeConditionalForwarders", []))

    @jsii.member(jsii_name="toDescribeDirectories")
    def to_describe_directories(self) -> "Ds":
        '''(experimental) Obtains information about the directories that belong to this account.

        Access Level: List

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DescribeDirectories.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDescribeDirectories", []))

    @jsii.member(jsii_name="toDescribeDomainControllers")
    def to_describe_domain_controllers(self) -> "Ds":
        '''(experimental) Provides information about any domain controllers in your directory.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DescribeDomainControllers.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDescribeDomainControllers", []))

    @jsii.member(jsii_name="toDescribeEventTopics")
    def to_describe_event_topics(self) -> "Ds":
        '''(experimental) Obtains information about which SNS topics receive status messages from the specified directory.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DescribeEventTopics.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDescribeEventTopics", []))

    @jsii.member(jsii_name="toDescribeLDAPSSettings")
    def to_describe_ldaps_settings(self) -> "Ds":
        '''(experimental) Describes the status of LDAP security for the specified directory.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DescribeLDAPSSettings.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDescribeLDAPSSettings", []))

    @jsii.member(jsii_name="toDescribeSharedDirectories")
    def to_describe_shared_directories(self) -> "Ds":
        '''(experimental) Returns the shared directories in your account.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DescribeSharedDirectories.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDescribeSharedDirectories", []))

    @jsii.member(jsii_name="toDescribeSnapshots")
    def to_describe_snapshots(self) -> "Ds":
        '''(experimental) Obtains information about the directory snapshots that belong to this account.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DescribeSnapshots.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDescribeSnapshots", []))

    @jsii.member(jsii_name="toDescribeTrusts")
    def to_describe_trusts(self) -> "Ds":
        '''(experimental) Obtains information about the trust relationships for this account.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DescribeTrusts.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDescribeTrusts", []))

    @jsii.member(jsii_name="toDisableLDAPS")
    def to_disable_ldaps(self) -> "Ds":
        '''(experimental) Deactivates LDAP secure calls for the specified directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DisableLDAPS.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDisableLDAPS", []))

    @jsii.member(jsii_name="toDisableRadius")
    def to_disable_radius(self) -> "Ds":
        '''(experimental) Disables multi-factor authentication (MFA) with the Remote Authentication Dial In User Service (RADIUS) server for an AD Connector directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DisableRadius.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDisableRadius", []))

    @jsii.member(jsii_name="toDisableSso")
    def to_disable_sso(self) -> "Ds":
        '''(experimental) Disables single-sign on for a directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DisableSso.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDisableSso", []))

    @jsii.member(jsii_name="toEnableLDAPS")
    def to_enable_ldaps(self) -> "Ds":
        '''(experimental) Activates the switch for the specific directory to always use LDAP secure calls.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_EnableLDAPS.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toEnableLDAPS", []))

    @jsii.member(jsii_name="toEnableRadius")
    def to_enable_radius(self) -> "Ds":
        '''(experimental) Enables multi-factor authentication (MFA) with the Remote Authentication Dial In User Service (RADIUS) server for an AD Connector directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_EnableRadius.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toEnableRadius", []))

    @jsii.member(jsii_name="toEnableSso")
    def to_enable_sso(self) -> "Ds":
        '''(experimental) Enables single-sign on for a directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_EnableSso.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toEnableSso", []))

    @jsii.member(jsii_name="toGetAuthorizedApplicationDetails")
    def to_get_authorized_application_details(self) -> "Ds":
        '''(experimental) Access Level: Read.

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toGetAuthorizedApplicationDetails", []))

    @jsii.member(jsii_name="toGetDirectoryLimits")
    def to_get_directory_limits(self) -> "Ds":
        '''(experimental) Obtains directory limit information for the current region.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_GetDirectoryLimits.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toGetDirectoryLimits", []))

    @jsii.member(jsii_name="toGetSnapshotLimits")
    def to_get_snapshot_limits(self) -> "Ds":
        '''(experimental) Obtains the manual snapshot limits for a directory.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_GetSnapshotLimits.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toGetSnapshotLimits", []))

    @jsii.member(jsii_name="toListAuthorizedApplications")
    def to_list_authorized_applications(self) -> "Ds":
        '''(experimental) Obtains the aws applications authorized for a directory.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toListAuthorizedApplications", []))

    @jsii.member(jsii_name="toListCertificates")
    def to_list_certificates(self) -> "Ds":
        '''(experimental) For the specified directory, lists all the certificates registered for a secured LDAP connection.

        Access Level: List

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_ListCertificates.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toListCertificates", []))

    @jsii.member(jsii_name="toListIpRoutes")
    def to_list_ip_routes(self) -> "Ds":
        '''(experimental) Lists the address blocks that you have added to a directory.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_ListIpRoutes.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toListIpRoutes", []))

    @jsii.member(jsii_name="toListLogSubscriptions")
    def to_list_log_subscriptions(self) -> "Ds":
        '''(experimental) Lists the active log subscriptions for the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_ListLogSubscriptions.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toListLogSubscriptions", []))

    @jsii.member(jsii_name="toListSchemaExtensions")
    def to_list_schema_extensions(self) -> "Ds":
        '''(experimental) Lists all schema extensions applied to a Microsoft AD Directory.

        Access Level: List

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_ListSchemaExtensions.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toListSchemaExtensions", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Ds":
        '''(experimental) Lists all tags on an Amazon Directory Services directory.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toRegisterCertificate")
    def to_register_certificate(self) -> "Ds":
        '''(experimental) Registers a certificate for secured LDAP connection.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_RegisterCertificate.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toRegisterCertificate", []))

    @jsii.member(jsii_name="toRegisterEventTopic")
    def to_register_event_topic(self) -> "Ds":
        '''(experimental) Associates a directory with an SNS topic.

        Access Level: Write

        Dependent actions:

        - sns:GetTopicAttributes

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_RegisterEventTopic.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toRegisterEventTopic", []))

    @jsii.member(jsii_name="toRejectSharedDirectory")
    def to_reject_shared_directory(self) -> "Ds":
        '''(experimental) Rejects a directory sharing request that was sent from the directory owner account.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_RejectSharedDirectory.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toRejectSharedDirectory", []))

    @jsii.member(jsii_name="toRemoveIpRoutes")
    def to_remove_ip_routes(self) -> "Ds":
        '''(experimental) Removes IP address blocks from a directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_RemoveIpRoutes.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toRemoveIpRoutes", []))

    @jsii.member(jsii_name="toRemoveTagsFromResource")
    def to_remove_tags_from_resource(self) -> "Ds":
        '''(experimental) Removes tags from an Amazon Directory Services directory.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - ec2:DeleteTags

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_RemoveTagsFromResource.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toRemoveTagsFromResource", []))

    @jsii.member(jsii_name="toResetUserPassword")
    def to_reset_user_password(self) -> "Ds":
        '''(experimental) Resets the password for any user in your AWS Managed Microsoft AD or Simple AD directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_ResetUserPassword.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toResetUserPassword", []))

    @jsii.member(jsii_name="toRestoreFromSnapshot")
    def to_restore_from_snapshot(self) -> "Ds":
        '''(experimental) Restores a directory using an existing directory snapshot.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_RestoreFromSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toRestoreFromSnapshot", []))

    @jsii.member(jsii_name="toShareDirectory")
    def to_share_directory(self) -> "Ds":
        '''(experimental) Shares a specified directory in your AWS account (directory owner) with another AWS account (directory consumer).

        With this operation you can use your directory from any AWS account and from any Amazon VPC within an AWS Region.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_ShareDirectory.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toShareDirectory", []))

    @jsii.member(jsii_name="toStartSchemaExtension")
    def to_start_schema_extension(self) -> "Ds":
        '''(experimental) Applies a schema extension to a Microsoft AD directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_StartSchemaExtension.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toStartSchemaExtension", []))

    @jsii.member(jsii_name="toUnauthorizeApplication")
    def to_unauthorize_application(self) -> "Ds":
        '''(experimental) Unauthorizes an application from your AWS Directory.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toUnauthorizeApplication", []))

    @jsii.member(jsii_name="toUnshareDirectory")
    def to_unshare_directory(self) -> "Ds":
        '''(experimental) Stops the directory sharing between the directory owner and consumer accounts.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_UnshareDirectory.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toUnshareDirectory", []))

    @jsii.member(jsii_name="toUpdateConditionalForwarder")
    def to_update_conditional_forwarder(self) -> "Ds":
        '''(experimental) Updates a conditional forwarder that has been set up for your AWS directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_UpdateConditionalForwarder.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toUpdateConditionalForwarder", []))

    @jsii.member(jsii_name="toUpdateNumberOfDomainControllers")
    def to_update_number_of_domain_controllers(self) -> "Ds":
        '''(experimental) Adds or removes domain controllers to or from the directory.

        Based on the difference between current value and new value (provided through this API call), domain controllers will be added or removed. It may take up to 45 minutes for any new domain controllers to become fully active once the requested number of domain controllers is updated. During this time, you cannot make another update request.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_UpdateNumberOfDomainControllers.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toUpdateNumberOfDomainControllers", []))

    @jsii.member(jsii_name="toUpdateRadius")
    def to_update_radius(self) -> "Ds":
        '''(experimental) Updates the Remote Authentication Dial In User Service (RADIUS) server information for an AD Connector directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_UpdateRadius.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toUpdateRadius", []))

    @jsii.member(jsii_name="toUpdateTrust")
    def to_update_trust(self) -> "Ds":
        '''(experimental) Updates the trust that has been set up between your AWS Managed Microsoft AD directory and an on-premises Active Directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_UpdateTrust.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toUpdateTrust", []))

    @jsii.member(jsii_name="toVerifyTrust")
    def to_verify_trust(self) -> "Ds":
        '''(experimental) Verifies a trust relationship between your Microsoft AD in the AWS cloud and an external domain.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_VerifyTrust.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toVerifyTrust", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Dynamodb(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Dynamodb",
):
    '''(experimental) Statement provider for service `dynamodb <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazondynamodb.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `dynamodb <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazondynamodb.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Dynamodb, self, [sid])

    @jsii.member(jsii_name="ifAttributes")
    def if_attributes(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Dynamodb":
        '''(experimental) Filter based on the attribute (field or column) names of the table.

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/specifying-conditions.html#FGAC_DDB.ConditionKeys

        Applies to actions:

        - .toBatchGetItem()
        - .toBatchWriteItem()
        - .toConditionCheckItem()
        - .toDeleteItem()
        - .toGetItem()
        - .toPartiQLDelete()
        - .toPartiQLInsert()
        - .toPartiQLSelect()
        - .toPartiQLUpdate()
        - .toPutItem()
        - .toQuery()
        - .toScan()
        - .toUpdateItem()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "ifAttributes", [value, operator]))

    @jsii.member(jsii_name="ifEnclosingOperation")
    def if_enclosing_operation(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Dynamodb":
        '''(experimental) Used to block Transactions APIs calls and allow the non-Transaction APIs calls and vice-versa.

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/specifying-conditions.html#FGAC_DDB.ConditionKeys

        Applies to actions:

        - .toDeleteItem()
        - .toGetItem()
        - .toPartiQLDelete()
        - .toPartiQLInsert()
        - .toPartiQLSelect()
        - .toPartiQLUpdate()
        - .toPutItem()
        - .toUpdateItem()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "ifEnclosingOperation", [value, operator]))

    @jsii.member(jsii_name="ifFullTableScan")
    def if_full_table_scan(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Dynamodb":
        '''(experimental) Used to block full table scan.

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/ql-iam.html

        Applies to actions:

        - .toPartiQLSelect()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "ifFullTableScan", [value]))

    @jsii.member(jsii_name="ifLeadingKeys")
    def if_leading_keys(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Dynamodb":
        '''(experimental) Filters based on the partition key of the table.

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/specifying-conditions.html#FGAC_DDB.ConditionKeys

        Applies to actions:

        - .toBatchGetItem()
        - .toBatchWriteItem()
        - .toConditionCheckItem()
        - .toDeleteItem()
        - .toGetItem()
        - .toPartiQLDelete()
        - .toPartiQLInsert()
        - .toPartiQLSelect()
        - .toPartiQLUpdate()
        - .toPutItem()
        - .toQuery()
        - .toUpdateItem()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "ifLeadingKeys", [value, operator]))

    @jsii.member(jsii_name="ifReturnConsumedCapacity")
    def if_return_consumed_capacity(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Dynamodb":
        '''(experimental) Filter based on the ReturnConsumedCapacity parameter of a request. Contains either "TOTAL" or "NONE".

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/specifying-conditions.html#FGAC_DDB.ConditionKeys

        Applies to actions:

        - .toBatchGetItem()
        - .toBatchWriteItem()
        - .toConditionCheckItem()
        - .toDeleteItem()
        - .toGetItem()
        - .toPutItem()
        - .toQuery()
        - .toScan()
        - .toUpdateItem()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "ifReturnConsumedCapacity", [value, operator]))

    @jsii.member(jsii_name="ifReturnValues")
    def if_return_values(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Dynamodb":
        '''(experimental) Filter based on the ReturnValues parameter of request. Contains one of the following: "ALL_OLD", "UPDATED_OLD","ALL_NEW","UPDATED_NEW", or "NONE".

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/specifying-conditions.html#FGAC_DDB.ConditionKeys

        Applies to actions:

        - .toConditionCheckItem()
        - .toDeleteItem()
        - .toPartiQLDelete()
        - .toPartiQLUpdate()
        - .toPutItem()
        - .toQuery()
        - .toScan()
        - .toUpdateItem()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "ifReturnValues", [value, operator]))

    @jsii.member(jsii_name="ifSelect")
    def if_select(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Dynamodb":
        '''(experimental) Filter based on the Select parameter of a Query or Scan request.

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/specifying-conditions.html#FGAC_DDB.ConditionKeys

        Applies to actions:

        - .toBatchGetItem()
        - .toGetItem()
        - .toPartiQLSelect()
        - .toQuery()
        - .toScan()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "ifSelect", [value, operator]))

    @jsii.member(jsii_name="onBackup")
    def on_backup(
        self,
        table_name: builtins.str,
        backup_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dynamodb":
        '''(experimental) Adds a resource of type backup to the statement.

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/backuprestore_HowItWorks.html

        :param table_name: - Identifier for the tableName.
        :param backup_name: - Identifier for the backupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "onBackup", [table_name, backup_name, account, region, partition]))

    @jsii.member(jsii_name="onExport")
    def on_export(
        self,
        table_name: builtins.str,
        export_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dynamodb":
        '''(experimental) Adds a resource of type export to the statement.

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DataExport.HowItWorks.html

        :param table_name: - Identifier for the tableName.
        :param export_name: - Identifier for the exportName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "onExport", [table_name, export_name, account, region, partition]))

    @jsii.member(jsii_name="onGlobalTable")
    def on_global_table(
        self,
        global_table_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dynamodb":
        '''(experimental) Adds a resource of type global-table to the statement.

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/globaltables_HowItWorks.html

        :param global_table_name: - Identifier for the globalTableName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "onGlobalTable", [global_table_name, account, partition]))

    @jsii.member(jsii_name="onIndex")
    def on_index(
        self,
        table_name: builtins.str,
        index_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dynamodb":
        '''(experimental) Adds a resource of type index to the statement.

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/HowItWorks.CoreComponents.htmlHowItWorks.CoreComponents.html#HowItWorks.CoreComponents.PrimaryKey

        :param table_name: - Identifier for the tableName.
        :param index_name: - Identifier for the indexName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "onIndex", [table_name, index_name, account, region, partition]))

    @jsii.member(jsii_name="onStream")
    def on_stream(
        self,
        table_name: builtins.str,
        stream_label: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dynamodb":
        '''(experimental) Adds a resource of type stream to the statement.

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/HowItWorks.CoreComponents.htmlHowItWorks.CoreComponents.html#HowItWorks.CoreComponents.Streams

        :param table_name: - Identifier for the tableName.
        :param stream_label: - Identifier for the streamLabel.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "onStream", [table_name, stream_label, account, region, partition]))

    @jsii.member(jsii_name="onTable")
    def on_table(
        self,
        table_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dynamodb":
        '''(experimental) Adds a resource of type table to the statement.

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/HowItWorks.CoreComponents.htmlHowItWorks.CoreComponents.html#HowItWorks.CoreComponents.TablesItemsAttributes

        :param table_name: - Identifier for the tableName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "onTable", [table_name, account, region, partition]))

    @jsii.member(jsii_name="toBatchGetItem")
    def to_batch_get_item(self) -> "Dynamodb":
        '''(experimental) Returns the attributes of one or more items from one or more tables.

        Access Level: Read

        Possible conditions:

        - .ifAttributes()
        - .ifLeadingKeys()
        - .ifReturnConsumedCapacity()
        - .ifSelect()

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_BatchGetItem.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toBatchGetItem", []))

    @jsii.member(jsii_name="toBatchWriteItem")
    def to_batch_write_item(self) -> "Dynamodb":
        '''(experimental) Puts or deletes multiple items in one or more tables.

        Access Level: Write

        Possible conditions:

        - .ifAttributes()
        - .ifLeadingKeys()
        - .ifReturnConsumedCapacity()

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_BatchWriteItem.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toBatchWriteItem", []))

    @jsii.member(jsii_name="toConditionCheckItem")
    def to_condition_check_item(self) -> "Dynamodb":
        '''(experimental) The ConditionCheckItem operation checks the existence of a set of attributes for the item with the given primary key.

        Access Level: Read

        Possible conditions:

        - .ifAttributes()
        - .ifLeadingKeys()
        - .ifReturnConsumedCapacity()
        - .ifReturnValues()

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ConditionCheckItem.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toConditionCheckItem", []))

    @jsii.member(jsii_name="toCreateBackup")
    def to_create_backup(self) -> "Dynamodb":
        '''(experimental) Creates a backup for an existing table.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_CreateBackup.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toCreateBackup", []))

    @jsii.member(jsii_name="toCreateGlobalTable")
    def to_create_global_table(self) -> "Dynamodb":
        '''(experimental) Enables the user to create a global table from an existing table.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_CreateGlobalTable.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toCreateGlobalTable", []))

    @jsii.member(jsii_name="toCreateTable")
    def to_create_table(self) -> "Dynamodb":
        '''(experimental) The CreateTable operation adds a new table to your account.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_CreateTable.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toCreateTable", []))

    @jsii.member(jsii_name="toCreateTableReplica")
    def to_create_table_replica(self) -> "Dynamodb":
        '''(experimental) Adds a new replica table.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/V2gt_IAM.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toCreateTableReplica", []))

    @jsii.member(jsii_name="toDeleteBackup")
    def to_delete_backup(self) -> "Dynamodb":
        '''(experimental) Deletes an existing backup of a table.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DeleteBackup.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDeleteBackup", []))

    @jsii.member(jsii_name="toDeleteItem")
    def to_delete_item(self) -> "Dynamodb":
        '''(experimental) Deletes a single item in a table by primary key.

        Access Level: Write

        Possible conditions:

        - .ifAttributes()
        - .ifEnclosingOperation()
        - .ifLeadingKeys()
        - .ifReturnConsumedCapacity()
        - .ifReturnValues()

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DeleteItem.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDeleteItem", []))

    @jsii.member(jsii_name="toDeleteTable")
    def to_delete_table(self) -> "Dynamodb":
        '''(experimental) The DeleteTable operation deletes a table and all of its items.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DeleteTable.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDeleteTable", []))

    @jsii.member(jsii_name="toDeleteTableReplica")
    def to_delete_table_replica(self) -> "Dynamodb":
        '''(experimental) Deletes a replica table and all of its items.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/V2gt_IAM.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDeleteTableReplica", []))

    @jsii.member(jsii_name="toDescribeBackup")
    def to_describe_backup(self) -> "Dynamodb":
        '''(experimental) Describes an existing backup of a table.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DescribeBackup.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDescribeBackup", []))

    @jsii.member(jsii_name="toDescribeContinuousBackups")
    def to_describe_continuous_backups(self) -> "Dynamodb":
        '''(experimental) Checks the status of the backup restore settings on the specified table.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DescribeContinuousBackups.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDescribeContinuousBackups", []))

    @jsii.member(jsii_name="toDescribeContributorInsights")
    def to_describe_contributor_insights(self) -> "Dynamodb":
        '''(experimental) Describes the contributor insights status and related details for a given table or global secondary index.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DescribeContributorInsights.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDescribeContributorInsights", []))

    @jsii.member(jsii_name="toDescribeExport")
    def to_describe_export(self) -> "Dynamodb":
        '''(experimental) Describes an existing Export of a table.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DescribeExport.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDescribeExport", []))

    @jsii.member(jsii_name="toDescribeGlobalTable")
    def to_describe_global_table(self) -> "Dynamodb":
        '''(experimental) Returns information about the specified global table.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DescribeGlobalTable.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDescribeGlobalTable", []))

    @jsii.member(jsii_name="toDescribeGlobalTableSettings")
    def to_describe_global_table_settings(self) -> "Dynamodb":
        '''(experimental) Returns settings information about the specified global table.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DescribeGlobalTableSettings.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDescribeGlobalTableSettings", []))

    @jsii.member(jsii_name="toDescribeKinesisStreamingDestination")
    def to_describe_kinesis_streaming_destination(self) -> "Dynamodb":
        '''(experimental) Grants permission to describe the status of Kinesis streaming and related details for a given table.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DescribeKinesisStreamingDestination.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDescribeKinesisStreamingDestination", []))

    @jsii.member(jsii_name="toDescribeLimits")
    def to_describe_limits(self) -> "Dynamodb":
        '''(experimental) Returns the current provisioned-capacity limits for your AWS account in a region, both for the region as a whole and for any one DynamoDB table that you create there.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DescribeLimits.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDescribeLimits", []))

    @jsii.member(jsii_name="toDescribeReservedCapacity")
    def to_describe_reserved_capacity(self) -> "Dynamodb":
        '''(experimental) Describes one or more of the Reserved Capacity purchased.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDescribeReservedCapacity", []))

    @jsii.member(jsii_name="toDescribeReservedCapacityOfferings")
    def to_describe_reserved_capacity_offerings(self) -> "Dynamodb":
        '''(experimental) Describes Reserved Capacity offerings that are available for purchase.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDescribeReservedCapacityOfferings", []))

    @jsii.member(jsii_name="toDescribeStream")
    def to_describe_stream(self) -> "Dynamodb":
        '''(experimental) Returns information about a stream, including the current status of the stream, its Amazon Resource Name (ARN), the composition of its shards, and its corresponding DynamoDB table.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DescribeStream.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDescribeStream", []))

    @jsii.member(jsii_name="toDescribeTable")
    def to_describe_table(self) -> "Dynamodb":
        '''(experimental) Returns information about the table.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DescribeTable.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDescribeTable", []))

    @jsii.member(jsii_name="toDescribeTableReplicaAutoScaling")
    def to_describe_table_replica_auto_scaling(self) -> "Dynamodb":
        '''(experimental) Describes the auto scaling settings across all replicas of the global table.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DescribeTableReplicaAutoScaling.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDescribeTableReplicaAutoScaling", []))

    @jsii.member(jsii_name="toDescribeTimeToLive")
    def to_describe_time_to_live(self) -> "Dynamodb":
        '''(experimental) Gives a description of the Time to Live (TTL) status on the specified table.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DescribeTimeToLive.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDescribeTimeToLive", []))

    @jsii.member(jsii_name="toDisableKinesisStreamingDestination")
    def to_disable_kinesis_streaming_destination(self) -> "Dynamodb":
        '''(experimental) Grants permission to stop replication from the DynamoDB table to the Kinesis data stream.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DisableKinesisStreamingDestination.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDisableKinesisStreamingDestination", []))

    @jsii.member(jsii_name="toEnableKinesisStreamingDestination")
    def to_enable_kinesis_streaming_destination(self) -> "Dynamodb":
        '''(experimental) Grants permission to start table data replication to the specified Kinesis data stream at a timestamp chosen during the enable workflow.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_EnableKinesisStreamingDestination.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toEnableKinesisStreamingDestination", []))

    @jsii.member(jsii_name="toExportTableToPointInTime")
    def to_export_table_to_point_in_time(self) -> "Dynamodb":
        '''(experimental) Initiates an Export of a DynamoDB table to S3.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ExportTableToPointInTime.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toExportTableToPointInTime", []))

    @jsii.member(jsii_name="toGetItem")
    def to_get_item(self) -> "Dynamodb":
        '''(experimental) The GetItem operation returns a set of attributes for the item with the given primary key.

        Access Level: Read

        Possible conditions:

        - .ifAttributes()
        - .ifEnclosingOperation()
        - .ifLeadingKeys()
        - .ifReturnConsumedCapacity()
        - .ifSelect()

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_GetItem.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toGetItem", []))

    @jsii.member(jsii_name="toGetRecords")
    def to_get_records(self) -> "Dynamodb":
        '''(experimental) Retrieves the stream records from a given shard.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_GetRecords.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toGetRecords", []))

    @jsii.member(jsii_name="toGetShardIterator")
    def to_get_shard_iterator(self) -> "Dynamodb":
        '''(experimental) Returns a shard iterator.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_GetShardIterator.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toGetShardIterator", []))

    @jsii.member(jsii_name="toListBackups")
    def to_list_backups(self) -> "Dynamodb":
        '''(experimental) List backups associated with the account and endpoint.

        Access Level: List

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ListBackups.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toListBackups", []))

    @jsii.member(jsii_name="toListContributorInsights")
    def to_list_contributor_insights(self) -> "Dynamodb":
        '''(experimental) Lists the ContributorInsightsSummary for all tables and global secondary indexes associated with the current account and endpoint.

        Access Level: List

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ListContributorInsights.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toListContributorInsights", []))

    @jsii.member(jsii_name="toListExports")
    def to_list_exports(self) -> "Dynamodb":
        '''(experimental) List exports associated with the account and endpoint.

        Access Level: List

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ListExports.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toListExports", []))

    @jsii.member(jsii_name="toListGlobalTables")
    def to_list_global_tables(self) -> "Dynamodb":
        '''(experimental) Lists all global tables that have a replica in the specified region.

        Access Level: List

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ListGlobalTables.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toListGlobalTables", []))

    @jsii.member(jsii_name="toListStreams")
    def to_list_streams(self) -> "Dynamodb":
        '''(experimental) Returns an array of stream ARNs associated with the current account and endpoint.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ListStreams.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toListStreams", []))

    @jsii.member(jsii_name="toListTables")
    def to_list_tables(self) -> "Dynamodb":
        '''(experimental) Returns an array of table names associated with the current account and endpoint.

        Access Level: List

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ListTables.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toListTables", []))

    @jsii.member(jsii_name="toListTagsOfResource")
    def to_list_tags_of_resource(self) -> "Dynamodb":
        '''(experimental) List all tags on an Amazon DynamoDB resource.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ListTagsOfResource.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toListTagsOfResource", []))

    @jsii.member(jsii_name="toPartiQLDelete")
    def to_parti_ql_delete(self) -> "Dynamodb":
        '''(experimental) Grants permission to delete a single item in a table by primary key.

        Access Level: Write

        Possible conditions:

        - .ifAttributes()
        - .ifEnclosingOperation()
        - .ifLeadingKeys()
        - .ifReturnValues()

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ExecuteStatement.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toPartiQLDelete", []))

    @jsii.member(jsii_name="toPartiQLInsert")
    def to_parti_ql_insert(self) -> "Dynamodb":
        '''(experimental) Grants permission to create a new item, if an item with same primary key does not exist in the table.

        Access Level: Write

        Possible conditions:

        - .ifAttributes()
        - .ifEnclosingOperation()
        - .ifLeadingKeys()

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ExecuteStatement.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toPartiQLInsert", []))

    @jsii.member(jsii_name="toPartiQLSelect")
    def to_parti_ql_select(self) -> "Dynamodb":
        '''(experimental) Grants permission to read a set of attributes for items from a table or index.

        Access Level: Read

        Possible conditions:

        - .ifAttributes()
        - .ifEnclosingOperation()
        - .ifFullTableScan()
        - .ifLeadingKeys()
        - .ifSelect()

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ExecuteStatement.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toPartiQLSelect", []))

    @jsii.member(jsii_name="toPartiQLUpdate")
    def to_parti_ql_update(self) -> "Dynamodb":
        '''(experimental) Grants permission to edit an existing item's attributes.

        Access Level: Write

        Possible conditions:

        - .ifAttributes()
        - .ifEnclosingOperation()
        - .ifLeadingKeys()
        - .ifReturnValues()

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ExecuteStatement.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toPartiQLUpdate", []))

    @jsii.member(jsii_name="toPurchaseReservedCapacityOfferings")
    def to_purchase_reserved_capacity_offerings(self) -> "Dynamodb":
        '''(experimental) Purchases Reserved Capacity for use with your account.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toPurchaseReservedCapacityOfferings", []))

    @jsii.member(jsii_name="toPutItem")
    def to_put_item(self) -> "Dynamodb":
        '''(experimental) Creates a new item, or replaces an old item with a new item.

        Access Level: Write

        Possible conditions:

        - .ifAttributes()
        - .ifEnclosingOperation()
        - .ifLeadingKeys()
        - .ifReturnConsumedCapacity()
        - .ifReturnValues()

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_PutItem.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toPutItem", []))

    @jsii.member(jsii_name="toQuery")
    def to_query(self) -> "Dynamodb":
        '''(experimental) Uses the primary key of a table or a secondary index to directly access items from that table or index.

        Access Level: Read

        Possible conditions:

        - .ifAttributes()
        - .ifLeadingKeys()
        - .ifReturnConsumedCapacity()
        - .ifReturnValues()
        - .ifSelect()

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_Query.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toQuery", []))

    @jsii.member(jsii_name="toRestoreTableFromBackup")
    def to_restore_table_from_backup(self) -> "Dynamodb":
        '''(experimental) Creates a new table from an existing backup.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_RestoreTableFromBackup.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toRestoreTableFromBackup", []))

    @jsii.member(jsii_name="toRestoreTableToPointInTime")
    def to_restore_table_to_point_in_time(self) -> "Dynamodb":
        '''(experimental) Restores a table to a point in time.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_RestoreTableToPointInTime.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toRestoreTableToPointInTime", []))

    @jsii.member(jsii_name="toScan")
    def to_scan(self) -> "Dynamodb":
        '''(experimental) Returns one or more items and item attributes by accessing every item in a table or a secondary index.

        Access Level: Read

        Possible conditions:

        - .ifAttributes()
        - .ifReturnConsumedCapacity()
        - .ifReturnValues()
        - .ifSelect()

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_Scan.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toScan", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Dynamodb":
        '''(experimental) Associate a set of tags with an Amazon DynamoDB resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Dynamodb":
        '''(experimental) Removes the association of tags from an Amazon DynamoDB resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateContinuousBackups")
    def to_update_continuous_backups(self) -> "Dynamodb":
        '''(experimental) Enables or disables continuous backups.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_UpdateContinuousBackups.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toUpdateContinuousBackups", []))

    @jsii.member(jsii_name="toUpdateContributorInsights")
    def to_update_contributor_insights(self) -> "Dynamodb":
        '''(experimental) Updates the status for contributor insights for a specific table or global secondary index.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_UpdateContributorInsights.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toUpdateContributorInsights", []))

    @jsii.member(jsii_name="toUpdateGlobalTable")
    def to_update_global_table(self) -> "Dynamodb":
        '''(experimental) Enables the user to add or remove replicas in the specified global table.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_UpdateGlobalTable.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toUpdateGlobalTable", []))

    @jsii.member(jsii_name="toUpdateGlobalTableSettings")
    def to_update_global_table_settings(self) -> "Dynamodb":
        '''(experimental) Enables the user to update settings of the specified global table.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_UpdateGlobalTableSettings.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toUpdateGlobalTableSettings", []))

    @jsii.member(jsii_name="toUpdateItem")
    def to_update_item(self) -> "Dynamodb":
        '''(experimental) Edits an existing item's attributes, or adds a new item to the table if it does not already exist.

        Access Level: Write

        Possible conditions:

        - .ifAttributes()
        - .ifEnclosingOperation()
        - .ifLeadingKeys()
        - .ifReturnConsumedCapacity()
        - .ifReturnValues()

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_UpdateItem.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toUpdateItem", []))

    @jsii.member(jsii_name="toUpdateTable")
    def to_update_table(self) -> "Dynamodb":
        '''(experimental) Modifies the provisioned throughput settings, global secondary indexes, or DynamoDB Streams settings for a given table.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_UpdateTable.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toUpdateTable", []))

    @jsii.member(jsii_name="toUpdateTableReplicaAutoScaling")
    def to_update_table_replica_auto_scaling(self) -> "Dynamodb":
        '''(experimental) Updates auto scaling settings on your replica table.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_UpdateTableReplicaAutoScaling.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toUpdateTableReplicaAutoScaling", []))

    @jsii.member(jsii_name="toUpdateTimeToLive")
    def to_update_time_to_live(self) -> "Dynamodb":
        '''(experimental) Enables or disables TTL for the specified table.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_UpdateTimeToLive.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toUpdateTimeToLive", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Ebs(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Ebs"):
    '''(experimental) Statement provider for service `ebs <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticblockstore.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `ebs <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticblockstore.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Ebs, self, [sid])

    @jsii.member(jsii_name="ifDescription")
    def if_description(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ebs":
        '''(experimental) Filters access by the description of the snapshot being created.

        Applies to resource types:

        - snapshot

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ebs", jsii.invoke(self, "ifDescription", [value, operator]))

    @jsii.member(jsii_name="ifParentSnapshot")
    def if_parent_snapshot(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ebs":
        '''(experimental) Filters access by the ID of the parent snapshot.

        Applies to resource types:

        - snapshot

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ebs", jsii.invoke(self, "ifParentSnapshot", [value, operator]))

    @jsii.member(jsii_name="ifVolumeSize")
    def if_volume_size(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ebs":
        '''(experimental) Filters access by the size of the volume for the snapshot being created, in GiB.

        Applies to resource types:

        - snapshot

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        return typing.cast("Ebs", jsii.invoke(self, "ifVolumeSize", [value, operator]))

    @jsii.member(jsii_name="onSnapshot")
    def on_snapshot(
        self,
        snapshot_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ebs":
        '''(experimental) Adds a resource of type snapshot to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#EC2_ARN_Format

        :param snapshot_id: - Identifier for the snapshotId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifDescription() - .ifParentSnapshot() - .ifVolumeSize()

        :stability: experimental
        '''
        return typing.cast("Ebs", jsii.invoke(self, "onSnapshot", [snapshot_id, region, partition]))

    @jsii.member(jsii_name="toCompleteSnapshot")
    def to_complete_snapshot(self) -> "Ebs":
        '''(experimental) Grants permission to seal and complete the snapshot after all of the required blocks of data have been written to it.

        Access Level: Write

        https://docs.aws.amazon.com/ebs/latest/APIReference/API_CompleteSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Ebs", jsii.invoke(self, "toCompleteSnapshot", []))

    @jsii.member(jsii_name="toGetSnapshotBlock")
    def to_get_snapshot_block(self) -> "Ebs":
        '''(experimental) Grants permission to return the data of a block in an Amazon Elastic Block Store (EBS) snapshot.

        Access Level: Read

        https://docs.aws.amazon.com/ebs/latest/APIReference/API_GetSnapshotBlock.html

        :stability: experimental
        '''
        return typing.cast("Ebs", jsii.invoke(self, "toGetSnapshotBlock", []))

    @jsii.member(jsii_name="toListChangedBlocks")
    def to_list_changed_blocks(self) -> "Ebs":
        '''(experimental) Grants permission to list the blocks that are different between two Amazon Elastic Block Store (EBS) snapshots of the same volume/snapshot lineage.

        Access Level: Read

        https://docs.aws.amazon.com/ebs/latest/APIReference/API_ListChangedBlocks.html

        :stability: experimental
        '''
        return typing.cast("Ebs", jsii.invoke(self, "toListChangedBlocks", []))

    @jsii.member(jsii_name="toListSnapshotBlocks")
    def to_list_snapshot_blocks(self) -> "Ebs":
        '''(experimental) Grants permission to list the blocks in an Amazon Elastic Block Store (EBS) snapshot.

        Access Level: Read

        https://docs.aws.amazon.com/ebs/latest/APIReference/API_ListSnapshotBlocks.html

        :stability: experimental
        '''
        return typing.cast("Ebs", jsii.invoke(self, "toListSnapshotBlocks", []))

    @jsii.member(jsii_name="toPutSnapshotBlock")
    def to_put_snapshot_block(self) -> "Ebs":
        '''(experimental) Grants permission to write a block of data to a snapshot created by the StartSnapshot operation.

        Access Level: Write

        https://docs.aws.amazon.com/ebs/latest/APIReference/API_PutSnapshotBlock.html

        :stability: experimental
        '''
        return typing.cast("Ebs", jsii.invoke(self, "toPutSnapshotBlock", []))

    @jsii.member(jsii_name="toStartSnapshot")
    def to_start_snapshot(self) -> "Ebs":
        '''(experimental) Grants permission to create a new EBS snapshot.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/ebs/latest/APIReference/API_StartSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Ebs", jsii.invoke(self, "toStartSnapshot", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Ec2(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Ec2"):
    '''(experimental) Statement provider for service `ec2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `ec2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Ec2, self, [sid])

    @jsii.member(jsii_name="ifAccepterVpc")
    def if_accepter_vpc(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of an accepter VPC in a VPC peering connection.

        https://docs.aws.amazon.com/vpc/latest/peering/security-iam.html

        Applies to actions:

        - .toAcceptVpcPeeringConnection()
        - .toCreateRoute()
        - .toCreateTags()
        - .toCreateVpcPeeringConnection()
        - .toDeleteTags()
        - .toDeleteVpcPeeringConnection()
        - .toModifyVpcPeeringConnectionOptions()
        - .toRejectVpcPeeringConnection()
        - .toReplaceRoute()

        Applies to resource types:

        - vpc-peering-connection

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifAccepterVpc", [value, operator]))

    @jsii.member(jsii_name="ifAssociatePublicIpAddress")
    def if_associate_public_ip_address(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by whether the user wants to associate a public IP address with the instance.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAssignIpv6Addresses()
        - .toAssignPrivateIpAddresses()
        - .toAssociateAddress()
        - .toAttachNetworkInterface()
        - .toCreateFleet()
        - .toCreateFlowLogs()
        - .toCreateLaunchTemplate()
        - .toCreateLaunchTemplateVersion()
        - .toCreateNetworkInterface()
        - .toCreateNetworkInterfacePermission()
        - .toCreateRoute()
        - .toCreateTags()
        - .toCreateTrafficMirrorSession()
        - .toCreateTrafficMirrorTarget()
        - .toDeleteNetworkInterface()
        - .toDeleteTags()
        - .toDeregisterTransitGatewayMulticastGroupMembers()
        - .toDeregisterTransitGatewayMulticastGroupSources()
        - .toDetachNetworkInterface()
        - .toDisassociateAddress()
        - .toModifyFleet()
        - .toModifyNetworkInterfaceAttribute()
        - .toRegisterTransitGatewayMulticastGroupMembers()
        - .toRegisterTransitGatewayMulticastGroupSources()
        - .toReplaceRoute()
        - .toResetNetworkInterfaceAttribute()
        - .toRunInstances()
        - .toRunScheduledInstances()
        - .toUnassignIpv6Addresses()
        - .toUnassignPrivateIpAddresses()

        Applies to resource types:

        - network-interface

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifAssociatePublicIpAddress", [value]))

    @jsii.member(jsii_name="ifAttribute")
    def if_attribute(
        self,
        attribute_name: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by an attribute being set on a resource.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        :param attribute_name: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifAttribute", [attribute_name, value, operator]))

    @jsii.member(jsii_name="ifAuthenticationType")
    def if_authentication_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the authentication type for the VPN tunnel endpoints.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-authentication-access-control.html

        Applies to actions:

        - .toCreateTags()
        - .toCreateVpnConnection()
        - .toCreateVpnConnectionRoute()
        - .toDeleteTags()
        - .toDeleteVpnConnection()
        - .toDeleteVpnConnectionRoute()
        - .toModifyVpnConnection()
        - .toModifyVpnConnectionOptions()
        - .toModifyVpnTunnelCertificate()
        - .toModifyVpnTunnelOptions()
        - .toTerminateClientVpnConnections()

        Applies to resource types:

        - vpn-connection

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifAuthenticationType", [value, operator]))

    @jsii.member(jsii_name="ifAuthorizedService")
    def if_authorized_service(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the AWS service that has permission to use a resource.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAssignIpv6Addresses()
        - .toAssignPrivateIpAddresses()
        - .toAssociateAddress()
        - .toAttachNetworkInterface()
        - .toCreateFleet()
        - .toCreateFlowLogs()
        - .toCreateLaunchTemplate()
        - .toCreateLaunchTemplateVersion()
        - .toCreateNetworkInterface()
        - .toCreateNetworkInterfacePermission()
        - .toCreateRoute()
        - .toCreateTags()
        - .toCreateTrafficMirrorSession()
        - .toCreateTrafficMirrorTarget()
        - .toDeleteNetworkInterface()
        - .toDeleteTags()
        - .toDeregisterTransitGatewayMulticastGroupMembers()
        - .toDeregisterTransitGatewayMulticastGroupSources()
        - .toDetachNetworkInterface()
        - .toDisassociateAddress()
        - .toModifyFleet()
        - .toModifyNetworkInterfaceAttribute()
        - .toRegisterTransitGatewayMulticastGroupMembers()
        - .toRegisterTransitGatewayMulticastGroupSources()
        - .toReplaceRoute()
        - .toResetNetworkInterfaceAttribute()
        - .toRunInstances()
        - .toRunScheduledInstances()
        - .toUnassignIpv6Addresses()
        - .toUnassignPrivateIpAddresses()

        Applies to resource types:

        - network-interface

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifAuthorizedService", [value, operator]))

    @jsii.member(jsii_name="ifAuthorizedUser")
    def if_authorized_user(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by an IAM principal that has permission to use a resource.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifAuthorizedUser", [value, operator]))

    @jsii.member(jsii_name="ifAutoPlacement")
    def if_auto_placement(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the Auto Placement properties of a Dedicated Host.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAllocateHosts()
        - .toCreateLaunchTemplate()
        - .toCreateLaunchTemplateVersion()
        - .toCreateTags()
        - .toDeleteTags()
        - .toGetHostReservationPurchasePreview()
        - .toModifyHosts()
        - .toModifyInstancePlacement()
        - .toPurchaseHostReservation()
        - .toReleaseHosts()

        Applies to resource types:

        - dedicated-host

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifAutoPlacement", [value, operator]))

    @jsii.member(jsii_name="ifAvailabilityZone")
    def if_availability_zone(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the name of an Availability Zone in an AWS Region.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAcceptReservedInstancesExchangeQuote()
        - .toAcceptTransitGatewayMulticastDomainAssociations()
        - .toAllocateHosts()
        - .toAssignIpv6Addresses()
        - .toAssignPrivateIpAddresses()
        - .toAssociateAddress()
        - .toAssociateClientVpnTargetNetwork()
        - .toAssociateIamInstanceProfile()
        - .toAssociateRouteTable()
        - .toAssociateSubnetCidrBlock()
        - .toAssociateTransitGatewayMulticastDomain()
        - .toAttachClassicLinkVpc()
        - .toAttachNetworkInterface()
        - .toAttachVolume()
        - .toBundleInstance()
        - .toConfirmProductInstance()
        - .toCreateClientVpnRoute()
        - .toCreateFleet()
        - .toCreateFlowLogs()
        - .toCreateImage()
        - .toCreateInstanceExportTask()
        - .toCreateLaunchTemplate()
        - .toCreateLaunchTemplateVersion()
        - .toCreateNatGateway()
        - .toCreateNetworkInterface()
        - .toCreateNetworkInterfacePermission()
        - .toCreateReservedInstancesListing()
        - .toCreateRoute()
        - .toCreateSnapshot()
        - .toCreateSnapshots()
        - .toCreateSubnet()
        - .toCreateTags()
        - .toCreateTrafficMirrorSession()
        - .toCreateTrafficMirrorTarget()
        - .toCreateTransitGatewayVpcAttachment()
        - .toCreateVolume()
        - .toCreateVpcEndpoint()
        - .toDeleteClientVpnRoute()
        - .toDeleteNetworkInterface()
        - .toDeleteQueuedReservedInstances()
        - .toDeleteSubnet()
        - .toDeleteTags()
        - .toDeleteVolume()
        - .toDeregisterTransitGatewayMulticastGroupMembers()
        - .toDeregisterTransitGatewayMulticastGroupSources()
        - .toDetachClassicLinkVpc()
        - .toDetachNetworkInterface()
        - .toDetachVolume()
        - .toDisassociateAddress()
        - .toDisassociateIamInstanceProfile()
        - .toDisassociateRouteTable()
        - .toDisassociateSubnetCidrBlock()
        - .toDisassociateTransitGatewayMulticastDomain()
        - .toEnableVolumeIO()
        - .toGetConsoleOutput()
        - .toGetConsoleScreenshot()
        - .toGetHostReservationPurchasePreview()
        - .toGetLaunchTemplateData()
        - .toGetPasswordData()
        - .toGetReservedInstancesExchangeQuote()
        - .toImportInstance()
        - .toModifyFleet()
        - .toModifyHosts()
        - .toModifyInstanceAttribute()
        - .toModifyInstanceCapacityReservationAttributes()
        - .toModifyInstanceCreditSpecification()
        - .toModifyInstanceEventStartTime()
        - .toModifyInstanceMetadataOptions()
        - .toModifyInstancePlacement()
        - .toModifyNetworkInterfaceAttribute()
        - .toModifyReservedInstances()
        - .toModifySubnetAttribute()
        - .toModifyTransitGatewayVpcAttachment()
        - .toModifyVolume()
        - .toModifyVolumeAttribute()
        - .toModifyVpcEndpoint()
        - .toMonitorInstances()
        - .toPurchaseHostReservation()
        - .toPurchaseReservedInstancesOffering()
        - .toRebootInstances()
        - .toRegisterTransitGatewayMulticastGroupMembers()
        - .toRegisterTransitGatewayMulticastGroupSources()
        - .toRejectTransitGatewayMulticastDomainAssociations()
        - .toReleaseHosts()
        - .toReplaceIamInstanceProfileAssociation()
        - .toReplaceRoute()
        - .toReportInstanceStatus()
        - .toRequestSpotInstances()
        - .toResetInstanceAttribute()
        - .toResetNetworkInterfaceAttribute()
        - .toRunInstances()
        - .toRunScheduledInstances()
        - .toSendDiagnosticInterrupt()
        - .toStartInstances()
        - .toStopInstances()
        - .toTerminateInstances()
        - .toUnassignIpv6Addresses()
        - .toUnassignPrivateIpAddresses()
        - .toUnmonitorInstances()

        Applies to resource types:

        - dedicated-host
        - instance
        - network-interface
        - reserved-instances
        - subnet
        - volume

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifAvailabilityZone", [value, operator]))

    @jsii.member(jsii_name="ifClientRootCertificateChainArn")
    def if_client_root_certificate_chain_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of the client root certificate chain.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toApplySecurityGroupsToClientVpnTargetNetwork()
        - .toAssociateClientVpnTargetNetwork()
        - .toAuthorizeClientVpnIngress()
        - .toCreateClientVpnEndpoint()
        - .toCreateClientVpnRoute()
        - .toCreateTags()
        - .toDeleteClientVpnEndpoint()
        - .toDeleteClientVpnRoute()
        - .toDeleteTags()
        - .toDisassociateClientVpnTargetNetwork()
        - .toExportClientVpnClientCertificateRevocationList()
        - .toExportClientVpnClientConfiguration()
        - .toImportClientVpnClientCertificateRevocationList()
        - .toModifyClientVpnEndpoint()
        - .toRevokeClientVpnIngress()
        - .toTerminateClientVpnConnections()

        Applies to resource types:

        - client-vpn-endpoint

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifClientRootCertificateChainArn", [value, operator]))

    @jsii.member(jsii_name="ifCloudwatchLogGroupArn")
    def if_cloudwatch_log_group_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of the CloudWatch Logs log group.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toApplySecurityGroupsToClientVpnTargetNetwork()
        - .toAssociateClientVpnTargetNetwork()
        - .toAuthorizeClientVpnIngress()
        - .toCreateClientVpnEndpoint()
        - .toCreateClientVpnRoute()
        - .toCreateTags()
        - .toDeleteClientVpnEndpoint()
        - .toDeleteClientVpnRoute()
        - .toDeleteTags()
        - .toDisassociateClientVpnTargetNetwork()
        - .toExportClientVpnClientCertificateRevocationList()
        - .toExportClientVpnClientConfiguration()
        - .toImportClientVpnClientCertificateRevocationList()
        - .toModifyClientVpnEndpoint()
        - .toRevokeClientVpnIngress()
        - .toTerminateClientVpnConnections()

        Applies to resource types:

        - client-vpn-endpoint

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifCloudwatchLogGroupArn", [value, operator]))

    @jsii.member(jsii_name="ifCloudwatchLogStreamArn")
    def if_cloudwatch_log_stream_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of the CloudWatch Logs log stream.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toApplySecurityGroupsToClientVpnTargetNetwork()
        - .toAssociateClientVpnTargetNetwork()
        - .toAuthorizeClientVpnIngress()
        - .toCreateClientVpnEndpoint()
        - .toCreateClientVpnRoute()
        - .toCreateTags()
        - .toDeleteClientVpnEndpoint()
        - .toDeleteClientVpnRoute()
        - .toDeleteTags()
        - .toDisassociateClientVpnTargetNetwork()
        - .toExportClientVpnClientCertificateRevocationList()
        - .toExportClientVpnClientConfiguration()
        - .toImportClientVpnClientCertificateRevocationList()
        - .toModifyClientVpnEndpoint()
        - .toRevokeClientVpnIngress()
        - .toTerminateClientVpnConnections()

        Applies to resource types:

        - client-vpn-endpoint

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifCloudwatchLogStreamArn", [value, operator]))

    @jsii.member(jsii_name="ifCreateAction")
    def if_create_action(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the name of a resource-creating API action.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/supported-iam-actions-tagging.html

        Applies to actions:

        - .toCreateTags()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifCreateAction", [value, operator]))

    @jsii.member(jsii_name="ifDirectoryArn")
    def if_directory_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of the directory.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toApplySecurityGroupsToClientVpnTargetNetwork()
        - .toAssociateClientVpnTargetNetwork()
        - .toAuthorizeClientVpnIngress()
        - .toCreateClientVpnEndpoint()
        - .toCreateClientVpnRoute()
        - .toCreateTags()
        - .toDeleteClientVpnEndpoint()
        - .toDeleteClientVpnRoute()
        - .toDeleteTags()
        - .toDisassociateClientVpnTargetNetwork()
        - .toExportClientVpnClientCertificateRevocationList()
        - .toExportClientVpnClientConfiguration()
        - .toImportClientVpnClientCertificateRevocationList()
        - .toModifyClientVpnEndpoint()
        - .toRevokeClientVpnIngress()
        - .toTerminateClientVpnConnections()

        Applies to resource types:

        - client-vpn-endpoint

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifDirectoryArn", [value, operator]))

    @jsii.member(jsii_name="ifDPDTimeoutSeconds")
    def if_dpd_timeout_seconds(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the duration after which DPD timeout occurs on a VPN tunnel.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-authentication-access-control.html

        Applies to actions:

        - .toCreateTags()
        - .toCreateVpnConnection()
        - .toCreateVpnConnectionRoute()
        - .toDeleteTags()
        - .toDeleteVpnConnection()
        - .toDeleteVpnConnectionRoute()
        - .toModifyVpnConnection()
        - .toModifyVpnConnectionOptions()
        - .toModifyVpnTunnelCertificate()
        - .toModifyVpnTunnelOptions()
        - .toTerminateClientVpnConnections()

        Applies to resource types:

        - vpn-connection

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifDPDTimeoutSeconds", [value, operator]))

    @jsii.member(jsii_name="ifEbsOptimized")
    def if_ebs_optimized(self, value: typing.Optional[builtins.bool] = None) -> "Ec2":
        '''(experimental) Filters access by whether the instance is enabled for EBS optimization.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAssociateAddress()
        - .toAssociateIamInstanceProfile()
        - .toAttachClassicLinkVpc()
        - .toAttachNetworkInterface()
        - .toAttachVolume()
        - .toBundleInstance()
        - .toConfirmProductInstance()
        - .toCreateImage()
        - .toCreateInstanceExportTask()
        - .toCreateRoute()
        - .toCreateSnapshots()
        - .toCreateTags()
        - .toDeleteTags()
        - .toDetachClassicLinkVpc()
        - .toDetachNetworkInterface()
        - .toDetachVolume()
        - .toDisassociateAddress()
        - .toDisassociateIamInstanceProfile()
        - .toGetConsoleOutput()
        - .toGetConsoleScreenshot()
        - .toGetLaunchTemplateData()
        - .toGetPasswordData()
        - .toModifyInstanceAttribute()
        - .toModifyInstanceCapacityReservationAttributes()
        - .toModifyInstanceCreditSpecification()
        - .toModifyInstanceEventStartTime()
        - .toModifyInstanceMetadataOptions()
        - .toModifyInstancePlacement()
        - .toModifyNetworkInterfaceAttribute()
        - .toMonitorInstances()
        - .toRebootInstances()
        - .toReplaceIamInstanceProfileAssociation()
        - .toReplaceRoute()
        - .toReportInstanceStatus()
        - .toResetInstanceAttribute()
        - .toRunInstances()
        - .toSendDiagnosticInterrupt()
        - .toStartInstances()
        - .toStopInstances()
        - .toTerminateInstances()
        - .toUnmonitorInstances()

        Applies to resource types:

        - instance

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifEbsOptimized", [value]))

    @jsii.member(jsii_name="ifElasticGpuType")
    def if_elastic_gpu_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the type of Elastic Graphics accelerator.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toCreateTags()
        - .toDeleteTags()
        - .toRunInstances()

        Applies to resource types:

        - elastic-gpu

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifElasticGpuType", [value, operator]))

    @jsii.member(jsii_name="ifEncrypted")
    def if_encrypted(self, value: typing.Optional[builtins.bool] = None) -> "Ec2":
        '''(experimental) Filters access by whether the EBS volume is encrypted.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAttachVolume()
        - .toCreateSnapshot()
        - .toCreateSnapshots()
        - .toCreateTags()
        - .toCreateVolume()
        - .toDeleteTags()
        - .toDeleteVolume()
        - .toDetachVolume()
        - .toEnableVolumeIO()
        - .toModifyInstanceAttribute()
        - .toModifyVolume()
        - .toModifyVolumeAttribute()
        - .toRunInstances()

        Applies to resource types:

        - volume

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifEncrypted", [value]))

    @jsii.member(jsii_name="ifGatewayType")
    def if_gateway_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the gateway type for a VPN endpoint on the AWS side of a VPN connection.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-authentication-access-control.html

        Applies to actions:

        - .toCreateTags()
        - .toCreateVpnConnection()
        - .toCreateVpnConnectionRoute()
        - .toDeleteTags()
        - .toDeleteVpnConnection()
        - .toDeleteVpnConnectionRoute()
        - .toModifyVpnConnection()
        - .toModifyVpnConnectionOptions()
        - .toModifyVpnTunnelCertificate()
        - .toModifyVpnTunnelOptions()
        - .toTerminateClientVpnConnections()

        Applies to resource types:

        - vpn-connection

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifGatewayType", [value, operator]))

    @jsii.member(jsii_name="ifHostRecovery")
    def if_host_recovery(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by whether host recovery is enabled for a Dedicated Host.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAllocateHosts()
        - .toCreateLaunchTemplate()
        - .toCreateLaunchTemplateVersion()
        - .toCreateTags()
        - .toDeleteTags()
        - .toGetHostReservationPurchasePreview()
        - .toModifyHosts()
        - .toModifyInstancePlacement()
        - .toPurchaseHostReservation()
        - .toReleaseHosts()

        Applies to resource types:

        - dedicated-host

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifHostRecovery", [value, operator]))

    @jsii.member(jsii_name="ifIKEVersions")
    def if_ike_versions(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the internet key exchange (IKE) versions that are permitted for a VPN tunnel.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-authentication-access-control.html

        Applies to actions:

        - .toCreateTags()
        - .toCreateVpnConnection()
        - .toCreateVpnConnectionRoute()
        - .toDeleteTags()
        - .toDeleteVpnConnection()
        - .toDeleteVpnConnectionRoute()
        - .toModifyVpnConnection()
        - .toModifyVpnConnectionOptions()
        - .toModifyVpnTunnelCertificate()
        - .toModifyVpnTunnelOptions()
        - .toTerminateClientVpnConnections()

        Applies to resource types:

        - vpn-connection

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifIKEVersions", [value, operator]))

    @jsii.member(jsii_name="ifImageType")
    def if_image_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the type of image (machine, aki, or ari).

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toCreateFleet()
        - .toCreateImage()
        - .toCreateLaunchTemplate()
        - .toCreateLaunchTemplateVersion()
        - .toCreateTags()
        - .toDeleteTags()
        - .toDeregisterImage()
        - .toExportImage()
        - .toImportImage()
        - .toModifyFleet()
        - .toModifyImageAttribute()
        - .toRequestSpotInstances()
        - .toResetImageAttribute()
        - .toRunInstances()
        - .toRunScheduledInstances()

        Applies to resource types:

        - image

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifImageType", [value, operator]))

    @jsii.member(jsii_name="ifInsideTunnelCidr")
    def if_inside_tunnel_cidr(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the range of inside IP addresses for a VPN tunnel.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-authentication-access-control.html

        Applies to actions:

        - .toCreateTags()
        - .toCreateVpnConnection()
        - .toCreateVpnConnectionRoute()
        - .toDeleteTags()
        - .toDeleteVpnConnection()
        - .toDeleteVpnConnectionRoute()
        - .toModifyVpnConnection()
        - .toModifyVpnConnectionOptions()
        - .toModifyVpnTunnelCertificate()
        - .toModifyVpnTunnelOptions()
        - .toTerminateClientVpnConnections()

        Applies to resource types:

        - vpn-connection

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifInsideTunnelCidr", [value, operator]))

    @jsii.member(jsii_name="ifInstanceMarketType")
    def if_instance_market_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the market or purchasing option of an instance (on-demand or spot).

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifInstanceMarketType", [value, operator]))

    @jsii.member(jsii_name="ifInstanceProfile")
    def if_instance_profile(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of an instance profile.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAssociateAddress()
        - .toAssociateIamInstanceProfile()
        - .toAttachClassicLinkVpc()
        - .toAttachNetworkInterface()
        - .toAttachVolume()
        - .toBundleInstance()
        - .toConfirmProductInstance()
        - .toCreateImage()
        - .toCreateInstanceExportTask()
        - .toCreateRoute()
        - .toCreateSnapshots()
        - .toCreateTags()
        - .toDeleteTags()
        - .toDetachClassicLinkVpc()
        - .toDetachNetworkInterface()
        - .toDetachVolume()
        - .toDisassociateAddress()
        - .toDisassociateIamInstanceProfile()
        - .toGetConsoleOutput()
        - .toGetConsoleScreenshot()
        - .toGetLaunchTemplateData()
        - .toGetPasswordData()
        - .toModifyInstanceAttribute()
        - .toModifyInstanceCapacityReservationAttributes()
        - .toModifyInstanceCreditSpecification()
        - .toModifyInstanceEventStartTime()
        - .toModifyInstanceMetadataOptions()
        - .toModifyInstancePlacement()
        - .toModifyNetworkInterfaceAttribute()
        - .toMonitorInstances()
        - .toRebootInstances()
        - .toReplaceIamInstanceProfileAssociation()
        - .toReplaceRoute()
        - .toReportInstanceStatus()
        - .toResetInstanceAttribute()
        - .toRunInstances()
        - .toSendDiagnosticInterrupt()
        - .toStartInstances()
        - .toStopInstances()
        - .toTerminateInstances()
        - .toUnmonitorInstances()

        Applies to resource types:

        - instance

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifInstanceProfile", [value, operator]))

    @jsii.member(jsii_name="ifInstanceType")
    def if_instance_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the type of instance.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAcceptReservedInstancesExchangeQuote()
        - .toAllocateHosts()
        - .toAssociateAddress()
        - .toAssociateIamInstanceProfile()
        - .toAttachClassicLinkVpc()
        - .toAttachNetworkInterface()
        - .toAttachVolume()
        - .toBundleInstance()
        - .toConfirmProductInstance()
        - .toCreateImage()
        - .toCreateInstanceExportTask()
        - .toCreateLaunchTemplate()
        - .toCreateLaunchTemplateVersion()
        - .toCreateReservedInstancesListing()
        - .toCreateRoute()
        - .toCreateSnapshots()
        - .toCreateTags()
        - .toDeleteQueuedReservedInstances()
        - .toDeleteTags()
        - .toDetachClassicLinkVpc()
        - .toDetachNetworkInterface()
        - .toDetachVolume()
        - .toDisassociateAddress()
        - .toDisassociateIamInstanceProfile()
        - .toGetConsoleOutput()
        - .toGetConsoleScreenshot()
        - .toGetHostReservationPurchasePreview()
        - .toGetLaunchTemplateData()
        - .toGetPasswordData()
        - .toGetReservedInstancesExchangeQuote()
        - .toModifyHosts()
        - .toModifyInstanceAttribute()
        - .toModifyInstanceCapacityReservationAttributes()
        - .toModifyInstanceCreditSpecification()
        - .toModifyInstanceEventStartTime()
        - .toModifyInstanceMetadataOptions()
        - .toModifyInstancePlacement()
        - .toModifyNetworkInterfaceAttribute()
        - .toModifyReservedInstances()
        - .toMonitorInstances()
        - .toPurchaseHostReservation()
        - .toPurchaseReservedInstancesOffering()
        - .toRebootInstances()
        - .toReleaseHosts()
        - .toReplaceIamInstanceProfileAssociation()
        - .toReplaceRoute()
        - .toReportInstanceStatus()
        - .toResetInstanceAttribute()
        - .toRunInstances()
        - .toSendDiagnosticInterrupt()
        - .toStartInstances()
        - .toStopInstances()
        - .toTerminateInstances()
        - .toUnmonitorInstances()

        Applies to resource types:

        - dedicated-host
        - instance
        - reserved-instances

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifInstanceType", [value, operator]))

    @jsii.member(jsii_name="ifIsLaunchTemplateResource")
    def if_is_launch_template_resource(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by whether users are able to override resources that are specified in the launch template.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifIsLaunchTemplateResource", [value]))

    @jsii.member(jsii_name="ifKeyPairName")
    def if_key_pair_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by key pair name.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toCreateFleet()
        - .toCreateKeyPair()
        - .toCreateLaunchTemplate()
        - .toCreateLaunchTemplateVersion()
        - .toCreateTags()
        - .toDeleteKeyPair()
        - .toDeleteTags()
        - .toImportKeyPair()
        - .toModifyFleet()
        - .toRequestSpotInstances()
        - .toRunInstances()
        - .toRunScheduledInstances()

        Applies to resource types:

        - key-pair

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifKeyPairName", [value, operator]))

    @jsii.member(jsii_name="ifLaunchTemplate")
    def if_launch_template(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of a launch template.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifLaunchTemplate", [value, operator]))

    @jsii.member(jsii_name="ifMetadataHttpEndpoint")
    def if_metadata_http_endpoint(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by whether the HTTP endpoint is enabled for the instance metadata service.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifMetadataHttpEndpoint", [value, operator]))

    @jsii.member(jsii_name="ifMetadataHttpPutResponseHopLimit")
    def if_metadata_http_put_response_hop_limit(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the allowed number of hops when calling the instance metadata service.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifMetadataHttpPutResponseHopLimit", [value, operator]))

    @jsii.member(jsii_name="ifMetadataHttpTokens")
    def if_metadata_http_tokens(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by whether tokens are required when calling the instance metadata service (optional or required).

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifMetadataHttpTokens", [value, operator]))

    @jsii.member(jsii_name="ifOutpostArn")
    def if_outpost_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of the Outpost.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toCopySnapshot()
        - .toCreateSnapshot()
        - .toCreateSnapshots()
        - .toDeleteSnapshot()
        - .toModifySnapshotAttribute()

        Applies to resource types:

        - snapshot

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifOutpostArn", [value, operator]))

    @jsii.member(jsii_name="ifOwner")
    def if_owner(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the owner of the resource (amazon, aws-marketplace, or an AWS account ID).

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toCopyFpgaImage()
        - .toCopyImage()
        - .toCreateFleet()
        - .toCreateFpgaImage()
        - .toCreateImage()
        - .toCreateLaunchTemplate()
        - .toCreateLaunchTemplateVersion()
        - .toCreateSnapshot()
        - .toCreateSnapshots()
        - .toCreateTags()
        - .toCreateVolume()
        - .toDeleteFpgaImage()
        - .toDeleteSnapshot()
        - .toDeleteTags()
        - .toDeregisterImage()
        - .toDisableFastSnapshotRestores()
        - .toEnableFastSnapshotRestores()
        - .toExportImage()
        - .toImportImage()
        - .toImportSnapshot()
        - .toModifyFleet()
        - .toModifyFpgaImageAttribute()
        - .toModifyImageAttribute()
        - .toModifySnapshotAttribute()
        - .toRequestSpotInstances()
        - .toResetFpgaImageAttribute()
        - .toResetImageAttribute()
        - .toResetSnapshotAttribute()
        - .toRunInstances()
        - .toRunScheduledInstances()

        Applies to resource types:

        - fpga-image
        - image
        - snapshot

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifOwner", [value, operator]))

    @jsii.member(jsii_name="ifParentSnapshot")
    def if_parent_snapshot(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of the parent snapshot.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAttachVolume()
        - .toCreateSnapshot()
        - .toCreateSnapshots()
        - .toCreateTags()
        - .toCreateVolume()
        - .toDeleteTags()
        - .toDeleteVolume()
        - .toDetachVolume()
        - .toEnableVolumeIO()
        - .toModifyInstanceAttribute()
        - .toModifyVolume()
        - .toModifyVolumeAttribute()
        - .toRunInstances()

        Applies to resource types:

        - volume

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifParentSnapshot", [value, operator]))

    @jsii.member(jsii_name="ifParentVolume")
    def if_parent_volume(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of the parent volume from which the snapshot was created.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toCreateFleet()
        - .toCreateLaunchTemplate()
        - .toCreateLaunchTemplateVersion()
        - .toCreateSnapshot()
        - .toCreateSnapshots()
        - .toCreateTags()
        - .toCreateVolume()
        - .toDeleteSnapshot()
        - .toDeleteTags()
        - .toDisableFastSnapshotRestores()
        - .toEnableFastSnapshotRestores()
        - .toImportImage()
        - .toImportSnapshot()
        - .toModifyFleet()
        - .toModifySnapshotAttribute()
        - .toResetSnapshotAttribute()
        - .toRunInstances()
        - .toRunScheduledInstances()

        Applies to resource types:

        - snapshot

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifParentVolume", [value, operator]))

    @jsii.member(jsii_name="ifPermission")
    def if_permission(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the type of permission for a resource (INSTANCE-ATTACH or EIP-ASSOCIATE).

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifPermission", [value, operator]))

    @jsii.member(jsii_name="ifPhase1DHGroupNumbers")
    def if_phase1_dh_group_numbers(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the Diffie-Hellman group numbers that are permitted for a VPN tunnel for the phase 1 IKE negotiations.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-authentication-access-control.html

        Applies to actions:

        - .toCreateTags()
        - .toCreateVpnConnection()
        - .toCreateVpnConnectionRoute()
        - .toDeleteTags()
        - .toDeleteVpnConnection()
        - .toDeleteVpnConnectionRoute()
        - .toModifyVpnConnection()
        - .toModifyVpnConnectionOptions()
        - .toModifyVpnTunnelCertificate()
        - .toModifyVpnTunnelOptions()
        - .toTerminateClientVpnConnections()

        Applies to resource types:

        - vpn-connection

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifPhase1DHGroupNumbers", [value, operator]))

    @jsii.member(jsii_name="ifPhase1EncryptionAlgorithms")
    def if_phase1_encryption_algorithms(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the encryption algorithms that are permitted for a VPN tunnel for the phase 1 IKE negotiations.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-authentication-access-control.html

        Applies to actions:

        - .toCreateTags()
        - .toCreateVpnConnection()
        - .toCreateVpnConnectionRoute()
        - .toDeleteTags()
        - .toDeleteVpnConnection()
        - .toDeleteVpnConnectionRoute()
        - .toModifyVpnConnection()
        - .toModifyVpnConnectionOptions()
        - .toModifyVpnTunnelCertificate()
        - .toModifyVpnTunnelOptions()
        - .toTerminateClientVpnConnections()

        Applies to resource types:

        - vpn-connection

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifPhase1EncryptionAlgorithms", [value, operator]))

    @jsii.member(jsii_name="ifPhase1IntegrityAlgorithms")
    def if_phase1_integrity_algorithms(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the integrity algorithms that are permitted for a VPN tunnel for the phase 1 IKE negotiations.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-authentication-access-control.html

        Applies to actions:

        - .toCreateTags()
        - .toCreateVpnConnection()
        - .toCreateVpnConnectionRoute()
        - .toDeleteTags()
        - .toDeleteVpnConnection()
        - .toDeleteVpnConnectionRoute()
        - .toModifyVpnConnection()
        - .toModifyVpnConnectionOptions()
        - .toModifyVpnTunnelCertificate()
        - .toModifyVpnTunnelOptions()
        - .toTerminateClientVpnConnections()

        Applies to resource types:

        - vpn-connection

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifPhase1IntegrityAlgorithms", [value, operator]))

    @jsii.member(jsii_name="ifPhase1LifetimeSeconds")
    def if_phase1_lifetime_seconds(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the lifetime in seconds for phase 1 of the IKE negotiations for a VPN tunnel.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-authentication-access-control.html

        Applies to actions:

        - .toCreateTags()
        - .toCreateVpnConnection()
        - .toCreateVpnConnectionRoute()
        - .toDeleteTags()
        - .toDeleteVpnConnection()
        - .toDeleteVpnConnectionRoute()
        - .toModifyVpnConnection()
        - .toModifyVpnConnectionOptions()
        - .toModifyVpnTunnelCertificate()
        - .toModifyVpnTunnelOptions()
        - .toTerminateClientVpnConnections()

        Applies to resource types:

        - vpn-connection

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifPhase1LifetimeSeconds", [value, operator]))

    @jsii.member(jsii_name="ifPhase2DHGroupNumbers")
    def if_phase2_dh_group_numbers(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the Diffie-Hellman group numbers that are permitted for a VPN tunnel for the phase 2 IKE negotiations.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-authentication-access-control.html

        Applies to actions:

        - .toCreateTags()
        - .toCreateVpnConnection()
        - .toCreateVpnConnectionRoute()
        - .toDeleteTags()
        - .toDeleteVpnConnection()
        - .toDeleteVpnConnectionRoute()
        - .toModifyVpnConnection()
        - .toModifyVpnConnectionOptions()
        - .toModifyVpnTunnelCertificate()
        - .toModifyVpnTunnelOptions()
        - .toTerminateClientVpnConnections()

        Applies to resource types:

        - vpn-connection

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifPhase2DHGroupNumbers", [value, operator]))

    @jsii.member(jsii_name="ifPhase2EncryptionAlgorithms")
    def if_phase2_encryption_algorithms(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the encryption algorithms that are permitted for a VPN tunnel for the phase 2 IKE negotiations.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-authentication-access-control.html

        Applies to actions:

        - .toCreateTags()
        - .toCreateVpnConnection()
        - .toCreateVpnConnectionRoute()
        - .toDeleteTags()
        - .toDeleteVpnConnection()
        - .toDeleteVpnConnectionRoute()
        - .toModifyVpnConnection()
        - .toModifyVpnConnectionOptions()
        - .toModifyVpnTunnelCertificate()
        - .toModifyVpnTunnelOptions()
        - .toTerminateClientVpnConnections()

        Applies to resource types:

        - vpn-connection

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifPhase2EncryptionAlgorithms", [value, operator]))

    @jsii.member(jsii_name="ifPhase2IntegrityAlgorithms")
    def if_phase2_integrity_algorithms(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the integrity algorithms that are permitted for a VPN tunnel for the phase 2 IKE negotiations.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-authentication-access-control.html

        Applies to actions:

        - .toCreateTags()
        - .toCreateVpnConnection()
        - .toCreateVpnConnectionRoute()
        - .toDeleteTags()
        - .toDeleteVpnConnection()
        - .toDeleteVpnConnectionRoute()
        - .toModifyVpnConnection()
        - .toModifyVpnConnectionOptions()
        - .toModifyVpnTunnelCertificate()
        - .toModifyVpnTunnelOptions()
        - .toTerminateClientVpnConnections()

        Applies to resource types:

        - vpn-connection

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifPhase2IntegrityAlgorithms", [value, operator]))

    @jsii.member(jsii_name="ifPhase2LifetimeSeconds")
    def if_phase2_lifetime_seconds(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the lifetime in seconds for phase 2 of the IKE negotiations for a VPN tunnel.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-authentication-access-control.html

        Applies to actions:

        - .toCreateTags()
        - .toCreateVpnConnection()
        - .toCreateVpnConnectionRoute()
        - .toDeleteTags()
        - .toDeleteVpnConnection()
        - .toDeleteVpnConnectionRoute()
        - .toModifyVpnConnection()
        - .toModifyVpnConnectionOptions()
        - .toModifyVpnTunnelCertificate()
        - .toModifyVpnTunnelOptions()
        - .toTerminateClientVpnConnections()

        Applies to resource types:

        - vpn-connection

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifPhase2LifetimeSeconds", [value, operator]))

    @jsii.member(jsii_name="ifPlacementGroup")
    def if_placement_group(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of the placement group.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAssociateAddress()
        - .toAssociateIamInstanceProfile()
        - .toAttachClassicLinkVpc()
        - .toAttachNetworkInterface()
        - .toAttachVolume()
        - .toBundleInstance()
        - .toConfirmProductInstance()
        - .toCreateImage()
        - .toCreateInstanceExportTask()
        - .toCreateRoute()
        - .toCreateSnapshots()
        - .toCreateTags()
        - .toDeleteTags()
        - .toDetachClassicLinkVpc()
        - .toDetachNetworkInterface()
        - .toDetachVolume()
        - .toDisassociateAddress()
        - .toDisassociateIamInstanceProfile()
        - .toGetConsoleOutput()
        - .toGetConsoleScreenshot()
        - .toGetLaunchTemplateData()
        - .toGetPasswordData()
        - .toModifyInstanceAttribute()
        - .toModifyInstanceCapacityReservationAttributes()
        - .toModifyInstanceCreditSpecification()
        - .toModifyInstanceEventStartTime()
        - .toModifyInstanceMetadataOptions()
        - .toModifyInstancePlacement()
        - .toModifyNetworkInterfaceAttribute()
        - .toMonitorInstances()
        - .toRebootInstances()
        - .toReplaceIamInstanceProfileAssociation()
        - .toReplaceRoute()
        - .toReportInstanceStatus()
        - .toResetInstanceAttribute()
        - .toRunInstances()
        - .toSendDiagnosticInterrupt()
        - .toStartInstances()
        - .toStopInstances()
        - .toTerminateInstances()
        - .toUnmonitorInstances()

        Applies to resource types:

        - instance

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifPlacementGroup", [value, operator]))

    @jsii.member(jsii_name="ifPlacementGroupStrategy")
    def if_placement_group_strategy(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the instance placement strategy used by the placement group (cluster, spread, or partition).

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toCreateLaunchTemplate()
        - .toCreateLaunchTemplateVersion()
        - .toCreatePlacementGroup()
        - .toCreateTags()
        - .toDeleteTags()
        - .toModifyInstancePlacement()
        - .toRunInstances()
        - .toRunScheduledInstances()

        Applies to resource types:

        - placement-group

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifPlacementGroupStrategy", [value, operator]))

    @jsii.member(jsii_name="ifPresharedKeys")
    def if_preshared_keys(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the pre-shared key (PSK) used to establish the initial IKE security association between a virtual private gateway and a customer gateway.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-authentication-access-control.html

        Applies to actions:

        - .toCreateTags()
        - .toCreateVpnConnection()
        - .toCreateVpnConnectionRoute()
        - .toDeleteTags()
        - .toDeleteVpnConnection()
        - .toDeleteVpnConnectionRoute()
        - .toModifyVpnConnection()
        - .toModifyVpnConnectionOptions()
        - .toModifyVpnTunnelCertificate()
        - .toModifyVpnTunnelOptions()
        - .toTerminateClientVpnConnections()

        Applies to resource types:

        - vpn-connection

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifPresharedKeys", [value, operator]))

    @jsii.member(jsii_name="ifProductCode")
    def if_product_code(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the product code that is associated with the AMI.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifProductCode", [value, operator]))

    @jsii.member(jsii_name="ifPublic")
    def if_public(self, value: typing.Optional[builtins.bool] = None) -> "Ec2":
        '''(experimental) Filters access by whether the image has public launch permissions.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toCreateFleet()
        - .toCreateFpgaImage()
        - .toCreateImage()
        - .toCreateLaunchTemplate()
        - .toCreateLaunchTemplateVersion()
        - .toCreateTags()
        - .toDeleteFpgaImage()
        - .toDeleteTags()
        - .toDeregisterImage()
        - .toExportImage()
        - .toImportImage()
        - .toModifyFleet()
        - .toModifyFpgaImageAttribute()
        - .toModifyImageAttribute()
        - .toRequestSpotInstances()
        - .toResetFpgaImageAttribute()
        - .toResetImageAttribute()
        - .toRunInstances()
        - .toRunScheduledInstances()

        Applies to resource types:

        - fpga-image
        - image

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifPublic", [value]))

    @jsii.member(jsii_name="ifQuantity")
    def if_quantity(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the number of Dedicated Hosts in a request.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAllocateHosts()
        - .toCreateLaunchTemplate()
        - .toCreateLaunchTemplateVersion()
        - .toCreateTags()
        - .toDeleteTags()
        - .toGetHostReservationPurchasePreview()
        - .toModifyHosts()
        - .toModifyInstancePlacement()
        - .toPurchaseHostReservation()
        - .toReleaseHosts()

        Applies to resource types:

        - dedicated-host

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifQuantity", [value, operator]))

    @jsii.member(jsii_name="ifRegion")
    def if_region(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the name of the AWS Region.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAcceptReservedInstancesExchangeQuote()
        - .toAcceptTransitGatewayMulticastDomainAssociations()
        - .toAcceptTransitGatewayPeeringAttachment()
        - .toAcceptTransitGatewayVpcAttachment()
        - .toAcceptVpcEndpointConnections()
        - .toAcceptVpcPeeringConnection()
        - .toAllocateAddress()
        - .toAllocateHosts()
        - .toApplySecurityGroupsToClientVpnTargetNetwork()
        - .toAssignIpv6Addresses()
        - .toAssignPrivateIpAddresses()
        - .toAssociateAddress()
        - .toAssociateClientVpnTargetNetwork()
        - .toAssociateDhcpOptions()
        - .toAssociateIamInstanceProfile()
        - .toAssociateRouteTable()
        - .toAssociateSubnetCidrBlock()
        - .toAssociateTransitGatewayMulticastDomain()
        - .toAssociateTransitGatewayRouteTable()
        - .toAssociateVpcCidrBlock()
        - .toAttachClassicLinkVpc()
        - .toAttachInternetGateway()
        - .toAttachNetworkInterface()
        - .toAttachVolume()
        - .toAttachVpnGateway()
        - .toAuthorizeClientVpnIngress()
        - .toAuthorizeSecurityGroupEgress()
        - .toAuthorizeSecurityGroupIngress()
        - .toBundleInstance()
        - .toCancelCapacityReservation()
        - .toCancelExportTask()
        - .toCancelImportTask()
        - .toCancelSpotFleetRequests()
        - .toCancelSpotInstanceRequests()
        - .toConfirmProductInstance()
        - .toCopyFpgaImage()
        - .toCopyImage()
        - .toCopySnapshot()
        - .toCreateCapacityReservation()
        - .toCreateCarrierGateway()
        - .toCreateClientVpnEndpoint()
        - .toCreateClientVpnRoute()
        - .toCreateCustomerGateway()
        - .toCreateDhcpOptions()
        - .toCreateEgressOnlyInternetGateway()
        - .toCreateFleet()
        - .toCreateFlowLogs()
        - .toCreateFpgaImage()
        - .toCreateImage()
        - .toCreateInstanceExportTask()
        - .toCreateInternetGateway()
        - .toCreateKeyPair()
        - .toCreateLaunchTemplate()
        - .toCreateLaunchTemplateVersion()
        - .toCreateLocalGatewayRoute()
        - .toCreateLocalGatewayRouteTableVpcAssociation()
        - .toCreateManagedPrefixList()
        - .toCreateNatGateway()
        - .toCreateNetworkAcl()
        - .toCreateNetworkAclEntry()
        - .toCreateNetworkInsightsPath()
        - .toCreateNetworkInterface()
        - .toCreateNetworkInterfacePermission()
        - .toCreatePlacementGroup()
        - .toCreateReservedInstancesListing()
        - .toCreateRoute()
        - .toCreateRouteTable()
        - .toCreateSecurityGroup()
        - .toCreateSnapshot()
        - .toCreateSnapshots()
        - .toCreateSubnet()
        - .toCreateTags()
        - .toCreateTrafficMirrorFilter()
        - .toCreateTrafficMirrorFilterRule()
        - .toCreateTrafficMirrorSession()
        - .toCreateTrafficMirrorTarget()
        - .toCreateTransitGateway()
        - .toCreateTransitGatewayConnect()
        - .toCreateTransitGatewayConnectPeer()
        - .toCreateTransitGatewayMulticastDomain()
        - .toCreateTransitGatewayPeeringAttachment()
        - .toCreateTransitGatewayPrefixListReference()
        - .toCreateTransitGatewayRoute()
        - .toCreateTransitGatewayRouteTable()
        - .toCreateTransitGatewayVpcAttachment()
        - .toCreateVolume()
        - .toCreateVpc()
        - .toCreateVpcEndpoint()
        - .toCreateVpcEndpointConnectionNotification()
        - .toCreateVpcEndpointServiceConfiguration()
        - .toCreateVpcPeeringConnection()
        - .toCreateVpnConnection()
        - .toCreateVpnConnectionRoute()
        - .toCreateVpnGateway()
        - .toDeleteCarrierGateway()
        - .toDeleteClientVpnEndpoint()
        - .toDeleteClientVpnRoute()
        - .toDeleteCustomerGateway()
        - .toDeleteDhcpOptions()
        - .toDeleteEgressOnlyInternetGateway()
        - .toDeleteFleets()
        - .toDeleteFlowLogs()
        - .toDeleteFpgaImage()
        - .toDeleteInternetGateway()
        - .toDeleteKeyPair()
        - .toDeleteLaunchTemplate()
        - .toDeleteLaunchTemplateVersions()
        - .toDeleteLocalGatewayRoute()
        - .toDeleteLocalGatewayRouteTableVpcAssociation()
        - .toDeleteManagedPrefixList()
        - .toDeleteNatGateway()
        - .toDeleteNetworkAcl()
        - .toDeleteNetworkAclEntry()
        - .toDeleteNetworkInsightsAnalysis()
        - .toDeleteNetworkInsightsPath()
        - .toDeleteNetworkInterface()
        - .toDeleteQueuedReservedInstances()
        - .toDeleteRoute()
        - .toDeleteRouteTable()
        - .toDeleteSecurityGroup()
        - .toDeleteSnapshot()
        - .toDeleteSubnet()
        - .toDeleteTags()
        - .toDeleteTrafficMirrorFilter()
        - .toDeleteTrafficMirrorFilterRule()
        - .toDeleteTrafficMirrorSession()
        - .toDeleteTrafficMirrorTarget()
        - .toDeleteTransitGateway()
        - .toDeleteTransitGatewayConnect()
        - .toDeleteTransitGatewayConnectPeer()
        - .toDeleteTransitGatewayMulticastDomain()
        - .toDeleteTransitGatewayPeeringAttachment()
        - .toDeleteTransitGatewayPrefixListReference()
        - .toDeleteTransitGatewayRoute()
        - .toDeleteTransitGatewayRouteTable()
        - .toDeleteTransitGatewayVpcAttachment()
        - .toDeleteVolume()
        - .toDeleteVpc()
        - .toDeleteVpcEndpointConnectionNotifications()
        - .toDeleteVpcEndpointServiceConfigurations()
        - .toDeleteVpcEndpoints()
        - .toDeleteVpcPeeringConnection()
        - .toDeleteVpnConnection()
        - .toDeleteVpnConnectionRoute()
        - .toDeleteVpnGateway()
        - .toDeregisterImage()
        - .toDeregisterTransitGatewayMulticastGroupMembers()
        - .toDeregisterTransitGatewayMulticastGroupSources()
        - .toDetachClassicLinkVpc()
        - .toDetachInternetGateway()
        - .toDetachNetworkInterface()
        - .toDetachVolume()
        - .toDetachVpnGateway()
        - .toDisableFastSnapshotRestores()
        - .toDisableTransitGatewayRouteTablePropagation()
        - .toDisableVgwRoutePropagation()
        - .toDisableVpcClassicLink()
        - .toDisableVpcClassicLinkDnsSupport()
        - .toDisassociateAddress()
        - .toDisassociateClientVpnTargetNetwork()
        - .toDisassociateIamInstanceProfile()
        - .toDisassociateRouteTable()
        - .toDisassociateSubnetCidrBlock()
        - .toDisassociateTransitGatewayMulticastDomain()
        - .toDisassociateTransitGatewayRouteTable()
        - .toEnableFastSnapshotRestores()
        - .toEnableTransitGatewayRouteTablePropagation()
        - .toEnableVgwRoutePropagation()
        - .toEnableVolumeIO()
        - .toEnableVpcClassicLink()
        - .toEnableVpcClassicLinkDnsSupport()
        - .toExportClientVpnClientCertificateRevocationList()
        - .toExportClientVpnClientConfiguration()
        - .toExportImage()
        - .toExportTransitGatewayRoutes()
        - .toGetAssociatedIpv6PoolCidrs()
        - .toGetCapacityReservationUsage()
        - .toGetConsoleOutput()
        - .toGetConsoleScreenshot()
        - .toGetGroupsForCapacityReservation()
        - .toGetHostReservationPurchasePreview()
        - .toGetLaunchTemplateData()
        - .toGetManagedPrefixListAssociations()
        - .toGetManagedPrefixListEntries()
        - .toGetPasswordData()
        - .toGetReservedInstancesExchangeQuote()
        - .toGetTransitGatewayAttachmentPropagations()
        - .toGetTransitGatewayMulticastDomainAssociations()
        - .toGetTransitGatewayPrefixListReferences()
        - .toGetTransitGatewayRouteTableAssociations()
        - .toGetTransitGatewayRouteTablePropagations()
        - .toImportClientVpnClientCertificateRevocationList()
        - .toImportImage()
        - .toImportInstance()
        - .toImportKeyPair()
        - .toImportSnapshot()
        - .toModifyCapacityReservation()
        - .toModifyClientVpnEndpoint()
        - .toModifyFleet()
        - .toModifyFpgaImageAttribute()
        - .toModifyHosts()
        - .toModifyImageAttribute()
        - .toModifyInstanceAttribute()
        - .toModifyInstanceCapacityReservationAttributes()
        - .toModifyInstanceCreditSpecification()
        - .toModifyInstanceEventStartTime()
        - .toModifyInstanceMetadataOptions()
        - .toModifyInstancePlacement()
        - .toModifyLaunchTemplate()
        - .toModifyManagedPrefixList()
        - .toModifyNetworkInterfaceAttribute()
        - .toModifyReservedInstances()
        - .toModifySnapshotAttribute()
        - .toModifySpotFleetRequest()
        - .toModifySubnetAttribute()
        - .toModifyTrafficMirrorFilterNetworkServices()
        - .toModifyTrafficMirrorFilterRule()
        - .toModifyTrafficMirrorSession()
        - .toModifyTransitGateway()
        - .toModifyTransitGatewayPrefixListReference()
        - .toModifyTransitGatewayVpcAttachment()
        - .toModifyVolume()
        - .toModifyVolumeAttribute()
        - .toModifyVpcAttribute()
        - .toModifyVpcEndpoint()
        - .toModifyVpcEndpointConnectionNotification()
        - .toModifyVpcEndpointServiceConfiguration()
        - .toModifyVpcEndpointServicePermissions()
        - .toModifyVpcPeeringConnectionOptions()
        - .toModifyVpcTenancy()
        - .toModifyVpnConnection()
        - .toModifyVpnConnectionOptions()
        - .toModifyVpnTunnelCertificate()
        - .toModifyVpnTunnelOptions()
        - .toMonitorInstances()
        - .toPurchaseHostReservation()
        - .toPurchaseReservedInstancesOffering()
        - .toRebootInstances()
        - .toRegisterTransitGatewayMulticastGroupMembers()
        - .toRegisterTransitGatewayMulticastGroupSources()
        - .toRejectTransitGatewayMulticastDomainAssociations()
        - .toRejectTransitGatewayPeeringAttachment()
        - .toRejectTransitGatewayVpcAttachment()
        - .toRejectVpcEndpointConnections()
        - .toRejectVpcPeeringConnection()
        - .toReleaseAddress()
        - .toReleaseHosts()
        - .toReplaceIamInstanceProfileAssociation()
        - .toReplaceNetworkAclAssociation()
        - .toReplaceNetworkAclEntry()
        - .toReplaceRoute()
        - .toReplaceRouteTableAssociation()
        - .toReplaceTransitGatewayRoute()
        - .toReportInstanceStatus()
        - .toRequestSpotFleet()
        - .toRequestSpotInstances()
        - .toResetFpgaImageAttribute()
        - .toResetImageAttribute()
        - .toResetInstanceAttribute()
        - .toResetNetworkInterfaceAttribute()
        - .toResetSnapshotAttribute()
        - .toRestoreManagedPrefixListVersion()
        - .toRevokeClientVpnIngress()
        - .toRevokeSecurityGroupEgress()
        - .toRevokeSecurityGroupIngress()
        - .toRunInstances()
        - .toRunScheduledInstances()
        - .toSearchLocalGatewayRoutes()
        - .toSearchTransitGatewayMulticastGroups()
        - .toSearchTransitGatewayRoutes()
        - .toSendDiagnosticInterrupt()
        - .toStartInstances()
        - .toStartNetworkInsightsAnalysis()
        - .toStartVpcEndpointServicePrivateDnsVerification()
        - .toStopInstances()
        - .toTerminateClientVpnConnections()
        - .toTerminateInstances()
        - .toUnassignIpv6Addresses()
        - .toUnassignPrivateIpAddresses()
        - .toUnmonitorInstances()
        - .toUpdateSecurityGroupRuleDescriptionsEgress()
        - .toUpdateSecurityGroupRuleDescriptionsIngress()

        Applies to resource types:

        - elastic-ip
        - capacity-reservation
        - carrier-gateway
        - client-vpn-endpoint
        - customer-gateway
        - dedicated-host
        - dhcp-options
        - egress-only-internet-gateway
        - elastic-gpu
        - export-image-task
        - export-instance-task
        - fleet
        - fpga-image
        - host-reservation
        - image
        - import-image-task
        - import-snapshot-task
        - instance
        - internet-gateway
        - ipv4pool-ec2
        - ipv6pool-ec2
        - key-pair
        - launch-template
        - local-gateway
        - local-gateway-route-table-virtual-interface-group-association
        - local-gateway-route-table-vpc-association
        - local-gateway-route-table
        - local-gateway-virtual-interface-group
        - local-gateway-virtual-interface
        - natgateway
        - network-acl
        - network-insights-analysis
        - network-insights-path
        - network-interface
        - placement-group
        - prefix-list
        - reserved-instances
        - route-table
        - security-group
        - snapshot
        - spot-fleet-request
        - spot-instances-request
        - subnet
        - traffic-mirror-filter
        - traffic-mirror-filter-rule
        - traffic-mirror-session
        - traffic-mirror-target
        - transit-gateway-attachment
        - transit-gateway-connect-peer
        - transit-gateway
        - transit-gateway-multicast-domain
        - transit-gateway-route-table
        - volume
        - vpc-endpoint
        - vpc-endpoint-service
        - vpc-flow-log
        - vpc
        - vpc-peering-connection
        - vpn-connection
        - vpn-gateway

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifRegion", [value, operator]))

    @jsii.member(jsii_name="ifRekeyFuzzPercentage")
    def if_rekey_fuzz_percentage(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the percentage of increase of the rekey window (determined by the rekey margin time) within which the rekey time is randomly selected for a VPN tunnel.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-authentication-access-control.html

        Applies to actions:

        - .toCreateTags()
        - .toCreateVpnConnection()
        - .toCreateVpnConnectionRoute()
        - .toDeleteTags()
        - .toDeleteVpnConnection()
        - .toDeleteVpnConnectionRoute()
        - .toModifyVpnConnection()
        - .toModifyVpnConnectionOptions()
        - .toModifyVpnTunnelCertificate()
        - .toModifyVpnTunnelOptions()
        - .toTerminateClientVpnConnections()

        Applies to resource types:

        - vpn-connection

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifRekeyFuzzPercentage", [value, operator]))

    @jsii.member(jsii_name="ifRekeyMarginTimeSeconds")
    def if_rekey_margin_time_seconds(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the margin time before the phase 2 lifetime expires for a VPN tunnel.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-authentication-access-control.html

        Applies to actions:

        - .toCreateTags()
        - .toCreateVpnConnection()
        - .toCreateVpnConnectionRoute()
        - .toDeleteTags()
        - .toDeleteVpnConnection()
        - .toDeleteVpnConnectionRoute()
        - .toModifyVpnConnection()
        - .toModifyVpnConnectionOptions()
        - .toModifyVpnTunnelCertificate()
        - .toModifyVpnTunnelOptions()
        - .toTerminateClientVpnConnections()

        Applies to resource types:

        - vpn-connection

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifRekeyMarginTimeSeconds", [value, operator]))

    @jsii.member(jsii_name="ifRequesterVpc")
    def if_requester_vpc(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of a requester VPC in a VPC peering connection.

        https://docs.aws.amazon.com/vpc/latest/peering/security-iam.html

        Applies to actions:

        - .toAcceptVpcPeeringConnection()
        - .toCreateRoute()
        - .toCreateTags()
        - .toCreateVpcPeeringConnection()
        - .toDeleteTags()
        - .toDeleteVpcPeeringConnection()
        - .toModifyVpcPeeringConnectionOptions()
        - .toRejectVpcPeeringConnection()
        - .toReplaceRoute()

        Applies to resource types:

        - vpc-peering-connection

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifRequesterVpc", [value, operator]))

    @jsii.member(jsii_name="ifReservedInstancesOfferingType")
    def if_reserved_instances_offering_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the payment option of the Reserved Instance offering (No Upfront, Partial Upfront, or All Upfront).

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-reserved-instances.html#ri-payment-options

        Applies to actions:

        - .toAcceptReservedInstancesExchangeQuote()
        - .toCreateReservedInstancesListing()
        - .toCreateTags()
        - .toDeleteQueuedReservedInstances()
        - .toDeleteTags()
        - .toGetReservedInstancesExchangeQuote()
        - .toModifyReservedInstances()
        - .toPurchaseReservedInstancesOffering()

        Applies to resource types:

        - reserved-instances

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifReservedInstancesOfferingType", [value, operator]))

    @jsii.member(jsii_name="ifResourceTag")
    def if_resource_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by a tag key and value pair of a resource.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/control-access-with-tags.html

        Applies to actions:

        - .toAcceptReservedInstancesExchangeQuote()
        - .toAcceptTransitGatewayMulticastDomainAssociations()
        - .toAcceptTransitGatewayPeeringAttachment()
        - .toAcceptTransitGatewayVpcAttachment()
        - .toAcceptVpcEndpointConnections()
        - .toAcceptVpcPeeringConnection()
        - .toAllocateAddress()
        - .toAllocateHosts()
        - .toApplySecurityGroupsToClientVpnTargetNetwork()
        - .toAssignIpv6Addresses()
        - .toAssignPrivateIpAddresses()
        - .toAssociateAddress()
        - .toAssociateClientVpnTargetNetwork()
        - .toAssociateDhcpOptions()
        - .toAssociateIamInstanceProfile()
        - .toAssociateRouteTable()
        - .toAssociateSubnetCidrBlock()
        - .toAssociateTransitGatewayMulticastDomain()
        - .toAssociateTransitGatewayRouteTable()
        - .toAssociateVpcCidrBlock()
        - .toAttachClassicLinkVpc()
        - .toAttachInternetGateway()
        - .toAttachNetworkInterface()
        - .toAttachVolume()
        - .toAttachVpnGateway()
        - .toAuthorizeClientVpnIngress()
        - .toAuthorizeSecurityGroupEgress()
        - .toAuthorizeSecurityGroupIngress()
        - .toBundleInstance()
        - .toCancelCapacityReservation()
        - .toCancelExportTask()
        - .toCancelImportTask()
        - .toCancelSpotFleetRequests()
        - .toCancelSpotInstanceRequests()
        - .toConfirmProductInstance()
        - .toCreateCapacityReservation()
        - .toCreateCarrierGateway()
        - .toCreateClientVpnEndpoint()
        - .toCreateClientVpnRoute()
        - .toCreateCustomerGateway()
        - .toCreateDhcpOptions()
        - .toCreateEgressOnlyInternetGateway()
        - .toCreateFleet()
        - .toCreateFlowLogs()
        - .toCreateFpgaImage()
        - .toCreateImage()
        - .toCreateInstanceExportTask()
        - .toCreateInternetGateway()
        - .toCreateKeyPair()
        - .toCreateLaunchTemplate()
        - .toCreateLaunchTemplateVersion()
        - .toCreateLocalGatewayRoute()
        - .toCreateLocalGatewayRouteTableVpcAssociation()
        - .toCreateManagedPrefixList()
        - .toCreateNatGateway()
        - .toCreateNetworkAcl()
        - .toCreateNetworkAclEntry()
        - .toCreateNetworkInsightsPath()
        - .toCreateNetworkInterface()
        - .toCreateNetworkInterfacePermission()
        - .toCreatePlacementGroup()
        - .toCreateReservedInstancesListing()
        - .toCreateRoute()
        - .toCreateRouteTable()
        - .toCreateSecurityGroup()
        - .toCreateSnapshot()
        - .toCreateSnapshots()
        - .toCreateSubnet()
        - .toCreateTags()
        - .toCreateTrafficMirrorFilter()
        - .toCreateTrafficMirrorFilterRule()
        - .toCreateTrafficMirrorSession()
        - .toCreateTrafficMirrorTarget()
        - .toCreateTransitGateway()
        - .toCreateTransitGatewayConnect()
        - .toCreateTransitGatewayConnectPeer()
        - .toCreateTransitGatewayMulticastDomain()
        - .toCreateTransitGatewayPeeringAttachment()
        - .toCreateTransitGatewayPrefixListReference()
        - .toCreateTransitGatewayRoute()
        - .toCreateTransitGatewayRouteTable()
        - .toCreateTransitGatewayVpcAttachment()
        - .toCreateVolume()
        - .toCreateVpc()
        - .toCreateVpcEndpoint()
        - .toCreateVpcEndpointConnectionNotification()
        - .toCreateVpcEndpointServiceConfiguration()
        - .toCreateVpcPeeringConnection()
        - .toCreateVpnConnection()
        - .toCreateVpnConnectionRoute()
        - .toCreateVpnGateway()
        - .toDeleteCarrierGateway()
        - .toDeleteClientVpnEndpoint()
        - .toDeleteClientVpnRoute()
        - .toDeleteCustomerGateway()
        - .toDeleteDhcpOptions()
        - .toDeleteEgressOnlyInternetGateway()
        - .toDeleteFleets()
        - .toDeleteFlowLogs()
        - .toDeleteFpgaImage()
        - .toDeleteInternetGateway()
        - .toDeleteKeyPair()
        - .toDeleteLaunchTemplate()
        - .toDeleteLaunchTemplateVersions()
        - .toDeleteLocalGatewayRoute()
        - .toDeleteLocalGatewayRouteTableVpcAssociation()
        - .toDeleteManagedPrefixList()
        - .toDeleteNatGateway()
        - .toDeleteNetworkAcl()
        - .toDeleteNetworkAclEntry()
        - .toDeleteNetworkInsightsAnalysis()
        - .toDeleteNetworkInsightsPath()
        - .toDeleteNetworkInterface()
        - .toDeleteQueuedReservedInstances()
        - .toDeleteRoute()
        - .toDeleteRouteTable()
        - .toDeleteSecurityGroup()
        - .toDeleteSnapshot()
        - .toDeleteSubnet()
        - .toDeleteTags()
        - .toDeleteTrafficMirrorFilter()
        - .toDeleteTrafficMirrorSession()
        - .toDeleteTrafficMirrorTarget()
        - .toDeleteTransitGateway()
        - .toDeleteTransitGatewayConnect()
        - .toDeleteTransitGatewayConnectPeer()
        - .toDeleteTransitGatewayMulticastDomain()
        - .toDeleteTransitGatewayPeeringAttachment()
        - .toDeleteTransitGatewayPrefixListReference()
        - .toDeleteTransitGatewayRoute()
        - .toDeleteTransitGatewayRouteTable()
        - .toDeleteTransitGatewayVpcAttachment()
        - .toDeleteVolume()
        - .toDeleteVpc()
        - .toDeleteVpcEndpointConnectionNotifications()
        - .toDeleteVpcEndpointServiceConfigurations()
        - .toDeleteVpcEndpoints()
        - .toDeleteVpcPeeringConnection()
        - .toDeleteVpnConnection()
        - .toDeleteVpnConnectionRoute()
        - .toDeleteVpnGateway()
        - .toDeregisterImage()
        - .toDeregisterTransitGatewayMulticastGroupMembers()
        - .toDeregisterTransitGatewayMulticastGroupSources()
        - .toDetachClassicLinkVpc()
        - .toDetachInternetGateway()
        - .toDetachNetworkInterface()
        - .toDetachVolume()
        - .toDetachVpnGateway()
        - .toDisableFastSnapshotRestores()
        - .toDisableTransitGatewayRouteTablePropagation()
        - .toDisableVgwRoutePropagation()
        - .toDisableVpcClassicLink()
        - .toDisableVpcClassicLinkDnsSupport()
        - .toDisassociateAddress()
        - .toDisassociateClientVpnTargetNetwork()
        - .toDisassociateIamInstanceProfile()
        - .toDisassociateRouteTable()
        - .toDisassociateSubnetCidrBlock()
        - .toDisassociateTransitGatewayMulticastDomain()
        - .toDisassociateTransitGatewayRouteTable()
        - .toEnableFastSnapshotRestores()
        - .toEnableTransitGatewayRouteTablePropagation()
        - .toEnableVgwRoutePropagation()
        - .toEnableVolumeIO()
        - .toEnableVpcClassicLink()
        - .toEnableVpcClassicLinkDnsSupport()
        - .toExportClientVpnClientCertificateRevocationList()
        - .toExportClientVpnClientConfiguration()
        - .toExportImage()
        - .toExportTransitGatewayRoutes()
        - .toGetAssociatedIpv6PoolCidrs()
        - .toGetCapacityReservationUsage()
        - .toGetConsoleOutput()
        - .toGetConsoleScreenshot()
        - .toGetGroupsForCapacityReservation()
        - .toGetHostReservationPurchasePreview()
        - .toGetLaunchTemplateData()
        - .toGetManagedPrefixListAssociations()
        - .toGetManagedPrefixListEntries()
        - .toGetPasswordData()
        - .toGetReservedInstancesExchangeQuote()
        - .toGetTransitGatewayAttachmentPropagations()
        - .toGetTransitGatewayMulticastDomainAssociations()
        - .toGetTransitGatewayPrefixListReferences()
        - .toGetTransitGatewayRouteTableAssociations()
        - .toGetTransitGatewayRouteTablePropagations()
        - .toImportClientVpnClientCertificateRevocationList()
        - .toImportImage()
        - .toImportInstance()
        - .toImportKeyPair()
        - .toImportSnapshot()
        - .toModifyCapacityReservation()
        - .toModifyClientVpnEndpoint()
        - .toModifyFleet()
        - .toModifyFpgaImageAttribute()
        - .toModifyHosts()
        - .toModifyImageAttribute()
        - .toModifyInstanceAttribute()
        - .toModifyInstanceCapacityReservationAttributes()
        - .toModifyInstanceCreditSpecification()
        - .toModifyInstanceEventStartTime()
        - .toModifyInstanceMetadataOptions()
        - .toModifyInstancePlacement()
        - .toModifyLaunchTemplate()
        - .toModifyManagedPrefixList()
        - .toModifyNetworkInterfaceAttribute()
        - .toModifyReservedInstances()
        - .toModifySnapshotAttribute()
        - .toModifySpotFleetRequest()
        - .toModifySubnetAttribute()
        - .toModifyTrafficMirrorFilterNetworkServices()
        - .toModifyTrafficMirrorFilterRule()
        - .toModifyTrafficMirrorSession()
        - .toModifyTransitGateway()
        - .toModifyTransitGatewayPrefixListReference()
        - .toModifyTransitGatewayVpcAttachment()
        - .toModifyVolume()
        - .toModifyVolumeAttribute()
        - .toModifyVpcAttribute()
        - .toModifyVpcEndpoint()
        - .toModifyVpcEndpointConnectionNotification()
        - .toModifyVpcEndpointServiceConfiguration()
        - .toModifyVpcEndpointServicePermissions()
        - .toModifyVpcPeeringConnectionOptions()
        - .toModifyVpcTenancy()
        - .toModifyVpnConnection()
        - .toModifyVpnConnectionOptions()
        - .toModifyVpnTunnelCertificate()
        - .toModifyVpnTunnelOptions()
        - .toMonitorInstances()
        - .toPurchaseHostReservation()
        - .toPurchaseReservedInstancesOffering()
        - .toRebootInstances()
        - .toRegisterTransitGatewayMulticastGroupMembers()
        - .toRegisterTransitGatewayMulticastGroupSources()
        - .toRejectTransitGatewayMulticastDomainAssociations()
        - .toRejectTransitGatewayPeeringAttachment()
        - .toRejectTransitGatewayVpcAttachment()
        - .toRejectVpcEndpointConnections()
        - .toRejectVpcPeeringConnection()
        - .toReleaseAddress()
        - .toReleaseHosts()
        - .toReplaceIamInstanceProfileAssociation()
        - .toReplaceNetworkAclAssociation()
        - .toReplaceNetworkAclEntry()
        - .toReplaceRoute()
        - .toReplaceRouteTableAssociation()
        - .toReplaceTransitGatewayRoute()
        - .toReportInstanceStatus()
        - .toRequestSpotFleet()
        - .toRequestSpotInstances()
        - .toResetFpgaImageAttribute()
        - .toResetImageAttribute()
        - .toResetInstanceAttribute()
        - .toResetNetworkInterfaceAttribute()
        - .toResetSnapshotAttribute()
        - .toRestoreManagedPrefixListVersion()
        - .toRevokeClientVpnIngress()
        - .toRevokeSecurityGroupEgress()
        - .toRevokeSecurityGroupIngress()
        - .toRunInstances()
        - .toRunScheduledInstances()
        - .toSearchLocalGatewayRoutes()
        - .toSearchTransitGatewayMulticastGroups()
        - .toSearchTransitGatewayRoutes()
        - .toSendDiagnosticInterrupt()
        - .toStartInstances()
        - .toStartNetworkInsightsAnalysis()
        - .toStartVpcEndpointServicePrivateDnsVerification()
        - .toStopInstances()
        - .toTerminateClientVpnConnections()
        - .toTerminateInstances()
        - .toUnassignIpv6Addresses()
        - .toUnassignPrivateIpAddresses()
        - .toUnmonitorInstances()
        - .toUpdateSecurityGroupRuleDescriptionsEgress()
        - .toUpdateSecurityGroupRuleDescriptionsIngress()

        Applies to resource types:

        - elastic-ip
        - capacity-reservation
        - carrier-gateway
        - client-vpn-endpoint
        - customer-gateway
        - dedicated-host
        - dhcp-options
        - egress-only-internet-gateway
        - elastic-gpu
        - export-image-task
        - export-instance-task
        - fleet
        - fpga-image
        - host-reservation
        - image
        - import-image-task
        - import-snapshot-task
        - instance
        - internet-gateway
        - ipv4pool-ec2
        - ipv6pool-ec2
        - key-pair
        - launch-template
        - local-gateway
        - local-gateway-route-table-virtual-interface-group-association
        - local-gateway-route-table-vpc-association
        - local-gateway-route-table
        - local-gateway-virtual-interface-group
        - local-gateway-virtual-interface
        - natgateway
        - network-acl
        - network-insights-analysis
        - network-insights-path
        - network-interface
        - placement-group
        - prefix-list
        - reserved-instances
        - route-table
        - security-group
        - snapshot
        - spot-fleet-request
        - spot-instances-request
        - subnet
        - traffic-mirror-filter
        - traffic-mirror-session
        - traffic-mirror-target
        - transit-gateway-attachment
        - transit-gateway-connect-peer
        - transit-gateway
        - transit-gateway-multicast-domain
        - transit-gateway-route-table
        - volume
        - vpc-endpoint
        - vpc-endpoint-service
        - vpc-flow-log
        - vpc
        - vpc-peering-connection
        - vpn-connection
        - vpn-gateway

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifResourceTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifResourceTagExists")
    def if_resource_tag_exists(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the preface string for a tag key and value pair that are attached to a resource.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/control-access-with-tags.html

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifResourceTagExists", [value, operator]))

    @jsii.member(jsii_name="ifRoleDelivery")
    def if_role_delivery(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the version of the instance metadata service for retrieving IAM role credentials for EC2.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifRoleDelivery", [value, operator]))

    @jsii.member(jsii_name="ifRootDeviceType")
    def if_root_device_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the root device type of the instance (ebs or instance-store).

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAssociateAddress()
        - .toAssociateIamInstanceProfile()
        - .toAttachClassicLinkVpc()
        - .toAttachNetworkInterface()
        - .toAttachVolume()
        - .toBundleInstance()
        - .toConfirmProductInstance()
        - .toCreateFleet()
        - .toCreateImage()
        - .toCreateInstanceExportTask()
        - .toCreateLaunchTemplate()
        - .toCreateLaunchTemplateVersion()
        - .toCreateRoute()
        - .toCreateSnapshots()
        - .toCreateTags()
        - .toDeleteTags()
        - .toDeregisterImage()
        - .toDetachClassicLinkVpc()
        - .toDetachNetworkInterface()
        - .toDetachVolume()
        - .toDisassociateAddress()
        - .toDisassociateIamInstanceProfile()
        - .toExportImage()
        - .toGetConsoleOutput()
        - .toGetConsoleScreenshot()
        - .toGetLaunchTemplateData()
        - .toGetPasswordData()
        - .toImportImage()
        - .toModifyFleet()
        - .toModifyImageAttribute()
        - .toModifyInstanceAttribute()
        - .toModifyInstanceCapacityReservationAttributes()
        - .toModifyInstanceCreditSpecification()
        - .toModifyInstanceEventStartTime()
        - .toModifyInstanceMetadataOptions()
        - .toModifyInstancePlacement()
        - .toModifyNetworkInterfaceAttribute()
        - .toMonitorInstances()
        - .toRebootInstances()
        - .toReplaceIamInstanceProfileAssociation()
        - .toReplaceRoute()
        - .toReportInstanceStatus()
        - .toRequestSpotInstances()
        - .toResetImageAttribute()
        - .toResetInstanceAttribute()
        - .toRunInstances()
        - .toRunScheduledInstances()
        - .toSendDiagnosticInterrupt()
        - .toStartInstances()
        - .toStopInstances()
        - .toTerminateInstances()
        - .toUnmonitorInstances()

        Applies to resource types:

        - image
        - instance

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifRootDeviceType", [value, operator]))

    @jsii.member(jsii_name="ifRoutingType")
    def if_routing_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the routing type for the VPN connection.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-authentication-access-control.html

        Applies to actions:

        - .toCreateTags()
        - .toCreateVpnConnection()
        - .toCreateVpnConnectionRoute()
        - .toDeleteTags()
        - .toDeleteVpnConnection()
        - .toDeleteVpnConnectionRoute()
        - .toModifyVpnConnection()
        - .toModifyVpnConnectionOptions()
        - .toModifyVpnTunnelCertificate()
        - .toModifyVpnTunnelOptions()
        - .toTerminateClientVpnConnections()

        Applies to resource types:

        - vpn-connection

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifRoutingType", [value, operator]))

    @jsii.member(jsii_name="ifSamlProviderArn")
    def if_saml_provider_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of the IAM SAML identity provider.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toApplySecurityGroupsToClientVpnTargetNetwork()
        - .toAssociateClientVpnTargetNetwork()
        - .toAuthorizeClientVpnIngress()
        - .toCreateClientVpnEndpoint()
        - .toCreateClientVpnRoute()
        - .toCreateTags()
        - .toDeleteClientVpnEndpoint()
        - .toDeleteClientVpnRoute()
        - .toDeleteTags()
        - .toDisassociateClientVpnTargetNetwork()
        - .toExportClientVpnClientCertificateRevocationList()
        - .toExportClientVpnClientConfiguration()
        - .toImportClientVpnClientCertificateRevocationList()
        - .toModifyClientVpnEndpoint()
        - .toRevokeClientVpnIngress()
        - .toTerminateClientVpnConnections()

        Applies to resource types:

        - client-vpn-endpoint

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifSamlProviderArn", [value, operator]))

    @jsii.member(jsii_name="ifServerCertificateArn")
    def if_server_certificate_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of the server certificate.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toApplySecurityGroupsToClientVpnTargetNetwork()
        - .toAssociateClientVpnTargetNetwork()
        - .toAuthorizeClientVpnIngress()
        - .toCreateClientVpnEndpoint()
        - .toCreateClientVpnRoute()
        - .toCreateTags()
        - .toDeleteClientVpnEndpoint()
        - .toDeleteClientVpnRoute()
        - .toDeleteTags()
        - .toDisassociateClientVpnTargetNetwork()
        - .toExportClientVpnClientCertificateRevocationList()
        - .toExportClientVpnClientConfiguration()
        - .toImportClientVpnClientCertificateRevocationList()
        - .toModifyClientVpnEndpoint()
        - .toRevokeClientVpnIngress()
        - .toTerminateClientVpnConnections()

        Applies to resource types:

        - client-vpn-endpoint

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifServerCertificateArn", [value, operator]))

    @jsii.member(jsii_name="ifSnapshotTime")
    def if_snapshot_time(
        self,
        value: typing.Union[builtins.str, datetime.datetime, typing.Sequence[typing.Union[builtins.str, datetime.datetime]]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the initiation time of a snapshot.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toCreateFleet()
        - .toCreateLaunchTemplate()
        - .toCreateLaunchTemplateVersion()
        - .toCreateSnapshot()
        - .toCreateSnapshots()
        - .toCreateTags()
        - .toCreateVolume()
        - .toDeleteSnapshot()
        - .toDeleteTags()
        - .toDisableFastSnapshotRestores()
        - .toEnableFastSnapshotRestores()
        - .toImportImage()
        - .toImportSnapshot()
        - .toModifyFleet()
        - .toModifySnapshotAttribute()
        - .toResetSnapshotAttribute()
        - .toRunInstances()
        - .toRunScheduledInstances()

        Applies to resource types:

        - snapshot

        :param value: The value(s) to check.
        :param operator: Works with `date operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Date>`_. **Default:** ``DateEquals``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifSnapshotTime", [value, operator]))

    @jsii.member(jsii_name="ifSourceInstanceARN")
    def if_source_instance_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of the instance from which the request originated.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifSourceInstanceARN", [value, operator]))

    @jsii.member(jsii_name="ifSourceOutpostArn")
    def if_source_outpost_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of the Outpost from which the request originated.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toCopySnapshot()
        - .toCreateSnapshot()
        - .toCreateSnapshots()
        - .toDeleteSnapshot()
        - .toModifySnapshotAttribute()

        Applies to resource types:

        - snapshot

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifSourceOutpostArn", [value, operator]))

    @jsii.member(jsii_name="ifSubnet")
    def if_subnet(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of the subnet.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAssignIpv6Addresses()
        - .toAssignPrivateIpAddresses()
        - .toAssociateAddress()
        - .toAttachNetworkInterface()
        - .toCreateFleet()
        - .toCreateFlowLogs()
        - .toCreateLaunchTemplate()
        - .toCreateLaunchTemplateVersion()
        - .toCreateNetworkInterface()
        - .toCreateNetworkInterfacePermission()
        - .toCreateRoute()
        - .toCreateTags()
        - .toCreateTrafficMirrorSession()
        - .toCreateTrafficMirrorTarget()
        - .toDeleteNetworkInterface()
        - .toDeleteTags()
        - .toDeregisterTransitGatewayMulticastGroupMembers()
        - .toDeregisterTransitGatewayMulticastGroupSources()
        - .toDetachNetworkInterface()
        - .toDisassociateAddress()
        - .toModifyFleet()
        - .toModifyNetworkInterfaceAttribute()
        - .toRegisterTransitGatewayMulticastGroupMembers()
        - .toRegisterTransitGatewayMulticastGroupSources()
        - .toReplaceRoute()
        - .toResetNetworkInterfaceAttribute()
        - .toRunInstances()
        - .toRunScheduledInstances()
        - .toUnassignIpv6Addresses()
        - .toUnassignPrivateIpAddresses()

        Applies to resource types:

        - network-interface

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifSubnet", [value, operator]))

    @jsii.member(jsii_name="ifTenancy")
    def if_tenancy(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the tenancy of the VPC or instance (default, dedicated, or host).

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAcceptReservedInstancesExchangeQuote()
        - .toAcceptVpcPeeringConnection()
        - .toApplySecurityGroupsToClientVpnTargetNetwork()
        - .toAssociateAddress()
        - .toAssociateDhcpOptions()
        - .toAssociateIamInstanceProfile()
        - .toAssociateVpcCidrBlock()
        - .toAttachClassicLinkVpc()
        - .toAttachInternetGateway()
        - .toAttachNetworkInterface()
        - .toAttachVolume()
        - .toAttachVpnGateway()
        - .toBundleInstance()
        - .toConfirmProductInstance()
        - .toCreateCarrierGateway()
        - .toCreateClientVpnEndpoint()
        - .toCreateEgressOnlyInternetGateway()
        - .toCreateFlowLogs()
        - .toCreateImage()
        - .toCreateInstanceExportTask()
        - .toCreateLocalGatewayRouteTableVpcAssociation()
        - .toCreateNetworkAcl()
        - .toCreateReservedInstancesListing()
        - .toCreateRoute()
        - .toCreateRouteTable()
        - .toCreateSecurityGroup()
        - .toCreateSnapshots()
        - .toCreateSubnet()
        - .toCreateTags()
        - .toCreateTransitGatewayVpcAttachment()
        - .toCreateVpc()
        - .toCreateVpcEndpoint()
        - .toCreateVpcPeeringConnection()
        - .toDeleteCarrierGateway()
        - .toDeleteLocalGatewayRouteTableVpcAssociation()
        - .toDeleteQueuedReservedInstances()
        - .toDeleteTags()
        - .toDeleteVpc()
        - .toDetachClassicLinkVpc()
        - .toDetachInternetGateway()
        - .toDetachNetworkInterface()
        - .toDetachVolume()
        - .toDetachVpnGateway()
        - .toDisableVpcClassicLink()
        - .toDisableVpcClassicLinkDnsSupport()
        - .toDisassociateAddress()
        - .toDisassociateIamInstanceProfile()
        - .toEnableVpcClassicLink()
        - .toEnableVpcClassicLinkDnsSupport()
        - .toGetConsoleOutput()
        - .toGetConsoleScreenshot()
        - .toGetLaunchTemplateData()
        - .toGetPasswordData()
        - .toGetReservedInstancesExchangeQuote()
        - .toModifyClientVpnEndpoint()
        - .toModifyInstanceAttribute()
        - .toModifyInstanceCapacityReservationAttributes()
        - .toModifyInstanceCreditSpecification()
        - .toModifyInstanceEventStartTime()
        - .toModifyInstanceMetadataOptions()
        - .toModifyInstancePlacement()
        - .toModifyNetworkInterfaceAttribute()
        - .toModifyReservedInstances()
        - .toModifyVpcAttribute()
        - .toModifyVpcTenancy()
        - .toMonitorInstances()
        - .toPurchaseReservedInstancesOffering()
        - .toRebootInstances()
        - .toReplaceIamInstanceProfileAssociation()
        - .toReplaceRoute()
        - .toReportInstanceStatus()
        - .toResetInstanceAttribute()
        - .toRunInstances()
        - .toSendDiagnosticInterrupt()
        - .toStartInstances()
        - .toStopInstances()
        - .toTerminateInstances()
        - .toUnmonitorInstances()

        Applies to resource types:

        - carrier-gateway
        - instance
        - local-gateway-route-table-vpc-association
        - reserved-instances
        - vpc

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifTenancy", [value, operator]))

    @jsii.member(jsii_name="ifVolumeIops")
    def if_volume_iops(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the the number of input/output operations per second (IOPS) provisioned for the volume.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAttachVolume()
        - .toCreateSnapshot()
        - .toCreateSnapshots()
        - .toCreateTags()
        - .toCreateVolume()
        - .toDeleteTags()
        - .toDeleteVolume()
        - .toDetachVolume()
        - .toEnableVolumeIO()
        - .toModifyInstanceAttribute()
        - .toModifyVolume()
        - .toModifyVolumeAttribute()
        - .toRunInstances()

        Applies to resource types:

        - volume

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifVolumeIops", [value, operator]))

    @jsii.member(jsii_name="ifVolumeSize")
    def if_volume_size(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the size of the volume, in GiB.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAttachVolume()
        - .toCreateFleet()
        - .toCreateLaunchTemplate()
        - .toCreateLaunchTemplateVersion()
        - .toCreateSnapshot()
        - .toCreateSnapshots()
        - .toCreateTags()
        - .toCreateVolume()
        - .toDeleteSnapshot()
        - .toDeleteTags()
        - .toDeleteVolume()
        - .toDetachVolume()
        - .toDisableFastSnapshotRestores()
        - .toEnableFastSnapshotRestores()
        - .toEnableVolumeIO()
        - .toImportImage()
        - .toImportSnapshot()
        - .toModifyFleet()
        - .toModifyInstanceAttribute()
        - .toModifySnapshotAttribute()
        - .toModifyVolume()
        - .toModifyVolumeAttribute()
        - .toResetSnapshotAttribute()
        - .toRunInstances()
        - .toRunScheduledInstances()

        Applies to resource types:

        - snapshot
        - volume

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifVolumeSize", [value, operator]))

    @jsii.member(jsii_name="ifVolumeThroughput")
    def if_volume_throughput(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the throughput of the volume, in MiBps.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAttachVolume()
        - .toCreateSnapshot()
        - .toCreateSnapshots()
        - .toCreateTags()
        - .toCreateVolume()
        - .toDeleteTags()
        - .toDeleteVolume()
        - .toDetachVolume()
        - .toEnableVolumeIO()
        - .toModifyInstanceAttribute()
        - .toModifyVolume()
        - .toModifyVolumeAttribute()
        - .toRunInstances()

        Applies to resource types:

        - volume

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifVolumeThroughput", [value, operator]))

    @jsii.member(jsii_name="ifVolumeType")
    def if_volume_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the type of volume (gp2, gp3, io1, io2, st1, sc1, or standard).

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAttachVolume()
        - .toCreateSnapshot()
        - .toCreateSnapshots()
        - .toCreateTags()
        - .toCreateVolume()
        - .toDeleteTags()
        - .toDeleteVolume()
        - .toDetachVolume()
        - .toEnableVolumeIO()
        - .toModifyInstanceAttribute()
        - .toModifyVolume()
        - .toModifyVolumeAttribute()
        - .toRunInstances()

        Applies to resource types:

        - volume

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifVolumeType", [value, operator]))

    @jsii.member(jsii_name="ifVpc")
    def if_vpc(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of the VPC.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAcceptTransitGatewayMulticastDomainAssociations()
        - .toApplySecurityGroupsToClientVpnTargetNetwork()
        - .toAssignIpv6Addresses()
        - .toAssignPrivateIpAddresses()
        - .toAssociateAddress()
        - .toAssociateClientVpnTargetNetwork()
        - .toAssociateRouteTable()
        - .toAssociateSubnetCidrBlock()
        - .toAssociateTransitGatewayMulticastDomain()
        - .toAttachClassicLinkVpc()
        - .toAttachNetworkInterface()
        - .toAuthorizeSecurityGroupEgress()
        - .toAuthorizeSecurityGroupIngress()
        - .toCreateCarrierGateway()
        - .toCreateClientVpnEndpoint()
        - .toCreateClientVpnRoute()
        - .toCreateFleet()
        - .toCreateFlowLogs()
        - .toCreateLaunchTemplate()
        - .toCreateLaunchTemplateVersion()
        - .toCreateNatGateway()
        - .toCreateNetworkAcl()
        - .toCreateNetworkAclEntry()
        - .toCreateNetworkInterface()
        - .toCreateNetworkInterfacePermission()
        - .toCreateRoute()
        - .toCreateRouteTable()
        - .toCreateSecurityGroup()
        - .toCreateSubnet()
        - .toCreateTags()
        - .toCreateTrafficMirrorSession()
        - .toCreateTrafficMirrorTarget()
        - .toCreateTransitGatewayVpcAttachment()
        - .toCreateVpcEndpoint()
        - .toDeleteCarrierGateway()
        - .toDeleteClientVpnRoute()
        - .toDeleteNetworkAcl()
        - .toDeleteNetworkAclEntry()
        - .toDeleteNetworkInterface()
        - .toDeleteRoute()
        - .toDeleteRouteTable()
        - .toDeleteSecurityGroup()
        - .toDeleteSubnet()
        - .toDeleteTags()
        - .toDeregisterTransitGatewayMulticastGroupMembers()
        - .toDeregisterTransitGatewayMulticastGroupSources()
        - .toDetachNetworkInterface()
        - .toDisableVgwRoutePropagation()
        - .toDisassociateAddress()
        - .toDisassociateRouteTable()
        - .toDisassociateSubnetCidrBlock()
        - .toDisassociateTransitGatewayMulticastDomain()
        - .toEnableVgwRoutePropagation()
        - .toImportInstance()
        - .toModifyClientVpnEndpoint()
        - .toModifyFleet()
        - .toModifyInstanceAttribute()
        - .toModifyNetworkInterfaceAttribute()
        - .toModifySubnetAttribute()
        - .toModifyTransitGatewayVpcAttachment()
        - .toModifyVpcEndpoint()
        - .toRegisterTransitGatewayMulticastGroupMembers()
        - .toRegisterTransitGatewayMulticastGroupSources()
        - .toRejectTransitGatewayMulticastDomainAssociations()
        - .toReplaceNetworkAclAssociation()
        - .toReplaceNetworkAclEntry()
        - .toReplaceRoute()
        - .toReplaceRouteTableAssociation()
        - .toRequestSpotFleet()
        - .toRequestSpotInstances()
        - .toResetNetworkInterfaceAttribute()
        - .toRevokeSecurityGroupEgress()
        - .toRevokeSecurityGroupIngress()
        - .toRunInstances()
        - .toRunScheduledInstances()
        - .toStartNetworkInsightsAnalysis()
        - .toUnassignIpv6Addresses()
        - .toUnassignPrivateIpAddresses()
        - .toUpdateSecurityGroupRuleDescriptionsEgress()
        - .toUpdateSecurityGroupRuleDescriptionsIngress()

        Applies to resource types:

        - carrier-gateway
        - network-acl
        - network-interface
        - route-table
        - security-group
        - subnet

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifVpc", [value, operator]))

    @jsii.member(jsii_name="ifVpceServiceName")
    def if_vpce_service_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the name of the VPC endpoint service.

        https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints-iam.html

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifVpceServiceName", [value, operator]))

    @jsii.member(jsii_name="ifVpceServiceOwner")
    def if_vpce_service_owner(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the service owner of the VPC endpoint service (amazon, aws-marketplace, or an AWS account ID).

        https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints-iam.html

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifVpceServiceOwner", [value, operator]))

    @jsii.member(jsii_name="ifVpceServicePrivateDnsName")
    def if_vpce_service_private_dns_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the private DNS name of the VPC endpoint service.

        https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints-iam.html

        Applies to actions:

        - .toAcceptVpcEndpointConnections()
        - .toCreateTags()
        - .toCreateVpcEndpointConnectionNotification()
        - .toCreateVpcEndpointServiceConfiguration()
        - .toDeleteTags()
        - .toDeleteVpcEndpointConnectionNotifications()
        - .toDeleteVpcEndpointServiceConfigurations()
        - .toModifyVpcEndpointConnectionNotification()
        - .toModifyVpcEndpointServiceConfiguration()
        - .toModifyVpcEndpointServicePermissions()
        - .toRejectVpcEndpointConnections()
        - .toStartVpcEndpointServicePrivateDnsVerification()

        Applies to resource types:

        - vpc-endpoint-service

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "ifVpceServicePrivateDnsName", [value, operator]))

    @jsii.member(jsii_name="onCapacityReservation")
    def on_capacity_reservation(
        self,
        capacity_reservation_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type capacity-reservation to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-capacity-reservations.html

        :param capacity_reservation_id: - Identifier for the capacityReservationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onCapacityReservation", [capacity_reservation_id, account, region, partition]))

    @jsii.member(jsii_name="onCarrierGateway")
    def on_carrier_gateway(
        self,
        carrier_gateway_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type carrier-gateway to the statement.

        https://docs.aws.amazon.com/vpc/latest/userguide/Carrier_Gateway.html

        :param carrier_gateway_id: - Identifier for the carrierGatewayId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag() - .ifTenancy() - .ifVpc()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onCarrierGateway", [carrier_gateway_id, account, region, partition]))

    @jsii.member(jsii_name="onCertificate")
    def on_certificate(
        self,
        certificate_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type certificate to the statement.

        https://docs.aws.amazon.com/acm/latest/userguide/authen-overview.html#acm-resources-operations

        :param certificate_id: - Identifier for the certificateId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onCertificate", [certificate_id, account, region, partition]))

    @jsii.member(jsii_name="onClientVpnEndpoint")
    def on_client_vpn_endpoint(
        self,
        client_vpn_endpoint_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type client-vpn-endpoint to the statement.

        https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/what-is.html

        :param client_vpn_endpoint_id: - Identifier for the clientVpnEndpointId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifClientRootCertificateChainArn() - .ifCloudwatchLogGroupArn() - .ifCloudwatchLogStreamArn() - .ifDirectoryArn() - .ifRegion() - .ifResourceTag() - .ifSamlProviderArn() - .ifServerCertificateArn()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onClientVpnEndpoint", [client_vpn_endpoint_id, account, region, partition]))

    @jsii.member(jsii_name="onCustomerGateway")
    def on_customer_gateway(
        self,
        customer_gateway_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type customer-gateway to the statement.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html

        :param customer_gateway_id: - Identifier for the customerGatewayId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onCustomerGateway", [customer_gateway_id, account, region, partition]))

    @jsii.member(jsii_name="onDedicatedHost")
    def on_dedicated_host(
        self,
        dedicated_host_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type dedicated-host to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/dedicated-hosts-overview.html

        :param dedicated_host_id: - Identifier for the dedicatedHostId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAutoPlacement() - .ifAvailabilityZone() - .ifHostRecovery() - .ifInstanceType() - .ifQuantity() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onDedicatedHost", [dedicated_host_id, account, region, partition]))

    @jsii.member(jsii_name="onDhcpOptions")
    def on_dhcp_options(
        self,
        dhcp_options_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type dhcp-options to the statement.

        https://docs.aws.amazon.com/vpc/latest/userguide/VPC_DHCP_Options.html

        :param dhcp_options_id: - Identifier for the dhcpOptionsId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onDhcpOptions", [dhcp_options_id, account, region, partition]))

    @jsii.member(jsii_name="onEgressOnlyInternetGateway")
    def on_egress_only_internet_gateway(
        self,
        egress_only_internet_gateway_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type egress-only-internet-gateway to the statement.

        https://docs.aws.amazon.com/vpc/latest/userguide/egress-only-internet-gateway.html

        :param egress_only_internet_gateway_id: - Identifier for the egressOnlyInternetGatewayId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onEgressOnlyInternetGateway", [egress_only_internet_gateway_id, account, region, partition]))

    @jsii.member(jsii_name="onElasticGpu")
    def on_elastic_gpu(
        self,
        elastic_gpu_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type elastic-gpu to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/elastic-gpus.html

        :param elastic_gpu_id: - Identifier for the elasticGpuId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifElasticGpuType() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onElasticGpu", [elastic_gpu_id, account, region, partition]))

    @jsii.member(jsii_name="onElasticInference")
    def on_elastic_inference(
        self,
        elastic_inference_accelerator_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type elastic-inference to the statement.

        https://docs.aws.amazon.com/elastic-inference/latest/developerguide/what-is-ei.html

        :param elastic_inference_accelerator_id: - Identifier for the elasticInferenceAcceleratorId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onElasticInference", [elastic_inference_accelerator_id, account, region, partition]))

    @jsii.member(jsii_name="onElasticIp")
    def on_elastic_ip(
        self,
        allocation_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type elastic-ip to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html

        :param allocation_id: - Identifier for the allocationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onElasticIp", [allocation_id, account, region, partition]))

    @jsii.member(jsii_name="onExportImageTask")
    def on_export_image_task(
        self,
        export_image_task_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type export-image-task to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/vmimport-image-import.html#export-vm-image

        :param export_image_task_id: - Identifier for the exportImageTaskId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onExportImageTask", [export_image_task_id, account, region, partition]))

    @jsii.member(jsii_name="onExportInstanceTask")
    def on_export_instance_task(
        self,
        export_task_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type export-instance-task to the statement.

        https://docs.aws.amazon.com/vm-import/latest/userguide/vmexport.html

        :param export_task_id: - Identifier for the exportTaskId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onExportInstanceTask", [export_task_id, account, region, partition]))

    @jsii.member(jsii_name="onFleet")
    def on_fleet(
        self,
        fleet_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type fleet to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-fleet.html

        :param fleet_id: - Identifier for the fleetId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onFleet", [fleet_id, account, region, partition]))

    @jsii.member(jsii_name="onFpgaImage")
    def on_fpga_image(
        self,
        fpga_image_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type fpga-image to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#EC2_ARN_Format

        :param fpga_image_id: - Identifier for the fpgaImageId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifOwner() - .ifPublic() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onFpgaImage", [fpga_image_id, region, partition]))

    @jsii.member(jsii_name="onHostReservation")
    def on_host_reservation(
        self,
        host_reservation_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type host-reservation to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#EC2_ARN_Format

        :param host_reservation_id: - Identifier for the hostReservationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onHostReservation", [host_reservation_id, account, region, partition]))

    @jsii.member(jsii_name="onImage")
    def on_image(
        self,
        image_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type image to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html

        :param image_id: - Identifier for the imageId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifImageType() - .ifOwner() - .ifPublic() - .ifRegion() - .ifResourceTag() - .ifRootDeviceType()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onImage", [image_id, region, partition]))

    @jsii.member(jsii_name="onImportImageTask")
    def on_import_image_task(
        self,
        import_image_task_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type import-image-task to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/vmimport-image-import.html#import-vm-image

        :param import_image_task_id: - Identifier for the importImageTaskId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onImportImageTask", [import_image_task_id, account, region, partition]))

    @jsii.member(jsii_name="onImportSnapshotTask")
    def on_import_snapshot_task(
        self,
        import_snapshot_task_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type import-snapshot-task to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/vmimport-import-snapshot.html

        :param import_snapshot_task_id: - Identifier for the importSnapshotTaskId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onImportSnapshotTask", [import_snapshot_task_id, account, region, partition]))

    @jsii.member(jsii_name="onInstance")
    def on_instance(
        self,
        instance_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type instance to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Instances.html

        :param instance_id: - Identifier for the instanceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAvailabilityZone() - .ifEbsOptimized() - .ifInstanceProfile() - .ifInstanceType() - .ifPlacementGroup() - .ifRegion() - .ifResourceTag() - .ifRootDeviceType() - .ifTenancy()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onInstance", [instance_id, account, region, partition]))

    @jsii.member(jsii_name="onInternetGateway")
    def on_internet_gateway(
        self,
        internet_gateway_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type internet-gateway to the statement.

        https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Internet_Gateway.html

        :param internet_gateway_id: - Identifier for the internetGatewayId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onInternetGateway", [internet_gateway_id, account, region, partition]))

    @jsii.member(jsii_name="onIpv4poolEc2")
    def on_ipv4pool_ec2(
        self,
        ipv4_pool_ec2_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type ipv4pool-ec2 to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html#ip-addressing-eips

        :param ipv4_pool_ec2_id: - Identifier for the ipv4PoolEc2Id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onIpv4poolEc2", [ipv4_pool_ec2_id, account, region, partition]))

    @jsii.member(jsii_name="onIpv6poolEc2")
    def on_ipv6pool_ec2(
        self,
        ipv6_pool_ec2_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type ipv6pool-ec2 to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html#ipv6-addressing

        :param ipv6_pool_ec2_id: - Identifier for the ipv6PoolEc2Id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onIpv6poolEc2", [ipv6_pool_ec2_id, account, region, partition]))

    @jsii.member(jsii_name="onKeyPair")
    def on_key_pair(
        self,
        key_pair_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type key-pair to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html

        :param key_pair_name: - Identifier for the keyPairName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifKeyPairName() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onKeyPair", [key_pair_name, account, region, partition]))

    @jsii.member(jsii_name="onLaunchTemplate")
    def on_launch_template(
        self,
        launch_template_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type launch-template to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-launch-templates.html

        :param launch_template_id: - Identifier for the launchTemplateId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onLaunchTemplate", [launch_template_id, account, region, partition]))

    @jsii.member(jsii_name="onLocalGateway")
    def on_local_gateway(
        self,
        local_gateway_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type local-gateway to the statement.

        https://docs.aws.amazon.com/outposts/latest/userguide/outposts-local-gateways.html#lgw

        :param local_gateway_id: - Identifier for the localGatewayId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onLocalGateway", [local_gateway_id, account, region, partition]))

    @jsii.member(jsii_name="onLocalGatewayRouteTable")
    def on_local_gateway_route_table(
        self,
        local_gateway_routetable_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type local-gateway-route-table to the statement.

        https://docs.aws.amazon.com/outposts/latest/userguide/outposts-local-gateways.html#route-tables

        :param local_gateway_routetable_id: - Identifier for the localGatewayRoutetableId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onLocalGatewayRouteTable", [local_gateway_routetable_id, account, region, partition]))

    @jsii.member(jsii_name="onLocalGatewayRouteTableVirtualInterfaceGroupAssociation")
    def on_local_gateway_route_table_virtual_interface_group_association(
        self,
        local_gateway_route_table_virtual_interface_group_association_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type local-gateway-route-table-virtual-interface-group-association to the statement.

        https://docs.aws.amazon.com/outposts/latest/userguide/outposts-local-gateways.html

        :param local_gateway_route_table_virtual_interface_group_association_id: - Identifier for the localGatewayRouteTableVirtualInterfaceGroupAssociationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onLocalGatewayRouteTableVirtualInterfaceGroupAssociation", [local_gateway_route_table_virtual_interface_group_association_id, account, region, partition]))

    @jsii.member(jsii_name="onLocalGatewayRouteTableVpcAssociation")
    def on_local_gateway_route_table_vpc_association(
        self,
        local_gateway_route_table_vpc_association_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type local-gateway-route-table-vpc-association to the statement.

        https://docs.aws.amazon.com/outposts/latest/userguide/outposts-local-gateways.html#vpc-associations

        :param local_gateway_route_table_vpc_association_id: - Identifier for the localGatewayRouteTableVpcAssociationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag() - .ifTenancy()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onLocalGatewayRouteTableVpcAssociation", [local_gateway_route_table_vpc_association_id, account, region, partition]))

    @jsii.member(jsii_name="onLocalGatewayVirtualInterface")
    def on_local_gateway_virtual_interface(
        self,
        local_gateway_virtual_interface_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type local-gateway-virtual-interface to the statement.

        https://docs.aws.amazon.com/outposts/latest/userguide/outposts-local-gateways.html

        :param local_gateway_virtual_interface_id: - Identifier for the localGatewayVirtualInterfaceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onLocalGatewayVirtualInterface", [local_gateway_virtual_interface_id, account, region, partition]))

    @jsii.member(jsii_name="onLocalGatewayVirtualInterfaceGroup")
    def on_local_gateway_virtual_interface_group(
        self,
        local_gateway_virtual_interface_group_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type local-gateway-virtual-interface-group to the statement.

        https://docs.aws.amazon.com/outposts/latest/userguide/outposts-local-gateways.html

        :param local_gateway_virtual_interface_group_id: - Identifier for the localGatewayVirtualInterfaceGroupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onLocalGatewayVirtualInterfaceGroup", [local_gateway_virtual_interface_group_id, account, region, partition]))

    @jsii.member(jsii_name="onNatgateway")
    def on_natgateway(
        self,
        nat_gateway_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type natgateway to the statement.

        https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html

        :param nat_gateway_id: - Identifier for the natGatewayId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onNatgateway", [nat_gateway_id, account, region, partition]))

    @jsii.member(jsii_name="onNetworkAcl")
    def on_network_acl(
        self,
        nacl_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type network-acl to the statement.

        https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html

        :param nacl_id: - Identifier for the naclId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag() - .ifVpc()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onNetworkAcl", [nacl_id, account, region, partition]))

    @jsii.member(jsii_name="onNetworkInsightsAnalysis")
    def on_network_insights_analysis(
        self,
        network_insights_analysis_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type network-insights-analysis to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#EC2_ARN_Format

        :param network_insights_analysis_id: - Identifier for the networkInsightsAnalysisId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onNetworkInsightsAnalysis", [network_insights_analysis_id, account, region, partition]))

    @jsii.member(jsii_name="onNetworkInsightsPath")
    def on_network_insights_path(
        self,
        network_insights_path_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type network-insights-path to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#EC2_ARN_Format

        :param network_insights_path_id: - Identifier for the networkInsightsPathId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onNetworkInsightsPath", [network_insights_path_id, account, region, partition]))

    @jsii.member(jsii_name="onNetworkInterface")
    def on_network_interface(
        self,
        network_interface_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type network-interface to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html

        :param network_interface_id: - Identifier for the networkInterfaceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAssociatePublicIpAddress() - .ifAuthorizedService() - .ifAvailabilityZone() - .ifRegion() - .ifResourceTag() - .ifSubnet() - .ifVpc()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onNetworkInterface", [network_interface_id, account, region, partition]))

    @jsii.member(jsii_name="onPlacementGroup")
    def on_placement_group(
        self,
        placement_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type placement-group to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/placement-groups.html

        :param placement_group_name: - Identifier for the placementGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifPlacementGroupStrategy() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onPlacementGroup", [placement_group_name, account, region, partition]))

    @jsii.member(jsii_name="onPrefixList")
    def on_prefix_list(
        self,
        prefix_list_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type prefix-list to the statement.

        https://docs.aws.amazon.com/vpc/latest/userguide/managed-prefix-lists.html

        :param prefix_list_id: - Identifier for the prefixListId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onPrefixList", [prefix_list_id, account, region, partition]))

    @jsii.member(jsii_name="onReservedInstances")
    def on_reserved_instances(
        self,
        reservation_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type reserved-instances to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-reserved-instances.html

        :param reservation_id: - Identifier for the reservationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAvailabilityZone() - .ifInstanceType() - .ifRegion() - .ifReservedInstancesOfferingType() - .ifResourceTag() - .ifTenancy()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onReservedInstances", [reservation_id, account, region, partition]))

    @jsii.member(jsii_name="onRole")
    def on_role(
        self,
        role_name_with_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type role to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html

        :param role_name_with_path: - Identifier for the roleNameWithPath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onRole", [role_name_with_path, account, partition]))

    @jsii.member(jsii_name="onRouteTable")
    def on_route_table(
        self,
        route_table_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type route-table to the statement.

        https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Route_Tables.html

        :param route_table_id: - Identifier for the routeTableId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag() - .ifVpc()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onRouteTable", [route_table_id, account, region, partition]))

    @jsii.member(jsii_name="onSecurityGroup")
    def on_security_group(
        self,
        security_group_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type security-group to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html

        :param security_group_id: - Identifier for the securityGroupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag() - .ifVpc()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onSecurityGroup", [security_group_id, account, region, partition]))

    @jsii.member(jsii_name="onSnapshot")
    def on_snapshot(
        self,
        snapshot_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type snapshot to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSSnapshots.html

        :param snapshot_id: - Identifier for the snapshotId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifOutpostArn() - .ifOwner() - .ifParentVolume() - .ifRegion() - .ifResourceTag() - .ifSnapshotTime() - .ifSourceOutpostArn() - .ifVolumeSize()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onSnapshot", [snapshot_id, region, partition]))

    @jsii.member(jsii_name="onSpotFleetRequest")
    def on_spot_fleet_request(
        self,
        spot_fleet_request_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type spot-fleet-request to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#EC2_ARN_Format

        :param spot_fleet_request_id: - Identifier for the spotFleetRequestId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onSpotFleetRequest", [spot_fleet_request_id, account, region, partition]))

    @jsii.member(jsii_name="onSpotInstancesRequest")
    def on_spot_instances_request(
        self,
        spot_instance_request_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type spot-instances-request to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-spot-instances.html

        :param spot_instance_request_id: - Identifier for the spotInstanceRequestId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onSpotInstancesRequest", [spot_instance_request_id, account, region, partition]))

    @jsii.member(jsii_name="onSubnet")
    def on_subnet(
        self,
        subnet_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type subnet to the statement.

        https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Subnets.html

        :param subnet_id: - Identifier for the subnetId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAvailabilityZone() - .ifRegion() - .ifResourceTag() - .ifVpc()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onSubnet", [subnet_id, account, region, partition]))

    @jsii.member(jsii_name="onTrafficMirrorFilter")
    def on_traffic_mirror_filter(
        self,
        traffic_mirror_filter_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type traffic-mirror-filter to the statement.

        https://docs.aws.amazon.com/vpc/latest/mirroring/traffic-mirroring-filter.html

        :param traffic_mirror_filter_id: - Identifier for the trafficMirrorFilterId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onTrafficMirrorFilter", [traffic_mirror_filter_id, account, region, partition]))

    @jsii.member(jsii_name="onTrafficMirrorFilterRule")
    def on_traffic_mirror_filter_rule(
        self,
        traffic_mirror_filter_rule_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type traffic-mirror-filter-rule to the statement.

        https://docs.aws.amazon.com/vpc/latest/mirroring/traffic-mirroring-filter.html

        :param traffic_mirror_filter_rule_id: - Identifier for the trafficMirrorFilterRuleId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifRegion()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onTrafficMirrorFilterRule", [traffic_mirror_filter_rule_id, account, region, partition]))

    @jsii.member(jsii_name="onTrafficMirrorSession")
    def on_traffic_mirror_session(
        self,
        traffic_mirror_session_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type traffic-mirror-session to the statement.

        https://docs.aws.amazon.com/vpc/latest/mirroring/traffic-mirroring-session.html

        :param traffic_mirror_session_id: - Identifier for the trafficMirrorSessionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onTrafficMirrorSession", [traffic_mirror_session_id, account, region, partition]))

    @jsii.member(jsii_name="onTrafficMirrorTarget")
    def on_traffic_mirror_target(
        self,
        traffic_mirror_target_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type traffic-mirror-target to the statement.

        https://docs.aws.amazon.com/vpc/latest/mirroring/traffic-mirroring-target.html

        :param traffic_mirror_target_id: - Identifier for the trafficMirrorTargetId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onTrafficMirrorTarget", [traffic_mirror_target_id, account, region, partition]))

    @jsii.member(jsii_name="onTransitGateway")
    def on_transit_gateway(
        self,
        transit_gateway_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type transit-gateway to the statement.

        https://docs.aws.amazon.com/vpc/latest/tgw/how-transit-gateways-work.html

        :param transit_gateway_id: - Identifier for the transitGatewayId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onTransitGateway", [transit_gateway_id, account, region, partition]))

    @jsii.member(jsii_name="onTransitGatewayAttachment")
    def on_transit_gateway_attachment(
        self,
        transit_gateway_attachment_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type transit-gateway-attachment to the statement.

        https://docs.aws.amazon.com/vpc/latest/tgw/how-transit-gateways-work.html

        :param transit_gateway_attachment_id: - Identifier for the transitGatewayAttachmentId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onTransitGatewayAttachment", [transit_gateway_attachment_id, account, region, partition]))

    @jsii.member(jsii_name="onTransitGatewayConnectPeer")
    def on_transit_gateway_connect_peer(
        self,
        transit_gateway_connect_peer_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type transit-gateway-connect-peer to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#EC2_ARN_Format

        :param transit_gateway_connect_peer_id: - Identifier for the transitGatewayConnectPeerId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onTransitGatewayConnectPeer", [transit_gateway_connect_peer_id, account, region, partition]))

    @jsii.member(jsii_name="onTransitGatewayMulticastDomain")
    def on_transit_gateway_multicast_domain(
        self,
        transit_gateway_multicast_domain_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type transit-gateway-multicast-domain to the statement.

        https://docs.aws.amazon.com/vpc/latest/tgw/tgw-multicast-overview.html

        :param transit_gateway_multicast_domain_id: - Identifier for the transitGatewayMulticastDomainId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onTransitGatewayMulticastDomain", [transit_gateway_multicast_domain_id, account, region, partition]))

    @jsii.member(jsii_name="onTransitGatewayRouteTable")
    def on_transit_gateway_route_table(
        self,
        transit_gateway_route_table_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type transit-gateway-route-table to the statement.

        https://docs.aws.amazon.com/vpc/latest/tgw/how-transit-gateways-work.html

        :param transit_gateway_route_table_id: - Identifier for the transitGatewayRouteTableId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onTransitGatewayRouteTable", [transit_gateway_route_table_id, account, region, partition]))

    @jsii.member(jsii_name="onVolume")
    def on_volume(
        self,
        volume_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type volume to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-volumes.html

        :param volume_id: - Identifier for the volumeId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAvailabilityZone() - .ifEncrypted() - .ifParentSnapshot() - .ifRegion() - .ifResourceTag() - .ifVolumeIops() - .ifVolumeSize() - .ifVolumeThroughput() - .ifVolumeType()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onVolume", [volume_id, account, region, partition]))

    @jsii.member(jsii_name="onVpc")
    def on_vpc(
        self,
        vpc_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type vpc to the statement.

        https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Subnets.html

        :param vpc_id: - Identifier for the vpcId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag() - .ifTenancy()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onVpc", [vpc_id, account, region, partition]))

    @jsii.member(jsii_name="onVpcEndpoint")
    def on_vpc_endpoint(
        self,
        vpc_endpoint_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type vpc-endpoint to the statement.

        https://docs.aws.amazon.com/vpc/latest/userguide/endpoint-services-overview.html

        :param vpc_endpoint_id: - Identifier for the vpcEndpointId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onVpcEndpoint", [vpc_endpoint_id, account, region, partition]))

    @jsii.member(jsii_name="onVpcEndpointService")
    def on_vpc_endpoint_service(
        self,
        vpc_endpoint_service_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type vpc-endpoint-service to the statement.

        https://docs.aws.amazon.com/vpc/latest/userguide/endpoint-services-overview.html

        :param vpc_endpoint_service_id: - Identifier for the vpcEndpointServiceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag() - .ifVpceServicePrivateDnsName()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onVpcEndpointService", [vpc_endpoint_service_id, account, region, partition]))

    @jsii.member(jsii_name="onVpcFlowLog")
    def on_vpc_flow_log(
        self,
        vpc_flow_log_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type vpc-flow-log to the statement.

        https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html

        :param vpc_flow_log_id: - Identifier for the vpcFlowLogId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onVpcFlowLog", [vpc_flow_log_id, account, region, partition]))

    @jsii.member(jsii_name="onVpcPeeringConnection")
    def on_vpc_peering_connection(
        self,
        vpc_peering_connection_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type vpc-peering-connection to the statement.

        https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html

        :param vpc_peering_connection_id: - Identifier for the vpcPeeringConnectionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAccepterVpc() - .ifRegion() - .ifRequesterVpc() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onVpcPeeringConnection", [vpc_peering_connection_id, account, region, partition]))

    @jsii.member(jsii_name="onVpnConnection")
    def on_vpn_connection(
        self,
        vpn_connection_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type vpn-connection to the statement.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html

        :param vpn_connection_id: - Identifier for the vpnConnectionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAuthenticationType() - .ifDPDTimeoutSeconds() - .ifGatewayType() - .ifIKEVersions() - .ifInsideTunnelCidr() - .ifPhase1DHGroupNumbers() - .ifPhase1EncryptionAlgorithms() - .ifPhase1IntegrityAlgorithms() - .ifPhase1LifetimeSeconds() - .ifPhase2DHGroupNumbers() - .ifPhase2EncryptionAlgorithms() - .ifPhase2IntegrityAlgorithms() - .ifPhase2LifetimeSeconds() - .ifPresharedKeys() - .ifRegion() - .ifRekeyFuzzPercentage() - .ifRekeyMarginTimeSeconds() - .ifResourceTag() - .ifRoutingType()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onVpnConnection", [vpn_connection_id, account, region, partition]))

    @jsii.member(jsii_name="onVpnGateway")
    def on_vpn_gateway(
        self,
        vpn_gateway_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type vpn-gateway to the statement.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html

        :param vpn_gateway_id: - Identifier for the vpnGatewayId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "onVpnGateway", [vpn_gateway_id, account, region, partition]))

    @jsii.member(jsii_name="toAcceptReservedInstancesExchangeQuote")
    def to_accept_reserved_instances_exchange_quote(self) -> "Ec2":
        '''(experimental) Grants permission to accept a Convertible Reserved Instance exchange quote.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AcceptReservedInstancesExchangeQuote.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAcceptReservedInstancesExchangeQuote", []))

    @jsii.member(jsii_name="toAcceptTransitGatewayMulticastDomainAssociations")
    def to_accept_transit_gateway_multicast_domain_associations(self) -> "Ec2":
        '''(experimental) Grants permission to accept a request to associate subnets with a transit gateway multicast domain.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AcceptTransitGatewayMulticastDomainAssociations.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAcceptTransitGatewayMulticastDomainAssociations", []))

    @jsii.member(jsii_name="toAcceptTransitGatewayPeeringAttachment")
    def to_accept_transit_gateway_peering_attachment(self) -> "Ec2":
        '''(experimental) Grants permission to accept a transit gateway peering attachment request.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AcceptTransitGatewayPeeringAttachment.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAcceptTransitGatewayPeeringAttachment", []))

    @jsii.member(jsii_name="toAcceptTransitGatewayVpcAttachment")
    def to_accept_transit_gateway_vpc_attachment(self) -> "Ec2":
        '''(experimental) Grants permission to accept a request to attach a VPC to a transit gateway.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AcceptTransitGatewayVpcAttachment.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAcceptTransitGatewayVpcAttachment", []))

    @jsii.member(jsii_name="toAcceptVpcEndpointConnections")
    def to_accept_vpc_endpoint_connections(self) -> "Ec2":
        '''(experimental) Grants permission to accept one or more interface VPC endpoint connections to your VPC endpoint service.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AcceptVpcEndpointConnections.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAcceptVpcEndpointConnections", []))

    @jsii.member(jsii_name="toAcceptVpcPeeringConnection")
    def to_accept_vpc_peering_connection(self) -> "Ec2":
        '''(experimental) Grants permission to accept a VPC peering connection request.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AcceptVpcPeeringConnection.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAcceptVpcPeeringConnection", []))

    @jsii.member(jsii_name="toAdvertiseByoipCidr")
    def to_advertise_byoip_cidr(self) -> "Ec2":
        '''(experimental) Grants permission to advertise an IP address range that is provisioned for use in AWS through bring your own IP addresses (BYOIP).

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AdvertiseByoipCidr.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAdvertiseByoipCidr", []))

    @jsii.member(jsii_name="toAllocateAddress")
    def to_allocate_address(self) -> "Ec2":
        '''(experimental) Grants permission to allocate an Elastic IP address (EIP) to your account.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AllocateAddress.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAllocateAddress", []))

    @jsii.member(jsii_name="toAllocateHosts")
    def to_allocate_hosts(self) -> "Ec2":
        '''(experimental) Grants permission to allocate a Dedicated Host to your account.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AllocateHosts.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAllocateHosts", []))

    @jsii.member(jsii_name="toApplySecurityGroupsToClientVpnTargetNetwork")
    def to_apply_security_groups_to_client_vpn_target_network(self) -> "Ec2":
        '''(experimental) Grants permission to apply a security group to the association between a Client VPN endpoint and a target network.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ApplySecurityGroupsToClientVpnTargetNetwork.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toApplySecurityGroupsToClientVpnTargetNetwork", []))

    @jsii.member(jsii_name="toAssignIpv6Addresses")
    def to_assign_ipv6_addresses(self) -> "Ec2":
        '''(experimental) Grants permission to assign one or more IPv6 addresses to a network interface.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssignIpv6Addresses.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAssignIpv6Addresses", []))

    @jsii.member(jsii_name="toAssignPrivateIpAddresses")
    def to_assign_private_ip_addresses(self) -> "Ec2":
        '''(experimental) Grants permission to assign one or more secondary private IP addresses to a network interface.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssignPrivateIpAddresses.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAssignPrivateIpAddresses", []))

    @jsii.member(jsii_name="toAssociateAddress")
    def to_associate_address(self) -> "Ec2":
        '''(experimental) Grants permission to associate an Elastic IP address (EIP) with an instance or a network interface.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateAddress.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAssociateAddress", []))

    @jsii.member(jsii_name="toAssociateClientVpnTargetNetwork")
    def to_associate_client_vpn_target_network(self) -> "Ec2":
        '''(experimental) Grants permission to associate a target network with a Client VPN endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateClientVpnTargetNetwork.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAssociateClientVpnTargetNetwork", []))

    @jsii.member(jsii_name="toAssociateDhcpOptions")
    def to_associate_dhcp_options(self) -> "Ec2":
        '''(experimental) Grants permission to associate or disassociate a set of DHCP options with a VPC.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateDhcpOptions.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAssociateDhcpOptions", []))

    @jsii.member(jsii_name="toAssociateEnclaveCertificateIamRole")
    def to_associate_enclave_certificate_iam_role(self) -> "Ec2":
        '''(experimental) Grants permission to associate an ACM certificate with an IAM role to be used in an EC2 Enclave.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateEnclaveCertificateIamRole.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAssociateEnclaveCertificateIamRole", []))

    @jsii.member(jsii_name="toAssociateIamInstanceProfile")
    def to_associate_iam_instance_profile(self) -> "Ec2":
        '''(experimental) Grants permission to associate an IAM instance profile with a running or stopped instance.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateIamInstanceProfile.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAssociateIamInstanceProfile", []))

    @jsii.member(jsii_name="toAssociateRouteTable")
    def to_associate_route_table(self) -> "Ec2":
        '''(experimental) Grants permission to associate a subnet or gateway with a route table.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateRouteTable.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAssociateRouteTable", []))

    @jsii.member(jsii_name="toAssociateSubnetCidrBlock")
    def to_associate_subnet_cidr_block(self) -> "Ec2":
        '''(experimental) Grants permission to associate a CIDR block with a subnet.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateSubnetCidrBlock.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAssociateSubnetCidrBlock", []))

    @jsii.member(jsii_name="toAssociateTransitGatewayMulticastDomain")
    def to_associate_transit_gateway_multicast_domain(self) -> "Ec2":
        '''(experimental) Grants permission to associate an attachment and list of subnets with a transit gateway multicast domain.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateTransitGatewayMulticastDomain.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAssociateTransitGatewayMulticastDomain", []))

    @jsii.member(jsii_name="toAssociateTransitGatewayRouteTable")
    def to_associate_transit_gateway_route_table(self) -> "Ec2":
        '''(experimental) Grants permission to associate an attachment with a transit gateway route table.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateTransitGatewayRouteTable.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAssociateTransitGatewayRouteTable", []))

    @jsii.member(jsii_name="toAssociateVpcCidrBlock")
    def to_associate_vpc_cidr_block(self) -> "Ec2":
        '''(experimental) Grants permission to associate a CIDR block with a VPC.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateVpcCidrBlock.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAssociateVpcCidrBlock", []))

    @jsii.member(jsii_name="toAttachClassicLinkVpc")
    def to_attach_classic_link_vpc(self) -> "Ec2":
        '''(experimental) Grants permission to link an EC2-Classic instance to a ClassicLink-enabled VPC through one or more of the VPC's security groups.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AttachClassicLinkVpc.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAttachClassicLinkVpc", []))

    @jsii.member(jsii_name="toAttachInternetGateway")
    def to_attach_internet_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to attach an internet gateway to a VPC.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AttachInternetGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAttachInternetGateway", []))

    @jsii.member(jsii_name="toAttachNetworkInterface")
    def to_attach_network_interface(self) -> "Ec2":
        '''(experimental) Grants permission to attach a network interface to an instance.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AttachNetworkInterface.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAttachNetworkInterface", []))

    @jsii.member(jsii_name="toAttachVolume")
    def to_attach_volume(self) -> "Ec2":
        '''(experimental) Grants permission to attach an EBS volume to a running or stopped instance and expose it to the instance with the specified device name.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AttachVolume.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAttachVolume", []))

    @jsii.member(jsii_name="toAttachVpnGateway")
    def to_attach_vpn_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to attach a virtual private gateway to a VPC.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AttachVpnGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAttachVpnGateway", []))

    @jsii.member(jsii_name="toAuthorizeClientVpnIngress")
    def to_authorize_client_vpn_ingress(self) -> "Ec2":
        '''(experimental) Grants permission to add an inbound authorization rule to a Client VPN endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AuthorizeClientVpnIngress.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAuthorizeClientVpnIngress", []))

    @jsii.member(jsii_name="toAuthorizeSecurityGroupEgress")
    def to_authorize_security_group_egress(self) -> "Ec2":
        '''(experimental) Grants permission to add one or more outbound rules to a VPC security group.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AuthorizeSecurityGroupEgress.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAuthorizeSecurityGroupEgress", []))

    @jsii.member(jsii_name="toAuthorizeSecurityGroupIngress")
    def to_authorize_security_group_ingress(self) -> "Ec2":
        '''(experimental) Grants permission to add one or more inbound rules to a security group.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AuthorizeSecurityGroupIngress.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAuthorizeSecurityGroupIngress", []))

    @jsii.member(jsii_name="toBundleInstance")
    def to_bundle_instance(self) -> "Ec2":
        '''(experimental) Grants permission to bundle an instance store-backed Windows instance.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_BundleInstance.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toBundleInstance", []))

    @jsii.member(jsii_name="toCancelBundleTask")
    def to_cancel_bundle_task(self) -> "Ec2":
        '''(experimental) Grants permission to cancel a bundling operation.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CancelBundleTask.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCancelBundleTask", []))

    @jsii.member(jsii_name="toCancelCapacityReservation")
    def to_cancel_capacity_reservation(self) -> "Ec2":
        '''(experimental) Grants permission to cancel a Capacity Reservation and release the reserved capacity.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CancelCapacityReservation.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCancelCapacityReservation", []))

    @jsii.member(jsii_name="toCancelConversionTask")
    def to_cancel_conversion_task(self) -> "Ec2":
        '''(experimental) Grants permission to cancel an active conversion task.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CancelConversionTask.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCancelConversionTask", []))

    @jsii.member(jsii_name="toCancelExportTask")
    def to_cancel_export_task(self) -> "Ec2":
        '''(experimental) Grants permission to cancel an active export task.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CancelExportTask.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCancelExportTask", []))

    @jsii.member(jsii_name="toCancelImportTask")
    def to_cancel_import_task(self) -> "Ec2":
        '''(experimental) Grants permission to cancel an in-process import virtual machine or import snapshot task.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CancelImportTask.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCancelImportTask", []))

    @jsii.member(jsii_name="toCancelReservedInstancesListing")
    def to_cancel_reserved_instances_listing(self) -> "Ec2":
        '''(experimental) Grants permission to cancel a Reserved Instance listing on the Reserved Instance Marketplace.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CancelReservedInstancesListing.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCancelReservedInstancesListing", []))

    @jsii.member(jsii_name="toCancelSpotFleetRequests")
    def to_cancel_spot_fleet_requests(self) -> "Ec2":
        '''(experimental) Grants permission to cancel one or more Spot Fleet requests.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CancelSpotFleetRequests.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCancelSpotFleetRequests", []))

    @jsii.member(jsii_name="toCancelSpotInstanceRequests")
    def to_cancel_spot_instance_requests(self) -> "Ec2":
        '''(experimental) Grants permission to cancel one or more Spot Instance requests.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CancelSpotInstanceRequests.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCancelSpotInstanceRequests", []))

    @jsii.member(jsii_name="toConfirmProductInstance")
    def to_confirm_product_instance(self) -> "Ec2":
        '''(experimental) Grants permission to determine whether an owned product code is associated with an instance.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ConfirmProductInstance.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toConfirmProductInstance", []))

    @jsii.member(jsii_name="toCopyFpgaImage")
    def to_copy_fpga_image(self) -> "Ec2":
        '''(experimental) Grants permission to copy a source Amazon FPGA image (AFI) to the current Region.

        Resource-level permissions specified for this action apply to the new AFI only. They do not apply to the source AFI

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CopyFpgaImage.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCopyFpgaImage", []))

    @jsii.member(jsii_name="toCopyImage")
    def to_copy_image(self) -> "Ec2":
        '''(experimental) Grants permission to copy an Amazon Machine Image (AMI) from a source Region to the current Region.

        Resource-level permissions specified for this action apply to the new AMI only. They do not apply to the source AMI

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CopyImage.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCopyImage", []))

    @jsii.member(jsii_name="toCopySnapshot")
    def to_copy_snapshot(self) -> "Ec2":
        '''(experimental) Grants permission to copy a point-in-time snapshot of an EBS volume and store it in Amazon S3.

        Resource-level permissions specified for this action apply to the new snapshot only. They do not apply to the source snapshot

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CopySnapshot.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCopySnapshot", []))

    @jsii.member(jsii_name="toCreateCapacityReservation")
    def to_create_capacity_reservation(self) -> "Ec2":
        '''(experimental) Grants permission to create a Capacity Reservation.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateCapacityReservation.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateCapacityReservation", []))

    @jsii.member(jsii_name="toCreateCarrierGateway")
    def to_create_carrier_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to create a carrier gateway and provides CSP connectivity to VPC customers.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateCarrierGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateCarrierGateway", []))

    @jsii.member(jsii_name="toCreateClientVpnEndpoint")
    def to_create_client_vpn_endpoint(self) -> "Ec2":
        '''(experimental) Grants permission to create a Client VPN endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateClientVpnEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateClientVpnEndpoint", []))

    @jsii.member(jsii_name="toCreateClientVpnRoute")
    def to_create_client_vpn_route(self) -> "Ec2":
        '''(experimental) Grants permission to add a network route to a Client VPN endpoint's route table.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateClientVpnRoute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateClientVpnRoute", []))

    @jsii.member(jsii_name="toCreateCustomerGateway")
    def to_create_customer_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to create a customer gateway, which provides information to AWS about your customer gateway device.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateCustomerGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateCustomerGateway", []))

    @jsii.member(jsii_name="toCreateDefaultSubnet")
    def to_create_default_subnet(self) -> "Ec2":
        '''(experimental) Grants permission to create a default subnet in a specified Availability Zone in a default VPC.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateDefaultSubnet.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateDefaultSubnet", []))

    @jsii.member(jsii_name="toCreateDefaultVpc")
    def to_create_default_vpc(self) -> "Ec2":
        '''(experimental) Grants permission to create a default VPC with a default subnet in each Availability Zone.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateDefaultVpc.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateDefaultVpc", []))

    @jsii.member(jsii_name="toCreateDhcpOptions")
    def to_create_dhcp_options(self) -> "Ec2":
        '''(experimental) Grants permission to create a set of DHCP options for a VPC.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateDhcpOptions.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateDhcpOptions", []))

    @jsii.member(jsii_name="toCreateEgressOnlyInternetGateway")
    def to_create_egress_only_internet_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to create an egress-only internet gateway for a VPC.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateEgressOnlyInternetGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateEgressOnlyInternetGateway", []))

    @jsii.member(jsii_name="toCreateFleet")
    def to_create_fleet(self) -> "Ec2":
        '''(experimental) Grants permission to launch an EC2 Fleet.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateFleet.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateFleet", []))

    @jsii.member(jsii_name="toCreateFlowLogs")
    def to_create_flow_logs(self) -> "Ec2":
        '''(experimental) Grants permission to create one or more flow logs to capture IP traffic for a network interface.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateFlowLogs.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateFlowLogs", []))

    @jsii.member(jsii_name="toCreateFpgaImage")
    def to_create_fpga_image(self) -> "Ec2":
        '''(experimental) Grants permission to create an Amazon FPGA Image (AFI) from a design checkpoint (DCP).

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateFpgaImage.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateFpgaImage", []))

    @jsii.member(jsii_name="toCreateImage")
    def to_create_image(self) -> "Ec2":
        '''(experimental) Grants permission to create an Amazon EBS-backed AMI from a stopped or running Amazon EBS-backed instance.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateImage.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateImage", []))

    @jsii.member(jsii_name="toCreateInstanceExportTask")
    def to_create_instance_export_task(self) -> "Ec2":
        '''(experimental) Grants permission to export a running or stopped instance to an Amazon S3 bucket.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateInstanceExportTask.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateInstanceExportTask", []))

    @jsii.member(jsii_name="toCreateInternetGateway")
    def to_create_internet_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to create an internet gateway for a VPC.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateInternetGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateInternetGateway", []))

    @jsii.member(jsii_name="toCreateKeyPair")
    def to_create_key_pair(self) -> "Ec2":
        '''(experimental) Grants permission to create a 2048-bit RSA key pair.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateKeyPair.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateKeyPair", []))

    @jsii.member(jsii_name="toCreateLaunchTemplate")
    def to_create_launch_template(self) -> "Ec2":
        '''(experimental) Grants permission to create a launch template.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateLaunchTemplate.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateLaunchTemplate", []))

    @jsii.member(jsii_name="toCreateLaunchTemplateVersion")
    def to_create_launch_template_version(self) -> "Ec2":
        '''(experimental) Grants permission to create a new version of a launch template.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateLaunchTemplateVersion.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateLaunchTemplateVersion", []))

    @jsii.member(jsii_name="toCreateLocalGatewayRoute")
    def to_create_local_gateway_route(self) -> "Ec2":
        '''(experimental) Grants permission to create a static route for a local gateway route table.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateLocalGatewayRoute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateLocalGatewayRoute", []))

    @jsii.member(jsii_name="toCreateLocalGatewayRouteTableVpcAssociation")
    def to_create_local_gateway_route_table_vpc_association(self) -> "Ec2":
        '''(experimental) Grants permission to associate a VPC with a local gateway route table.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateLocalGatewayRouteTableVpcAssociation.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateLocalGatewayRouteTableVpcAssociation", []))

    @jsii.member(jsii_name="toCreateManagedPrefixList")
    def to_create_managed_prefix_list(self) -> "Ec2":
        '''(experimental) Grants permission to create a managed prefix list.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateManagedPrefixList.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateManagedPrefixList", []))

    @jsii.member(jsii_name="toCreateNatGateway")
    def to_create_nat_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to create a NAT gateway in a subnet.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateNatGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateNatGateway", []))

    @jsii.member(jsii_name="toCreateNetworkAcl")
    def to_create_network_acl(self) -> "Ec2":
        '''(experimental) Grants permission to create a network ACL in a VPC.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateNetworkAcl.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateNetworkAcl", []))

    @jsii.member(jsii_name="toCreateNetworkAclEntry")
    def to_create_network_acl_entry(self) -> "Ec2":
        '''(experimental) Grants permission to create a numbered entry (a rule) in a network ACL.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateNetworkAclEntry.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateNetworkAclEntry", []))

    @jsii.member(jsii_name="toCreateNetworkInsightsPath")
    def to_create_network_insights_path(self) -> "Ec2":
        '''(experimental) Grants permission to create a path to analyze for reachability.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateNetworkInsightsPath.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateNetworkInsightsPath", []))

    @jsii.member(jsii_name="toCreateNetworkInterface")
    def to_create_network_interface(self) -> "Ec2":
        '''(experimental) Grants permission to create a network interface in a subnet.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateNetworkInterface.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateNetworkInterface", []))

    @jsii.member(jsii_name="toCreateNetworkInterfacePermission")
    def to_create_network_interface_permission(self) -> "Ec2":
        '''(experimental) Grants permission to create a permission for an AWS-authorized user to perform certain operations on a network interface.

        Access Level: Permissions management

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateNetworkInterfacePermission.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateNetworkInterfacePermission", []))

    @jsii.member(jsii_name="toCreatePlacementGroup")
    def to_create_placement_group(self) -> "Ec2":
        '''(experimental) Grants permission to create a placement group.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreatePlacementGroup.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreatePlacementGroup", []))

    @jsii.member(jsii_name="toCreateReservedInstancesListing")
    def to_create_reserved_instances_listing(self) -> "Ec2":
        '''(experimental) Grants permission to create a listing for Standard Reserved Instances to be sold in the Reserved Instance Marketplace.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateReservedInstancesListing.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateReservedInstancesListing", []))

    @jsii.member(jsii_name="toCreateRoute")
    def to_create_route(self) -> "Ec2":
        '''(experimental) Grants permission to create a route in a VPC route table.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateRoute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateRoute", []))

    @jsii.member(jsii_name="toCreateRouteTable")
    def to_create_route_table(self) -> "Ec2":
        '''(experimental) Grants permission to create a route table for a VPC.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateRouteTable.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateRouteTable", []))

    @jsii.member(jsii_name="toCreateSecurityGroup")
    def to_create_security_group(self) -> "Ec2":
        '''(experimental) Grants permission to create a security group.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateSecurityGroup.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateSecurityGroup", []))

    @jsii.member(jsii_name="toCreateSnapshot")
    def to_create_snapshot(self) -> "Ec2":
        '''(experimental) Grants permission to create a snapshot of an EBS volume and store it in Amazon S3.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateSnapshot", []))

    @jsii.member(jsii_name="toCreateSnapshots")
    def to_create_snapshots(self) -> "Ec2":
        '''(experimental) Grants permission to create crash-consistent snapshots of multiple EBS volumes and store them in Amazon S3.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateSnapshots.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateSnapshots", []))

    @jsii.member(jsii_name="toCreateSpotDatafeedSubscription")
    def to_create_spot_datafeed_subscription(self) -> "Ec2":
        '''(experimental) Grants permission to create a data feed for Spot Instances to view Spot Instance usage logs.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateSpotDatafeedSubscription.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateSpotDatafeedSubscription", []))

    @jsii.member(jsii_name="toCreateSubnet")
    def to_create_subnet(self) -> "Ec2":
        '''(experimental) Grants permission to create a subnet in a VPC.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateSubnet.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateSubnet", []))

    @jsii.member(jsii_name="toCreateTags")
    def to_create_tags(self) -> "Ec2":
        '''(experimental) Grants permission to add or overwrite one or more tags for Amazon EC2 resources.

        Access Level: Tagging

        Possible conditions:

        - .ifCreateAction()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTags.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateTags", []))

    @jsii.member(jsii_name="toCreateTrafficMirrorFilter")
    def to_create_traffic_mirror_filter(self) -> "Ec2":
        '''(experimental) Grants permission to create a traffic mirror filter.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTrafficMirrorFilter.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateTrafficMirrorFilter", []))

    @jsii.member(jsii_name="toCreateTrafficMirrorFilterRule")
    def to_create_traffic_mirror_filter_rule(self) -> "Ec2":
        '''(experimental) Grants permission to create a traffic mirror filter rule.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTrafficMirrorFilterRule.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateTrafficMirrorFilterRule", []))

    @jsii.member(jsii_name="toCreateTrafficMirrorSession")
    def to_create_traffic_mirror_session(self) -> "Ec2":
        '''(experimental) Grants permission to create a traffic mirror session.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTrafficMirrorSession.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateTrafficMirrorSession", []))

    @jsii.member(jsii_name="toCreateTrafficMirrorTarget")
    def to_create_traffic_mirror_target(self) -> "Ec2":
        '''(experimental) Grants permission to create a traffic mirror target.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTrafficMirrorTarget.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateTrafficMirrorTarget", []))

    @jsii.member(jsii_name="toCreateTransitGateway")
    def to_create_transit_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to create a transit gateway.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTransitGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateTransitGateway", []))

    @jsii.member(jsii_name="toCreateTransitGatewayConnect")
    def to_create_transit_gateway_connect(self) -> "Ec2":
        '''(experimental) Grants permission to create a Connect attachment from a specified transit gateway attachment.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTransitGatewayConnect.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateTransitGatewayConnect", []))

    @jsii.member(jsii_name="toCreateTransitGatewayConnectPeer")
    def to_create_transit_gateway_connect_peer(self) -> "Ec2":
        '''(experimental) Grants permission to create a Connect peer between a transit gateway and an appliance.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTransitGatewayConnectPeer.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateTransitGatewayConnectPeer", []))

    @jsii.member(jsii_name="toCreateTransitGatewayMulticastDomain")
    def to_create_transit_gateway_multicast_domain(self) -> "Ec2":
        '''(experimental) Grants permission to create a multicast domain for a transit gateway.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTransitGatewayMulticastDomain.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateTransitGatewayMulticastDomain", []))

    @jsii.member(jsii_name="toCreateTransitGatewayPeeringAttachment")
    def to_create_transit_gateway_peering_attachment(self) -> "Ec2":
        '''(experimental) Grants permission to request a transit gateway peering attachment between a requester and accepter transit gateway.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTransitGatewayPeeringAttachment.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateTransitGatewayPeeringAttachment", []))

    @jsii.member(jsii_name="toCreateTransitGatewayPrefixListReference")
    def to_create_transit_gateway_prefix_list_reference(self) -> "Ec2":
        '''(experimental) Grants permission to create a transit gateway prefix list reference.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTransitGatewayPrefixListReference.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateTransitGatewayPrefixListReference", []))

    @jsii.member(jsii_name="toCreateTransitGatewayRoute")
    def to_create_transit_gateway_route(self) -> "Ec2":
        '''(experimental) Grants permission to create a static route for a transit gateway route table.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTransitGatewayRoute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateTransitGatewayRoute", []))

    @jsii.member(jsii_name="toCreateTransitGatewayRouteTable")
    def to_create_transit_gateway_route_table(self) -> "Ec2":
        '''(experimental) Grants permission to create a route table for a transit gateway.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTransitGatewayRouteTable.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateTransitGatewayRouteTable", []))

    @jsii.member(jsii_name="toCreateTransitGatewayVpcAttachment")
    def to_create_transit_gateway_vpc_attachment(self) -> "Ec2":
        '''(experimental) Grants permission to attach a VPC to a transit gateway.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTransitGatewayVpcAttachment.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateTransitGatewayVpcAttachment", []))

    @jsii.member(jsii_name="toCreateVolume")
    def to_create_volume(self) -> "Ec2":
        '''(experimental) Grants permission to create an EBS volume.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateVolume.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateVolume", []))

    @jsii.member(jsii_name="toCreateVpc")
    def to_create_vpc(self) -> "Ec2":
        '''(experimental) Grants permission to create a VPC with a specified CIDR block.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateVpc.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateVpc", []))

    @jsii.member(jsii_name="toCreateVpcEndpoint")
    def to_create_vpc_endpoint(self) -> "Ec2":
        '''(experimental) Grants permission to create a VPC endpoint for an AWS service.

        Access Level: Write

        Dependent actions:

        - route53:AssociateVPCWithHostedZone

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateVpcEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateVpcEndpoint", []))

    @jsii.member(jsii_name="toCreateVpcEndpointConnectionNotification")
    def to_create_vpc_endpoint_connection_notification(self) -> "Ec2":
        '''(experimental) Grants permission to create a connection notification for a VPC endpoint or VPC endpoint service.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateVpcEndpointConnectionNotification.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateVpcEndpointConnectionNotification", []))

    @jsii.member(jsii_name="toCreateVpcEndpointServiceConfiguration")
    def to_create_vpc_endpoint_service_configuration(self) -> "Ec2":
        '''(experimental) Grants permission to create a VPC endpoint service configuration to which service consumers (AWS accounts, IAM users, and IAM roles) can connect.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateVpcEndpointServiceConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateVpcEndpointServiceConfiguration", []))

    @jsii.member(jsii_name="toCreateVpcPeeringConnection")
    def to_create_vpc_peering_connection(self) -> "Ec2":
        '''(experimental) Grants permission to request a VPC peering connection between two VPCs.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateVpcPeeringConnection.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateVpcPeeringConnection", []))

    @jsii.member(jsii_name="toCreateVpnConnection")
    def to_create_vpn_connection(self) -> "Ec2":
        '''(experimental) Grants permission to create a VPN connection between a virtual private gateway or transit gateway and a customer gateway.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateVpnConnection.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateVpnConnection", []))

    @jsii.member(jsii_name="toCreateVpnConnectionRoute")
    def to_create_vpn_connection_route(self) -> "Ec2":
        '''(experimental) Grants permission to create a static route for a VPN connection between a virtual private gateway and a customer gateway.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateVpnConnectionRoute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateVpnConnectionRoute", []))

    @jsii.member(jsii_name="toCreateVpnGateway")
    def to_create_vpn_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to create a virtual private gateway.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateVpnGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateVpnGateway", []))

    @jsii.member(jsii_name="toDeleteCarrierGateway")
    def to_delete_carrier_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to delete a carrier gateway.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteCarrierGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteCarrierGateway", []))

    @jsii.member(jsii_name="toDeleteClientVpnEndpoint")
    def to_delete_client_vpn_endpoint(self) -> "Ec2":
        '''(experimental) Grants permission to delete a Client VPN endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteClientVpnEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteClientVpnEndpoint", []))

    @jsii.member(jsii_name="toDeleteClientVpnRoute")
    def to_delete_client_vpn_route(self) -> "Ec2":
        '''(experimental) Grants permission to delete a route from a Client VPN endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteClientVpnRoute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteClientVpnRoute", []))

    @jsii.member(jsii_name="toDeleteCustomerGateway")
    def to_delete_customer_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to delete a customer gateway.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteCustomerGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteCustomerGateway", []))

    @jsii.member(jsii_name="toDeleteDhcpOptions")
    def to_delete_dhcp_options(self) -> "Ec2":
        '''(experimental) Grants permission to delete a set of DHCP options.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteDhcpOptions.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteDhcpOptions", []))

    @jsii.member(jsii_name="toDeleteEgressOnlyInternetGateway")
    def to_delete_egress_only_internet_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to delete an egress-only internet gateway.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteEgressOnlyInternetGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteEgressOnlyInternetGateway", []))

    @jsii.member(jsii_name="toDeleteFleets")
    def to_delete_fleets(self) -> "Ec2":
        '''(experimental) Grants permission to delete one or more EC2 Fleets.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteFleets.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteFleets", []))

    @jsii.member(jsii_name="toDeleteFlowLogs")
    def to_delete_flow_logs(self) -> "Ec2":
        '''(experimental) Grants permission to delete one or more flow logs.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteFlowLogs.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteFlowLogs", []))

    @jsii.member(jsii_name="toDeleteFpgaImage")
    def to_delete_fpga_image(self) -> "Ec2":
        '''(experimental) Grants permission to delete an Amazon FPGA Image (AFI).

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteFpgaImage.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteFpgaImage", []))

    @jsii.member(jsii_name="toDeleteInternetGateway")
    def to_delete_internet_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to delete an internet gateway.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteInternetGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteInternetGateway", []))

    @jsii.member(jsii_name="toDeleteKeyPair")
    def to_delete_key_pair(self) -> "Ec2":
        '''(experimental) Grants permission to delete a key pair by removing the public key from Amazon EC2.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteKeyPair.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteKeyPair", []))

    @jsii.member(jsii_name="toDeleteLaunchTemplate")
    def to_delete_launch_template(self) -> "Ec2":
        '''(experimental) Grants permission to delete a launch template and its associated versions.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteLaunchTemplate.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteLaunchTemplate", []))

    @jsii.member(jsii_name="toDeleteLaunchTemplateVersions")
    def to_delete_launch_template_versions(self) -> "Ec2":
        '''(experimental) Grants permission to delete one or more versions of a launch template.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteLaunchTemplateVersions.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteLaunchTemplateVersions", []))

    @jsii.member(jsii_name="toDeleteLocalGatewayRoute")
    def to_delete_local_gateway_route(self) -> "Ec2":
        '''(experimental) Grants permission to delete a route from a local gateway route table.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteLocalGatewayRoute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteLocalGatewayRoute", []))

    @jsii.member(jsii_name="toDeleteLocalGatewayRouteTableVpcAssociation")
    def to_delete_local_gateway_route_table_vpc_association(self) -> "Ec2":
        '''(experimental) Grants permission to delete an association between a VPC and local gateway route table.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteLocalGatewayRouteTableVpcAssociation.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteLocalGatewayRouteTableVpcAssociation", []))

    @jsii.member(jsii_name="toDeleteManagedPrefixList")
    def to_delete_managed_prefix_list(self) -> "Ec2":
        '''(experimental) Grants permission to delete a managed prefix list.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteManagedPrefixList.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteManagedPrefixList", []))

    @jsii.member(jsii_name="toDeleteNatGateway")
    def to_delete_nat_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to delete a NAT gateway.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteNatGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteNatGateway", []))

    @jsii.member(jsii_name="toDeleteNetworkAcl")
    def to_delete_network_acl(self) -> "Ec2":
        '''(experimental) Grants permission to delete a network ACL.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteNetworkAcl.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteNetworkAcl", []))

    @jsii.member(jsii_name="toDeleteNetworkAclEntry")
    def to_delete_network_acl_entry(self) -> "Ec2":
        '''(experimental) Grants permission to delete an inbound or outbound entry (rule) from a network ACL.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteNetworkAclEntry.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteNetworkAclEntry", []))

    @jsii.member(jsii_name="toDeleteNetworkInsightsAnalysis")
    def to_delete_network_insights_analysis(self) -> "Ec2":
        '''(experimental) Grants permission to delete a network insights analysis.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteNetworkInsightsAnalysis.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteNetworkInsightsAnalysis", []))

    @jsii.member(jsii_name="toDeleteNetworkInsightsPath")
    def to_delete_network_insights_path(self) -> "Ec2":
        '''(experimental) Grants permission to delete a network insights path.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteNetworkInsightsPath.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteNetworkInsightsPath", []))

    @jsii.member(jsii_name="toDeleteNetworkInterface")
    def to_delete_network_interface(self) -> "Ec2":
        '''(experimental) Grants permission to delete a detached network interface.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteNetworkInterface.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteNetworkInterface", []))

    @jsii.member(jsii_name="toDeleteNetworkInterfacePermission")
    def to_delete_network_interface_permission(self) -> "Ec2":
        '''(experimental) Grants permission to delete a permission that is associated with a network interface.

        Access Level: Permissions management

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteNetworkInterfacePermission.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteNetworkInterfacePermission", []))

    @jsii.member(jsii_name="toDeletePlacementGroup")
    def to_delete_placement_group(self) -> "Ec2":
        '''(experimental) Grants permission to delete a placement group.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeletePlacementGroup.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeletePlacementGroup", []))

    @jsii.member(jsii_name="toDeleteQueuedReservedInstances")
    def to_delete_queued_reserved_instances(self) -> "Ec2":
        '''(experimental) Grants permission to delete the queued purchases for the specified Reserved Instances.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteQueuedReservedInstances.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteQueuedReservedInstances", []))

    @jsii.member(jsii_name="toDeleteRoute")
    def to_delete_route(self) -> "Ec2":
        '''(experimental) Grants permission to delete a route from a route table.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteRoute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteRoute", []))

    @jsii.member(jsii_name="toDeleteRouteTable")
    def to_delete_route_table(self) -> "Ec2":
        '''(experimental) Grants permission to delete a route table.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteRouteTable.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteRouteTable", []))

    @jsii.member(jsii_name="toDeleteSecurityGroup")
    def to_delete_security_group(self) -> "Ec2":
        '''(experimental) Grants permission to delete a security group.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteSecurityGroup.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteSecurityGroup", []))

    @jsii.member(jsii_name="toDeleteSnapshot")
    def to_delete_snapshot(self) -> "Ec2":
        '''(experimental) Grants permission to delete a snapshot of an EBS volume.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteSnapshot", []))

    @jsii.member(jsii_name="toDeleteSpotDatafeedSubscription")
    def to_delete_spot_datafeed_subscription(self) -> "Ec2":
        '''(experimental) Grants permission to delete a data feed for Spot Instances.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteSpotDatafeedSubscription.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteSpotDatafeedSubscription", []))

    @jsii.member(jsii_name="toDeleteSubnet")
    def to_delete_subnet(self) -> "Ec2":
        '''(experimental) Grants permission to delete a subnet.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteSubnet.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteSubnet", []))

    @jsii.member(jsii_name="toDeleteTags")
    def to_delete_tags(self) -> "Ec2":
        '''(experimental) Grants permission to delete one or more tags from Amazon EC2 resources.

        Access Level: Tagging

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteTags.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteTags", []))

    @jsii.member(jsii_name="toDeleteTrafficMirrorFilter")
    def to_delete_traffic_mirror_filter(self) -> "Ec2":
        '''(experimental) Grants permission to delete a traffic mirror filter.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteTrafficMirrorFilter.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteTrafficMirrorFilter", []))

    @jsii.member(jsii_name="toDeleteTrafficMirrorFilterRule")
    def to_delete_traffic_mirror_filter_rule(self) -> "Ec2":
        '''(experimental) Grants permission to delete a traffic mirror filter rule.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteTrafficMirrorFilterRule.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteTrafficMirrorFilterRule", []))

    @jsii.member(jsii_name="toDeleteTrafficMirrorSession")
    def to_delete_traffic_mirror_session(self) -> "Ec2":
        '''(experimental) Grants permission to delete a traffic mirror session.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteTrafficMirrorSession.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteTrafficMirrorSession", []))

    @jsii.member(jsii_name="toDeleteTrafficMirrorTarget")
    def to_delete_traffic_mirror_target(self) -> "Ec2":
        '''(experimental) Grants permission to delete a traffic mirror target.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteTrafficMirrorTarget.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteTrafficMirrorTarget", []))

    @jsii.member(jsii_name="toDeleteTransitGateway")
    def to_delete_transit_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to delete a transit gateway.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteTransitGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteTransitGateway", []))

    @jsii.member(jsii_name="toDeleteTransitGatewayConnect")
    def to_delete_transit_gateway_connect(self) -> "Ec2":
        '''(experimental) Grants permission to delete a transit gateway connect attachment.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteTransitGatewayConnect.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteTransitGatewayConnect", []))

    @jsii.member(jsii_name="toDeleteTransitGatewayConnectPeer")
    def to_delete_transit_gateway_connect_peer(self) -> "Ec2":
        '''(experimental) Grants permission to delete a transit gateway connect peer.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteTransitGatewayConnectPeer.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteTransitGatewayConnectPeer", []))

    @jsii.member(jsii_name="toDeleteTransitGatewayMulticastDomain")
    def to_delete_transit_gateway_multicast_domain(self) -> "Ec2":
        '''(experimental) Grants permissions to delete a transit gateway multicast domain.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteTransitGatewayMulticastDomain.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteTransitGatewayMulticastDomain", []))

    @jsii.member(jsii_name="toDeleteTransitGatewayPeeringAttachment")
    def to_delete_transit_gateway_peering_attachment(self) -> "Ec2":
        '''(experimental) Grants permission to delete a peering attachment from a transit gateway.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteTransitGatewayPeeringAttachment.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteTransitGatewayPeeringAttachment", []))

    @jsii.member(jsii_name="toDeleteTransitGatewayPrefixListReference")
    def to_delete_transit_gateway_prefix_list_reference(self) -> "Ec2":
        '''(experimental) Grants permission to delete a transit gateway prefix list reference.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteTransitGatewayPrefixListReference.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteTransitGatewayPrefixListReference", []))

    @jsii.member(jsii_name="toDeleteTransitGatewayRoute")
    def to_delete_transit_gateway_route(self) -> "Ec2":
        '''(experimental) Grants permission to delete a route from a transit gateway route table.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteTransitGatewayRoute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteTransitGatewayRoute", []))

    @jsii.member(jsii_name="toDeleteTransitGatewayRouteTable")
    def to_delete_transit_gateway_route_table(self) -> "Ec2":
        '''(experimental) Grants permission to delete a transit gateway route table.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteTransitGatewayRouteTable.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteTransitGatewayRouteTable", []))

    @jsii.member(jsii_name="toDeleteTransitGatewayVpcAttachment")
    def to_delete_transit_gateway_vpc_attachment(self) -> "Ec2":
        '''(experimental) Grants permission to delete a VPC attachment from a transit gateway.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteTransitGatewayVpcAttachment.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteTransitGatewayVpcAttachment", []))

    @jsii.member(jsii_name="toDeleteVolume")
    def to_delete_volume(self) -> "Ec2":
        '''(experimental) Grants permission to delete an EBS volume.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteVolume.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteVolume", []))

    @jsii.member(jsii_name="toDeleteVpc")
    def to_delete_vpc(self) -> "Ec2":
        '''(experimental) Grants permission to delete a VPC.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteVpc.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteVpc", []))

    @jsii.member(jsii_name="toDeleteVpcEndpointConnectionNotifications")
    def to_delete_vpc_endpoint_connection_notifications(self) -> "Ec2":
        '''(experimental) Grants permission to delete one or more VPC endpoint connection notifications.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteVpcEndpointConnectionNotifications.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteVpcEndpointConnectionNotifications", []))

    @jsii.member(jsii_name="toDeleteVpcEndpoints")
    def to_delete_vpc_endpoints(self) -> "Ec2":
        '''(experimental) Grants permission to delete one or more VPC endpoints.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteVpcEndpoints.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteVpcEndpoints", []))

    @jsii.member(jsii_name="toDeleteVpcEndpointServiceConfigurations")
    def to_delete_vpc_endpoint_service_configurations(self) -> "Ec2":
        '''(experimental) Grants permission to delete one or more VPC endpoint service configurations.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteVpcEndpointServiceConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteVpcEndpointServiceConfigurations", []))

    @jsii.member(jsii_name="toDeleteVpcPeeringConnection")
    def to_delete_vpc_peering_connection(self) -> "Ec2":
        '''(experimental) Grants permission to delete a VPC peering connection.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteVpcPeeringConnection.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteVpcPeeringConnection", []))

    @jsii.member(jsii_name="toDeleteVpnConnection")
    def to_delete_vpn_connection(self) -> "Ec2":
        '''(experimental) Grants permission to delete a VPN connection.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteVpnConnection.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteVpnConnection", []))

    @jsii.member(jsii_name="toDeleteVpnConnectionRoute")
    def to_delete_vpn_connection_route(self) -> "Ec2":
        '''(experimental) Grants permission to delete a static route for a VPN connection between a virtual private gateway and a customer gateway.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteVpnConnectionRoute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteVpnConnectionRoute", []))

    @jsii.member(jsii_name="toDeleteVpnGateway")
    def to_delete_vpn_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to delete a virtual private gateway.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteVpnGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteVpnGateway", []))

    @jsii.member(jsii_name="toDeprovisionByoipCidr")
    def to_deprovision_byoip_cidr(self) -> "Ec2":
        '''(experimental) Grants permission to release an IP address range that was provisioned through bring your own IP addresses (BYOIP), and to delete the corresponding address pool.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeprovisionByoipCidr.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeprovisionByoipCidr", []))

    @jsii.member(jsii_name="toDeregisterImage")
    def to_deregister_image(self) -> "Ec2":
        '''(experimental) Grants permission to deregister an Amazon Machine Image (AMI).

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeregisterImage.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeregisterImage", []))

    @jsii.member(jsii_name="toDeregisterInstanceEventNotificationAttributes")
    def to_deregister_instance_event_notification_attributes(self) -> "Ec2":
        '''(experimental) Grants permission to remove tags from the set of tags to include in notifications about scheduled events for your instances.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeregisterInstanceEventNotificationAttributes.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeregisterInstanceEventNotificationAttributes", []))

    @jsii.member(jsii_name="toDeregisterTransitGatewayMulticastGroupMembers")
    def to_deregister_transit_gateway_multicast_group_members(self) -> "Ec2":
        '''(experimental) Grants permission to deregister one or more network interface members from a group IP address in a transit gateway multicast domain.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeregisterTransitGatewayMulticastGroupMembers.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeregisterTransitGatewayMulticastGroupMembers", []))

    @jsii.member(jsii_name="toDeregisterTransitGatewayMulticastGroupSources")
    def to_deregister_transit_gateway_multicast_group_sources(self) -> "Ec2":
        '''(experimental) Grants permission to deregister one or more network interface sources from a group IP address in a transit gateway multicast domain.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeregisterTransitGatewayMulticastGroupSources.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeregisterTransitGatewayMulticastGroupSources", []))

    @jsii.member(jsii_name="toDescribeAccountAttributes")
    def to_describe_account_attributes(self) -> "Ec2":
        '''(experimental) Grants permission to describe the attributes of the AWS account.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeAccountAttributes.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeAccountAttributes", []))

    @jsii.member(jsii_name="toDescribeAddresses")
    def to_describe_addresses(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more Elastic IP addresses.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeAddresses.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeAddresses", []))

    @jsii.member(jsii_name="toDescribeAddressesAttribute")
    def to_describe_addresses_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to describe the attributes of the specified Elastic IP addresses.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeAddressesAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeAddressesAttribute", []))

    @jsii.member(jsii_name="toDescribeAggregateIdFormat")
    def to_describe_aggregate_id_format(self) -> "Ec2":
        '''(experimental) Grants permission to describe the longer ID format settings for all resource types.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeAggregateIdFormat.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeAggregateIdFormat", []))

    @jsii.member(jsii_name="toDescribeAvailabilityZones")
    def to_describe_availability_zones(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more of the Availability Zones that are available to you.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeAvailabilityZones.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeAvailabilityZones", []))

    @jsii.member(jsii_name="toDescribeBundleTasks")
    def to_describe_bundle_tasks(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more bundling tasks.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeBundleTasks.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeBundleTasks", []))

    @jsii.member(jsii_name="toDescribeByoipCidrs")
    def to_describe_byoip_cidrs(self) -> "Ec2":
        '''(experimental) Grants permission to describe the IP address ranges that were provisioned through bring your own IP addresses (BYOIP).

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeByoipCidrs.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeByoipCidrs", []))

    @jsii.member(jsii_name="toDescribeCapacityReservations")
    def to_describe_capacity_reservations(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more Capacity Reservations.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeCapacityReservations.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeCapacityReservations", []))

    @jsii.member(jsii_name="toDescribeCarrierGateways")
    def to_describe_carrier_gateways(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more Carrier Gateways.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeCarrierGateways.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeCarrierGateways", []))

    @jsii.member(jsii_name="toDescribeClassicLinkInstances")
    def to_describe_classic_link_instances(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more linked EC2-Classic instances.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeClassicLinkInstances.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeClassicLinkInstances", []))

    @jsii.member(jsii_name="toDescribeClientVpnAuthorizationRules")
    def to_describe_client_vpn_authorization_rules(self) -> "Ec2":
        '''(experimental) Grants permission to describe the authorization rules for a Client VPN endpoint.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeClientVpnAuthorizationRules.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeClientVpnAuthorizationRules", []))

    @jsii.member(jsii_name="toDescribeClientVpnConnections")
    def to_describe_client_vpn_connections(self) -> "Ec2":
        '''(experimental) Grants permission to describe active client connections and connections that have been terminated within the last 60 minutes for a Client VPN endpoint.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeClientVpnConnections.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeClientVpnConnections", []))

    @jsii.member(jsii_name="toDescribeClientVpnEndpoints")
    def to_describe_client_vpn_endpoints(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more Client VPN endpoints.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeClientVpnEndpoints.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeClientVpnEndpoints", []))

    @jsii.member(jsii_name="toDescribeClientVpnRoutes")
    def to_describe_client_vpn_routes(self) -> "Ec2":
        '''(experimental) Grants permission to describe the routes for a Client VPN endpoint.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeClientVpnRoutes.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeClientVpnRoutes", []))

    @jsii.member(jsii_name="toDescribeClientVpnTargetNetworks")
    def to_describe_client_vpn_target_networks(self) -> "Ec2":
        '''(experimental) Grants permission to describe the target networks that are associated with a Client VPN endpoint.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeClientVpnTargetNetworks.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeClientVpnTargetNetworks", []))

    @jsii.member(jsii_name="toDescribeCoipPools")
    def to_describe_coip_pools(self) -> "Ec2":
        '''(experimental) Grants permission to describe the specified customer-owned address pools or all of your customer-owned address pools.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeCoipPools.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeCoipPools", []))

    @jsii.member(jsii_name="toDescribeConversionTasks")
    def to_describe_conversion_tasks(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more conversion tasks.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeConversionTasks.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeConversionTasks", []))

    @jsii.member(jsii_name="toDescribeCustomerGateways")
    def to_describe_customer_gateways(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more customer gateways.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeCustomerGateways.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeCustomerGateways", []))

    @jsii.member(jsii_name="toDescribeDhcpOptions")
    def to_describe_dhcp_options(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more DHCP options sets.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeDhcpOptions.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeDhcpOptions", []))

    @jsii.member(jsii_name="toDescribeEgressOnlyInternetGateways")
    def to_describe_egress_only_internet_gateways(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more egress-only internet gateways.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeEgressOnlyInternetGateways.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeEgressOnlyInternetGateways", []))

    @jsii.member(jsii_name="toDescribeElasticGpus")
    def to_describe_elastic_gpus(self) -> "Ec2":
        '''(experimental) Grants permission to describe an Elastic Graphics accelerator that is associated with an instance.

        Access Level: Read

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeElasticGpus.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeElasticGpus", []))

    @jsii.member(jsii_name="toDescribeExportImageTasks")
    def to_describe_export_image_tasks(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more export image tasks.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeExportImageTasks.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeExportImageTasks", []))

    @jsii.member(jsii_name="toDescribeExportTasks")
    def to_describe_export_tasks(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more export instance tasks.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeExportTasks.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeExportTasks", []))

    @jsii.member(jsii_name="toDescribeFastSnapshotRestores")
    def to_describe_fast_snapshot_restores(self) -> "Ec2":
        '''(experimental) Grants permission to describe the state of fast snapshot restores for snapshots.

        Access Level: Read

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeFastSnapshotRestores.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeFastSnapshotRestores", []))

    @jsii.member(jsii_name="toDescribeFleetHistory")
    def to_describe_fleet_history(self) -> "Ec2":
        '''(experimental) Grants permission to describe the events for an EC2 Fleet during a specified time.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeFleetHistory.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeFleetHistory", []))

    @jsii.member(jsii_name="toDescribeFleetInstances")
    def to_describe_fleet_instances(self) -> "Ec2":
        '''(experimental) Grants permission to describe the running instances for an EC2 Fleet.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeFleetInstances.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeFleetInstances", []))

    @jsii.member(jsii_name="toDescribeFleets")
    def to_describe_fleets(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more EC2 Fleets.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeFleets.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeFleets", []))

    @jsii.member(jsii_name="toDescribeFlowLogs")
    def to_describe_flow_logs(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more flow logs.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeFlowLogs.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeFlowLogs", []))

    @jsii.member(jsii_name="toDescribeFpgaImageAttribute")
    def to_describe_fpga_image_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to describe the attributes of an Amazon FPGA Image (AFI).

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeFpgaImageAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeFpgaImageAttribute", []))

    @jsii.member(jsii_name="toDescribeFpgaImages")
    def to_describe_fpga_images(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more Amazon FPGA Images (AFIs).

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeFpgaImages.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeFpgaImages", []))

    @jsii.member(jsii_name="toDescribeHostReservationOfferings")
    def to_describe_host_reservation_offerings(self) -> "Ec2":
        '''(experimental) Grants permission to describe the Dedicated Host Reservations that are available to purchase.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeHostReservationOfferings.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeHostReservationOfferings", []))

    @jsii.member(jsii_name="toDescribeHostReservations")
    def to_describe_host_reservations(self) -> "Ec2":
        '''(experimental) Grants permission to describe the Dedicated Host Reservations that are associated with Dedicated Hosts in the AWS account.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeHostReservations.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeHostReservations", []))

    @jsii.member(jsii_name="toDescribeHosts")
    def to_describe_hosts(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more Dedicated Hosts.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeHosts.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeHosts", []))

    @jsii.member(jsii_name="toDescribeIamInstanceProfileAssociations")
    def to_describe_iam_instance_profile_associations(self) -> "Ec2":
        '''(experimental) Grants permission to describe the IAM instance profile associations.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeIamInstanceProfileAssociations.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeIamInstanceProfileAssociations", []))

    @jsii.member(jsii_name="toDescribeIdentityIdFormat")
    def to_describe_identity_id_format(self) -> "Ec2":
        '''(experimental) Grants permission to describe the ID format settings for resources for an IAM user, IAM role, or root user.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeIdentityIdFormat.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeIdentityIdFormat", []))

    @jsii.member(jsii_name="toDescribeIdFormat")
    def to_describe_id_format(self) -> "Ec2":
        '''(experimental) Grants permission to describe the ID format settings for resources.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeIdFormat.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeIdFormat", []))

    @jsii.member(jsii_name="toDescribeImageAttribute")
    def to_describe_image_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to describe an attribute of an Amazon Machine Image (AMI).

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeImageAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeImageAttribute", []))

    @jsii.member(jsii_name="toDescribeImages")
    def to_describe_images(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more images (AMIs, AKIs, and ARIs).

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeImages.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeImages", []))

    @jsii.member(jsii_name="toDescribeImportImageTasks")
    def to_describe_import_image_tasks(self) -> "Ec2":
        '''(experimental) Grants permission to describe import virtual machine or import snapshot tasks.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeImportImageTasks.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeImportImageTasks", []))

    @jsii.member(jsii_name="toDescribeImportSnapshotTasks")
    def to_describe_import_snapshot_tasks(self) -> "Ec2":
        '''(experimental) Grants permission to describe import snapshot tasks.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeImportSnapshotTasks.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeImportSnapshotTasks", []))

    @jsii.member(jsii_name="toDescribeInstanceAttribute")
    def to_describe_instance_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to describe the attributes of an instance.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstanceAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeInstanceAttribute", []))

    @jsii.member(jsii_name="toDescribeInstanceCreditSpecifications")
    def to_describe_instance_credit_specifications(self) -> "Ec2":
        '''(experimental) Grants permission to describe the credit option for CPU usage of one or more burstable performance instances.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstanceCreditSpecifications.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeInstanceCreditSpecifications", []))

    @jsii.member(jsii_name="toDescribeInstanceEventNotificationAttributes")
    def to_describe_instance_event_notification_attributes(self) -> "Ec2":
        '''(experimental) Grants permission to describe the set of tags to include in notifications about scheduled events for your instances.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstanceEventNotificationAttributes.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeInstanceEventNotificationAttributes", []))

    @jsii.member(jsii_name="toDescribeInstances")
    def to_describe_instances(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more instances.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstances.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeInstances", []))

    @jsii.member(jsii_name="toDescribeInstanceStatus")
    def to_describe_instance_status(self) -> "Ec2":
        '''(experimental) Grants permission to describe the status of one or more instances.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstanceStatus.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeInstanceStatus", []))

    @jsii.member(jsii_name="toDescribeInstanceTypeOfferings")
    def to_describe_instance_type_offerings(self) -> "Ec2":
        '''(experimental) Grants permission to describe the set of instance types that are offered in a location.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstanceTypeOfferings.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeInstanceTypeOfferings", []))

    @jsii.member(jsii_name="toDescribeInstanceTypes")
    def to_describe_instance_types(self) -> "Ec2":
        '''(experimental) Grants permission to describe the details of instance types that are offered in a location.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstanceTypes.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeInstanceTypes", []))

    @jsii.member(jsii_name="toDescribeInternetGateways")
    def to_describe_internet_gateways(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more internet gateways.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInternetGateways.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeInternetGateways", []))

    @jsii.member(jsii_name="toDescribeIpv6Pools")
    def to_describe_ipv6_pools(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more IPv6 address pools.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeIpv6Pools.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeIpv6Pools", []))

    @jsii.member(jsii_name="toDescribeKeyPairs")
    def to_describe_key_pairs(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more key pairs.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeKeyPairs.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeKeyPairs", []))

    @jsii.member(jsii_name="toDescribeLaunchTemplates")
    def to_describe_launch_templates(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more launch templates.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeLaunchTemplates.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeLaunchTemplates", []))

    @jsii.member(jsii_name="toDescribeLaunchTemplateVersions")
    def to_describe_launch_template_versions(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more launch template versions.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeLaunchTemplateVersions.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeLaunchTemplateVersions", []))

    @jsii.member(jsii_name="toDescribeLocalGatewayRouteTables")
    def to_describe_local_gateway_route_tables(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more local gateway route tables.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeLocalGatewayRouteTables.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeLocalGatewayRouteTables", []))

    @jsii.member(jsii_name="toDescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations")
    def to_describe_local_gateway_route_table_virtual_interface_group_associations(
        self,
    ) -> "Ec2":
        '''(experimental) Grants permission to describe the associations between virtual interface groups and local gateway route tables.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", []))

    @jsii.member(jsii_name="toDescribeLocalGatewayRouteTableVpcAssociations")
    def to_describe_local_gateway_route_table_vpc_associations(self) -> "Ec2":
        '''(experimental) Grants permission to describe an association between VPCs and local gateway route tables.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeLocalGatewayRouteTableVpcAssociations.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeLocalGatewayRouteTableVpcAssociations", []))

    @jsii.member(jsii_name="toDescribeLocalGateways")
    def to_describe_local_gateways(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more local gateways.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeLocalGateways.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeLocalGateways", []))

    @jsii.member(jsii_name="toDescribeLocalGatewayVirtualInterfaceGroups")
    def to_describe_local_gateway_virtual_interface_groups(self) -> "Ec2":
        '''(experimental) Grants permission to describe local gateway virtual interface groups.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeLocalGatewayVirtualInterfaceGroups.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeLocalGatewayVirtualInterfaceGroups", []))

    @jsii.member(jsii_name="toDescribeLocalGatewayVirtualInterfaces")
    def to_describe_local_gateway_virtual_interfaces(self) -> "Ec2":
        '''(experimental) Grants permission to describe local gateway virtual interfaces.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeLocalGatewayVirtualInterfaces.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeLocalGatewayVirtualInterfaces", []))

    @jsii.member(jsii_name="toDescribeManagedPrefixLists")
    def to_describe_managed_prefix_lists(self) -> "Ec2":
        '''(experimental) Grants permission to describe your managed prefix lists and any AWS-managed prefix lists.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeManagedPrefixLists.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeManagedPrefixLists", []))

    @jsii.member(jsii_name="toDescribeMovingAddresses")
    def to_describe_moving_addresses(self) -> "Ec2":
        '''(experimental) Grants permission to describe Elastic IP addresses that are being moved to the EC2-VPC platform.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeMovingAddresses.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeMovingAddresses", []))

    @jsii.member(jsii_name="toDescribeNatGateways")
    def to_describe_nat_gateways(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more NAT gateways.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNatGateways.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeNatGateways", []))

    @jsii.member(jsii_name="toDescribeNetworkAcls")
    def to_describe_network_acls(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more network ACLs.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNetworkAcls.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeNetworkAcls", []))

    @jsii.member(jsii_name="toDescribeNetworkInsightsAnalyses")
    def to_describe_network_insights_analyses(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more network insights analyses.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNetworkInsightsAnalyses.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeNetworkInsightsAnalyses", []))

    @jsii.member(jsii_name="toDescribeNetworkInsightsPaths")
    def to_describe_network_insights_paths(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more network insights paths.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNetworkInsightsPaths.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeNetworkInsightsPaths", []))

    @jsii.member(jsii_name="toDescribeNetworkInterfaceAttribute")
    def to_describe_network_interface_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to describe a network interface attribute.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNetworkInterfaceAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeNetworkInterfaceAttribute", []))

    @jsii.member(jsii_name="toDescribeNetworkInterfacePermissions")
    def to_describe_network_interface_permissions(self) -> "Ec2":
        '''(experimental) Grants permission to describe the permissions that are associated with a network interface.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNetworkInterfacePermissions.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeNetworkInterfacePermissions", []))

    @jsii.member(jsii_name="toDescribeNetworkInterfaces")
    def to_describe_network_interfaces(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more network interfaces.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNetworkInterfaces.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeNetworkInterfaces", []))

    @jsii.member(jsii_name="toDescribePlacementGroups")
    def to_describe_placement_groups(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more placement groups.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribePlacementGroups.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribePlacementGroups", []))

    @jsii.member(jsii_name="toDescribePrefixLists")
    def to_describe_prefix_lists(self) -> "Ec2":
        '''(experimental) Grants permission to describe available AWS services in a prefix list format.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribePrefixLists.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribePrefixLists", []))

    @jsii.member(jsii_name="toDescribePrincipalIdFormat")
    def to_describe_principal_id_format(self) -> "Ec2":
        '''(experimental) Grants permission to describe the ID format settings for the root user and all IAM roles and IAM users that have explicitly specified a longer ID (17-character ID) preference.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribePrincipalIdFormat.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribePrincipalIdFormat", []))

    @jsii.member(jsii_name="toDescribePublicIpv4Pools")
    def to_describe_public_ipv4_pools(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more IPv4 address pools.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribePublicIpv4Pools.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribePublicIpv4Pools", []))

    @jsii.member(jsii_name="toDescribeRegions")
    def to_describe_regions(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more AWS Regions that are currently available in your account.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeRegions.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeRegions", []))

    @jsii.member(jsii_name="toDescribeReservedInstances")
    def to_describe_reserved_instances(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more purchased Reserved Instances in your account.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeReservedInstances.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeReservedInstances", []))

    @jsii.member(jsii_name="toDescribeReservedInstancesListings")
    def to_describe_reserved_instances_listings(self) -> "Ec2":
        '''(experimental) Grants permission to describe your account's Reserved Instance listings in the Reserved Instance Marketplace.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeReservedInstancesListings.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeReservedInstancesListings", []))

    @jsii.member(jsii_name="toDescribeReservedInstancesModifications")
    def to_describe_reserved_instances_modifications(self) -> "Ec2":
        '''(experimental) Grants permission to describe the modifications made to one or more Reserved Instances.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeReservedInstancesModifications.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeReservedInstancesModifications", []))

    @jsii.member(jsii_name="toDescribeReservedInstancesOfferings")
    def to_describe_reserved_instances_offerings(self) -> "Ec2":
        '''(experimental) Grants permission to describe the Reserved Instance offerings that are available for purchase.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeReservedInstancesOfferings.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeReservedInstancesOfferings", []))

    @jsii.member(jsii_name="toDescribeRouteTables")
    def to_describe_route_tables(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more route tables.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeRouteTables.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeRouteTables", []))

    @jsii.member(jsii_name="toDescribeScheduledInstanceAvailability")
    def to_describe_scheduled_instance_availability(self) -> "Ec2":
        '''(experimental) Grants permission to find available schedules for Scheduled Instances.

        Access Level: Read

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeScheduledInstanceAvailability.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeScheduledInstanceAvailability", []))

    @jsii.member(jsii_name="toDescribeScheduledInstances")
    def to_describe_scheduled_instances(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more Scheduled Instances in your account.

        Access Level: Read

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeScheduledInstances.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeScheduledInstances", []))

    @jsii.member(jsii_name="toDescribeSecurityGroupReferences")
    def to_describe_security_group_references(self) -> "Ec2":
        '''(experimental) Grants permission to describe the VPCs on the other side of a VPC peering connection that are referencing specified VPC security groups.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSecurityGroupReferences.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeSecurityGroupReferences", []))

    @jsii.member(jsii_name="toDescribeSecurityGroups")
    def to_describe_security_groups(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more security groups.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSecurityGroups.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeSecurityGroups", []))

    @jsii.member(jsii_name="toDescribeSnapshotAttribute")
    def to_describe_snapshot_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to describe an attribute of a snapshot.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSnapshotAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeSnapshotAttribute", []))

    @jsii.member(jsii_name="toDescribeSnapshots")
    def to_describe_snapshots(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more EBS snapshots.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSnapshots.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeSnapshots", []))

    @jsii.member(jsii_name="toDescribeSpotDatafeedSubscription")
    def to_describe_spot_datafeed_subscription(self) -> "Ec2":
        '''(experimental) Grants permission to describe the data feed for Spot Instances.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSpotDatafeedSubscription.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeSpotDatafeedSubscription", []))

    @jsii.member(jsii_name="toDescribeSpotFleetInstances")
    def to_describe_spot_fleet_instances(self) -> "Ec2":
        '''(experimental) Grants permission to describe the running instances for a Spot Fleet.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSpotFleetInstances.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeSpotFleetInstances", []))

    @jsii.member(jsii_name="toDescribeSpotFleetRequestHistory")
    def to_describe_spot_fleet_request_history(self) -> "Ec2":
        '''(experimental) Grants permission to describe the events for a Spot Fleet request during a specified time.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSpotFleetRequestHistory.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeSpotFleetRequestHistory", []))

    @jsii.member(jsii_name="toDescribeSpotFleetRequests")
    def to_describe_spot_fleet_requests(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more Spot Fleet requests.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSpotFleetRequests.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeSpotFleetRequests", []))

    @jsii.member(jsii_name="toDescribeSpotInstanceRequests")
    def to_describe_spot_instance_requests(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more Spot Instance requests.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSpotInstanceRequests.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeSpotInstanceRequests", []))

    @jsii.member(jsii_name="toDescribeSpotPriceHistory")
    def to_describe_spot_price_history(self) -> "Ec2":
        '''(experimental) Grants permission to describe the Spot Instance price history.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSpotPriceHistory.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeSpotPriceHistory", []))

    @jsii.member(jsii_name="toDescribeStaleSecurityGroups")
    def to_describe_stale_security_groups(self) -> "Ec2":
        '''(experimental) Grants permission to describe the stale security group rules for security groups in a specified VPC.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeStaleSecurityGroups.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeStaleSecurityGroups", []))

    @jsii.member(jsii_name="toDescribeSubnets")
    def to_describe_subnets(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more subnets.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSubnets.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeSubnets", []))

    @jsii.member(jsii_name="toDescribeTags")
    def to_describe_tags(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more tags for an Amazon EC2 resource.

        Access Level: Read

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeTags.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeTags", []))

    @jsii.member(jsii_name="toDescribeTrafficMirrorFilters")
    def to_describe_traffic_mirror_filters(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more traffic mirror filters.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeTrafficMirrorFilters.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeTrafficMirrorFilters", []))

    @jsii.member(jsii_name="toDescribeTrafficMirrorSessions")
    def to_describe_traffic_mirror_sessions(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more traffic mirror sessions.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeTrafficMirrorSessions.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeTrafficMirrorSessions", []))

    @jsii.member(jsii_name="toDescribeTrafficMirrorTargets")
    def to_describe_traffic_mirror_targets(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more traffic mirror targets.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeTrafficMirrorTargets.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeTrafficMirrorTargets", []))

    @jsii.member(jsii_name="toDescribeTransitGatewayAttachments")
    def to_describe_transit_gateway_attachments(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more attachments between resources and transit gateways.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeTransitGatewayAttachments.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeTransitGatewayAttachments", []))

    @jsii.member(jsii_name="toDescribeTransitGatewayConnectPeers")
    def to_describe_transit_gateway_connect_peers(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more transit gateway connect peers.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeTransitGatewayConnectPeers.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeTransitGatewayConnectPeers", []))

    @jsii.member(jsii_name="toDescribeTransitGatewayConnects")
    def to_describe_transit_gateway_connects(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more transit gateway connect attachments.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeTransitGatewayConnects.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeTransitGatewayConnects", []))

    @jsii.member(jsii_name="toDescribeTransitGatewayMulticastDomains")
    def to_describe_transit_gateway_multicast_domains(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more transit gateway multicast domains.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeTransitGatewayMulticastDomains.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeTransitGatewayMulticastDomains", []))

    @jsii.member(jsii_name="toDescribeTransitGatewayPeeringAttachments")
    def to_describe_transit_gateway_peering_attachments(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more transit gateway peering attachments.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeTransitGatewayPeeringAttachments.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeTransitGatewayPeeringAttachments", []))

    @jsii.member(jsii_name="toDescribeTransitGatewayRouteTables")
    def to_describe_transit_gateway_route_tables(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more transit gateway route tables.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeTransitGatewayRouteTables.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeTransitGatewayRouteTables", []))

    @jsii.member(jsii_name="toDescribeTransitGateways")
    def to_describe_transit_gateways(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more transit gateways.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeTransitGateways.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeTransitGateways", []))

    @jsii.member(jsii_name="toDescribeTransitGatewayVpcAttachments")
    def to_describe_transit_gateway_vpc_attachments(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more VPC attachments on a transit gateway.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeTransitGatewayVpcAttachments.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeTransitGatewayVpcAttachments", []))

    @jsii.member(jsii_name="toDescribeVolumeAttribute")
    def to_describe_volume_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to describe an attribute of an EBS volume.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVolumeAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVolumeAttribute", []))

    @jsii.member(jsii_name="toDescribeVolumes")
    def to_describe_volumes(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more EBS volumes.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVolumes.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVolumes", []))

    @jsii.member(jsii_name="toDescribeVolumesModifications")
    def to_describe_volumes_modifications(self) -> "Ec2":
        '''(experimental) Grants permission to describe the current modification status of one or more EBS volumes.

        Access Level: Read

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVolumesModifications.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVolumesModifications", []))

    @jsii.member(jsii_name="toDescribeVolumeStatus")
    def to_describe_volume_status(self) -> "Ec2":
        '''(experimental) Grants permission to describe the status of one or more EBS volumes.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVolumeStatus.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVolumeStatus", []))

    @jsii.member(jsii_name="toDescribeVpcAttribute")
    def to_describe_vpc_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to describe an attribute of a VPC.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVpcAttribute", []))

    @jsii.member(jsii_name="toDescribeVpcClassicLink")
    def to_describe_vpc_classic_link(self) -> "Ec2":
        '''(experimental) Grants permission to describe the ClassicLink status of one or more VPCs.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcClassicLink.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVpcClassicLink", []))

    @jsii.member(jsii_name="toDescribeVpcClassicLinkDnsSupport")
    def to_describe_vpc_classic_link_dns_support(self) -> "Ec2":
        '''(experimental) Grants permission to describe the ClassicLink DNS support status of one or more VPCs.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcClassicLinkDnsSupport.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVpcClassicLinkDnsSupport", []))

    @jsii.member(jsii_name="toDescribeVpcEndpointConnectionNotifications")
    def to_describe_vpc_endpoint_connection_notifications(self) -> "Ec2":
        '''(experimental) Grants permission to describe the connection notifications for VPC endpoints and VPC endpoint services.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcEndpointConnectionNotifications.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVpcEndpointConnectionNotifications", []))

    @jsii.member(jsii_name="toDescribeVpcEndpointConnections")
    def to_describe_vpc_endpoint_connections(self) -> "Ec2":
        '''(experimental) Grants permission to describe the VPC endpoint connections to your VPC endpoint services.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcEndpointConnections.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVpcEndpointConnections", []))

    @jsii.member(jsii_name="toDescribeVpcEndpoints")
    def to_describe_vpc_endpoints(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more VPC endpoints.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcEndpoints.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVpcEndpoints", []))

    @jsii.member(jsii_name="toDescribeVpcEndpointServiceConfigurations")
    def to_describe_vpc_endpoint_service_configurations(self) -> "Ec2":
        '''(experimental) Grants permission to describe VPC endpoint service configurations (your services).

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcEndpointServiceConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVpcEndpointServiceConfigurations", []))

    @jsii.member(jsii_name="toDescribeVpcEndpointServicePermissions")
    def to_describe_vpc_endpoint_service_permissions(self) -> "Ec2":
        '''(experimental) Grants permission to describe the principals (service consumers) that are permitted to discover your VPC endpoint service.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcEndpointServicePermissions.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVpcEndpointServicePermissions", []))

    @jsii.member(jsii_name="toDescribeVpcEndpointServices")
    def to_describe_vpc_endpoint_services(self) -> "Ec2":
        '''(experimental) Grants permission to describe all supported AWS services that can be specified when creating a VPC endpoint.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcEndpointServices.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVpcEndpointServices", []))

    @jsii.member(jsii_name="toDescribeVpcPeeringConnections")
    def to_describe_vpc_peering_connections(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more VPC peering connections.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcPeeringConnections.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVpcPeeringConnections", []))

    @jsii.member(jsii_name="toDescribeVpcs")
    def to_describe_vpcs(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more VPCs.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcs.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVpcs", []))

    @jsii.member(jsii_name="toDescribeVpnConnections")
    def to_describe_vpn_connections(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more VPN connections.

        Access Level: Read

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpnConnections.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVpnConnections", []))

    @jsii.member(jsii_name="toDescribeVpnGateways")
    def to_describe_vpn_gateways(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more virtual private gateways.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpnGateways.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVpnGateways", []))

    @jsii.member(jsii_name="toDetachClassicLinkVpc")
    def to_detach_classic_link_vpc(self) -> "Ec2":
        '''(experimental) Grants permission to unlink (detach) a linked EC2-Classic instance from a VPC.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DetachClassicLinkVpc.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDetachClassicLinkVpc", []))

    @jsii.member(jsii_name="toDetachInternetGateway")
    def to_detach_internet_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to detach an internet gateway from a VPC.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DetachInternetGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDetachInternetGateway", []))

    @jsii.member(jsii_name="toDetachNetworkInterface")
    def to_detach_network_interface(self) -> "Ec2":
        '''(experimental) Grants permission to detach a network interface from an instance.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DetachNetworkInterface.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDetachNetworkInterface", []))

    @jsii.member(jsii_name="toDetachVolume")
    def to_detach_volume(self) -> "Ec2":
        '''(experimental) Grants permission to detach an EBS volume from an instance.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DetachVolume.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDetachVolume", []))

    @jsii.member(jsii_name="toDetachVpnGateway")
    def to_detach_vpn_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to detach a virtual private gateway from a VPC.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DetachVpnGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDetachVpnGateway", []))

    @jsii.member(jsii_name="toDisableEbsEncryptionByDefault")
    def to_disable_ebs_encryption_by_default(self) -> "Ec2":
        '''(experimental) Grants permission to disable EBS encryption by default for your account.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisableEbsEncryptionByDefault.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisableEbsEncryptionByDefault", []))

    @jsii.member(jsii_name="toDisableFastSnapshotRestores")
    def to_disable_fast_snapshot_restores(self) -> "Ec2":
        '''(experimental) Grants permission to disable fast snapshot restores for one or more snapshots in specified Availability Zones.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisableFastSnapshotRestores.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisableFastSnapshotRestores", []))

    @jsii.member(jsii_name="toDisableTransitGatewayRouteTablePropagation")
    def to_disable_transit_gateway_route_table_propagation(self) -> "Ec2":
        '''(experimental) Grants permission to disable a resource attachment from propagating routes to the specified propagation route table.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisableTransitGatewayRouteTablePropagation.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisableTransitGatewayRouteTablePropagation", []))

    @jsii.member(jsii_name="toDisableVgwRoutePropagation")
    def to_disable_vgw_route_propagation(self) -> "Ec2":
        '''(experimental) Grants permission to disable a virtual private gateway from propagating routes to a specified route table of a VPC.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisableVgwRoutePropagation.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisableVgwRoutePropagation", []))

    @jsii.member(jsii_name="toDisableVpcClassicLink")
    def to_disable_vpc_classic_link(self) -> "Ec2":
        '''(experimental) Grants permission to disable ClassicLink for a VPC.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisableVpcClassicLink.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisableVpcClassicLink", []))

    @jsii.member(jsii_name="toDisableVpcClassicLinkDnsSupport")
    def to_disable_vpc_classic_link_dns_support(self) -> "Ec2":
        '''(experimental) Grants permission to disable ClassicLink DNS support for a VPC.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisableVpcClassicLinkDnsSupport.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisableVpcClassicLinkDnsSupport", []))

    @jsii.member(jsii_name="toDisassociateAddress")
    def to_disassociate_address(self) -> "Ec2":
        '''(experimental) Grants permission to disassociate an Elastic IP address from an instance or network interface.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisassociateAddress.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisassociateAddress", []))

    @jsii.member(jsii_name="toDisassociateClientVpnTargetNetwork")
    def to_disassociate_client_vpn_target_network(self) -> "Ec2":
        '''(experimental) Grants permission to disassociate a target network from a Client VPN endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisassociateClientVpnTargetNetwork.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisassociateClientVpnTargetNetwork", []))

    @jsii.member(jsii_name="toDisassociateEnclaveCertificateIamRole")
    def to_disassociate_enclave_certificate_iam_role(self) -> "Ec2":
        '''(experimental) Grants permission to disassociate an ACM certificate from a IAM role.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisassociateEnclaveCertificateIamRole.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisassociateEnclaveCertificateIamRole", []))

    @jsii.member(jsii_name="toDisassociateIamInstanceProfile")
    def to_disassociate_iam_instance_profile(self) -> "Ec2":
        '''(experimental) Grants permission to disassociate an IAM instance profile from a running or stopped instance.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisassociateIamInstanceProfile.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisassociateIamInstanceProfile", []))

    @jsii.member(jsii_name="toDisassociateRouteTable")
    def to_disassociate_route_table(self) -> "Ec2":
        '''(experimental) Grants permission to disassociate a subnet from a route table.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisassociateRouteTable.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisassociateRouteTable", []))

    @jsii.member(jsii_name="toDisassociateSubnetCidrBlock")
    def to_disassociate_subnet_cidr_block(self) -> "Ec2":
        '''(experimental) Grants permission to disassociate a CIDR block from a subnet.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisassociateSubnetCidrBlock.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisassociateSubnetCidrBlock", []))

    @jsii.member(jsii_name="toDisassociateTransitGatewayMulticastDomain")
    def to_disassociate_transit_gateway_multicast_domain(self) -> "Ec2":
        '''(experimental) Grants permission to disassociate one or more subnets from a transit gateway multicast domain.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisassociateTransitGatewayMulticastDomain.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisassociateTransitGatewayMulticastDomain", []))

    @jsii.member(jsii_name="toDisassociateTransitGatewayRouteTable")
    def to_disassociate_transit_gateway_route_table(self) -> "Ec2":
        '''(experimental) Grants permission to disassociate a resource attachment from a transit gateway route table.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisassociateTransitGatewayRouteTable.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisassociateTransitGatewayRouteTable", []))

    @jsii.member(jsii_name="toDisassociateVpcCidrBlock")
    def to_disassociate_vpc_cidr_block(self) -> "Ec2":
        '''(experimental) Grants permission to disassociate a CIDR block from a VPC.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisassociateVpcCidrBlock.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisassociateVpcCidrBlock", []))

    @jsii.member(jsii_name="toEnableEbsEncryptionByDefault")
    def to_enable_ebs_encryption_by_default(self) -> "Ec2":
        '''(experimental) Grants permission to enable EBS encryption by default for your account.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_EnableEbsEncryptionByDefault.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toEnableEbsEncryptionByDefault", []))

    @jsii.member(jsii_name="toEnableFastSnapshotRestores")
    def to_enable_fast_snapshot_restores(self) -> "Ec2":
        '''(experimental) Grants permission to enable fast snapshot restores for one or more snapshots in specified Availability Zones.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_EnableFastSnapshotRestores.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toEnableFastSnapshotRestores", []))

    @jsii.member(jsii_name="toEnableTransitGatewayRouteTablePropagation")
    def to_enable_transit_gateway_route_table_propagation(self) -> "Ec2":
        '''(experimental) Grants permission to enable an attachment to propagate routes to a propagation route table.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_EnableTransitGatewayRouteTablePropagation.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toEnableTransitGatewayRouteTablePropagation", []))

    @jsii.member(jsii_name="toEnableVgwRoutePropagation")
    def to_enable_vgw_route_propagation(self) -> "Ec2":
        '''(experimental) Grants permission to enable a virtual private gateway to propagate routes to a VPC route table.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_EnableVgwRoutePropagation.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toEnableVgwRoutePropagation", []))

    @jsii.member(jsii_name="toEnableVolumeIO")
    def to_enable_volume_io(self) -> "Ec2":
        '''(experimental) Grants permission to enable I/O operations for a volume that had I/O operations disabled.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_EnableVolumeIO.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toEnableVolumeIO", []))

    @jsii.member(jsii_name="toEnableVpcClassicLink")
    def to_enable_vpc_classic_link(self) -> "Ec2":
        '''(experimental) Grants permission to enable a VPC for ClassicLink.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_EnableVpcClassicLink.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toEnableVpcClassicLink", []))

    @jsii.member(jsii_name="toEnableVpcClassicLinkDnsSupport")
    def to_enable_vpc_classic_link_dns_support(self) -> "Ec2":
        '''(experimental) Grants permission to enable a VPC to support DNS hostname resolution for ClassicLink.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_EnableVpcClassicLinkDnsSupport.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toEnableVpcClassicLinkDnsSupport", []))

    @jsii.member(jsii_name="toExportClientVpnClientCertificateRevocationList")
    def to_export_client_vpn_client_certificate_revocation_list(self) -> "Ec2":
        '''(experimental) Grants permission to download the client certificate revocation list for a Client VPN endpoint.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ExportClientVpnClientCertificateRevocationList.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toExportClientVpnClientCertificateRevocationList", []))

    @jsii.member(jsii_name="toExportClientVpnClientConfiguration")
    def to_export_client_vpn_client_configuration(self) -> "Ec2":
        '''(experimental) Grants permission to download the contents of the Client VPN endpoint configuration file for a Client VPN endpoint.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ExportClientVpnClientConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toExportClientVpnClientConfiguration", []))

    @jsii.member(jsii_name="toExportImage")
    def to_export_image(self) -> "Ec2":
        '''(experimental) Grants permission to export an Amazon Machine Image (AMI) to a VM file.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ExportImage.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toExportImage", []))

    @jsii.member(jsii_name="toExportTransitGatewayRoutes")
    def to_export_transit_gateway_routes(self) -> "Ec2":
        '''(experimental) Grants permission to export routes from a transit gateway route table to an Amazon S3 bucket.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ExportTransitGatewayRoutes.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toExportTransitGatewayRoutes", []))

    @jsii.member(jsii_name="toGetAssociatedEnclaveCertificateIamRoles")
    def to_get_associated_enclave_certificate_iam_roles(self) -> "Ec2":
        '''(experimental) Grants permission to get the list of roles associated with an ACM certificate.

        Access Level: Read

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetAssociatedEnclaveCertificateIamRoles.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetAssociatedEnclaveCertificateIamRoles", []))

    @jsii.member(jsii_name="toGetAssociatedIpv6PoolCidrs")
    def to_get_associated_ipv6_pool_cidrs(self) -> "Ec2":
        '''(experimental) Grants permission to get information about the IPv6 CIDR block associations for a specified IPv6 address pool.

        Access Level: Read

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetAssociatedIpv6PoolCidrs.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetAssociatedIpv6PoolCidrs", []))

    @jsii.member(jsii_name="toGetCapacityReservationUsage")
    def to_get_capacity_reservation_usage(self) -> "Ec2":
        '''(experimental) Grants permission to get usage information about a Capacity Reservation.

        Access Level: Read

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetCapacityReservationUsage.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetCapacityReservationUsage", []))

    @jsii.member(jsii_name="toGetCoipPoolUsage")
    def to_get_coip_pool_usage(self) -> "Ec2":
        '''(experimental) Grants permission to describe the allocations from the specified customer-owned address pool.

        Access Level: Read

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetCoipPoolUsage.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetCoipPoolUsage", []))

    @jsii.member(jsii_name="toGetConsoleOutput")
    def to_get_console_output(self) -> "Ec2":
        '''(experimental) Grants permission to get the console output for an instance.

        Access Level: Read

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetConsoleOutput.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetConsoleOutput", []))

    @jsii.member(jsii_name="toGetConsoleScreenshot")
    def to_get_console_screenshot(self) -> "Ec2":
        '''(experimental) Grants permission to retrieve a JPG-format screenshot of a running instance.

        Access Level: Read

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetConsoleScreenshot.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetConsoleScreenshot", []))

    @jsii.member(jsii_name="toGetDefaultCreditSpecification")
    def to_get_default_credit_specification(self) -> "Ec2":
        '''(experimental) Grants permission to get the default credit option for CPU usage of a burstable performance instance family.

        Access Level: Read

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetDefaultCreditSpecification.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetDefaultCreditSpecification", []))

    @jsii.member(jsii_name="toGetEbsDefaultKmsKeyId")
    def to_get_ebs_default_kms_key_id(self) -> "Ec2":
        '''(experimental) Grants permission to get the ID of the default customer master key (CMK) for EBS encryption by default.

        Access Level: Read

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetEbsDefaultKmsKeyId.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetEbsDefaultKmsKeyId", []))

    @jsii.member(jsii_name="toGetEbsEncryptionByDefault")
    def to_get_ebs_encryption_by_default(self) -> "Ec2":
        '''(experimental) Grants permission to describe whether EBS encryption by default is enabled for your account.

        Access Level: Read

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetEbsEncryptionByDefault.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetEbsEncryptionByDefault", []))

    @jsii.member(jsii_name="toGetGroupsForCapacityReservation")
    def to_get_groups_for_capacity_reservation(self) -> "Ec2":
        '''(experimental) Grants permission to list the resource groups to which a Capacity Reservation has been added.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetGroupsForCapacityReservation.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetGroupsForCapacityReservation", []))

    @jsii.member(jsii_name="toGetHostReservationPurchasePreview")
    def to_get_host_reservation_purchase_preview(self) -> "Ec2":
        '''(experimental) Grants permission to preview a reservation purchase with configurations that match those of a Dedicated Host.

        Access Level: Read

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetHostReservationPurchasePreview.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetHostReservationPurchasePreview", []))

    @jsii.member(jsii_name="toGetLaunchTemplateData")
    def to_get_launch_template_data(self) -> "Ec2":
        '''(experimental) Grants permission to get the configuration data of the specified instance for use with a new launch template or launch template version.

        Access Level: Read

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetLaunchTemplateData.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetLaunchTemplateData", []))

    @jsii.member(jsii_name="toGetManagedPrefixListAssociations")
    def to_get_managed_prefix_list_associations(self) -> "Ec2":
        '''(experimental) Grants permission to get information about the resources that are associated with the specified managed prefix list.

        Access Level: Read

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetManagedPrefixListAssociations.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetManagedPrefixListAssociations", []))

    @jsii.member(jsii_name="toGetManagedPrefixListEntries")
    def to_get_managed_prefix_list_entries(self) -> "Ec2":
        '''(experimental) Grants permission to get information about the entries for a specified managed prefix list.

        Access Level: Read

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetManagedPrefixListEntries.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetManagedPrefixListEntries", []))

    @jsii.member(jsii_name="toGetPasswordData")
    def to_get_password_data(self) -> "Ec2":
        '''(experimental) Grants permission to retrieve the encrypted administrator password for a running Windows instance.

        Access Level: Read

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetPasswordData.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetPasswordData", []))

    @jsii.member(jsii_name="toGetReservedInstancesExchangeQuote")
    def to_get_reserved_instances_exchange_quote(self) -> "Ec2":
        '''(experimental) Grants permission to return a quote and exchange information for exchanging one or more Convertible Reserved Instances for a new Convertible Reserved Instance.

        Access Level: Read

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetReservedInstancesExchangeQuote.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetReservedInstancesExchangeQuote", []))

    @jsii.member(jsii_name="toGetTransitGatewayAttachmentPropagations")
    def to_get_transit_gateway_attachment_propagations(self) -> "Ec2":
        '''(experimental) Grants permission to list the route tables to which a resource attachment propagates routes.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetTransitGatewayAttachmentPropagations.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetTransitGatewayAttachmentPropagations", []))

    @jsii.member(jsii_name="toGetTransitGatewayMulticastDomainAssociations")
    def to_get_transit_gateway_multicast_domain_associations(self) -> "Ec2":
        '''(experimental) Grants permission to get information about the associations for a transit gateway multicast domain.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetTransitGatewayMulticastDomainAssociations.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetTransitGatewayMulticastDomainAssociations", []))

    @jsii.member(jsii_name="toGetTransitGatewayPrefixListReferences")
    def to_get_transit_gateway_prefix_list_references(self) -> "Ec2":
        '''(experimental) Grants permission to get information about prefix list references for a transit gateway route table.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetTransitGatewayPrefixListReference.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetTransitGatewayPrefixListReferences", []))

    @jsii.member(jsii_name="toGetTransitGatewayRouteTableAssociations")
    def to_get_transit_gateway_route_table_associations(self) -> "Ec2":
        '''(experimental) Grants permission to get information about associations for a transit gateway route table.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetTransitGatewayRouteTableAssociations.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetTransitGatewayRouteTableAssociations", []))

    @jsii.member(jsii_name="toGetTransitGatewayRouteTablePropagations")
    def to_get_transit_gateway_route_table_propagations(self) -> "Ec2":
        '''(experimental) Grants permission to get information about the route table propagations for a transit gateway route table.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetTransitGatewayRouteTablePropagations.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetTransitGatewayRouteTablePropagations", []))

    @jsii.member(jsii_name="toImportClientVpnClientCertificateRevocationList")
    def to_import_client_vpn_client_certificate_revocation_list(self) -> "Ec2":
        '''(experimental) Grants permission to upload a client certificate revocation list to a Client VPN endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ImportClientVpnClientCertificateRevocationList.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toImportClientVpnClientCertificateRevocationList", []))

    @jsii.member(jsii_name="toImportImage")
    def to_import_image(self) -> "Ec2":
        '''(experimental) Grants permission to import single or multi-volume disk images or EBS snapshots into an Amazon Machine Image (AMI).

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ImportImage.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toImportImage", []))

    @jsii.member(jsii_name="toImportInstance")
    def to_import_instance(self) -> "Ec2":
        '''(experimental) Grants permission to create an import instance task using metadata from a disk image.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ImportInstance.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toImportInstance", []))

    @jsii.member(jsii_name="toImportKeyPair")
    def to_import_key_pair(self) -> "Ec2":
        '''(experimental) Grants permission to import a public key from an RSA key pair that was created with a third-party tool.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ImportKeyPair.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toImportKeyPair", []))

    @jsii.member(jsii_name="toImportSnapshot")
    def to_import_snapshot(self) -> "Ec2":
        '''(experimental) Grants permission to import a disk into an EBS snapshot.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ImportSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toImportSnapshot", []))

    @jsii.member(jsii_name="toImportVolume")
    def to_import_volume(self) -> "Ec2":
        '''(experimental) Grants permission to create an import volume task using metadata from a disk image.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ImportVolume.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toImportVolume", []))

    @jsii.member(jsii_name="toModifyAddressAttribute")
    def to_modify_address_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to modify an attribute of the specified Elastic IP address.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyAddressAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyAddressAttribute", []))

    @jsii.member(jsii_name="toModifyAvailabilityZoneGroup")
    def to_modify_availability_zone_group(self) -> "Ec2":
        '''(experimental) Grants permission to modify the opt-in status of the Local Zone and Wavelength Zone group for your account.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyAvailabilityZoneGroup.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyAvailabilityZoneGroup", []))

    @jsii.member(jsii_name="toModifyCapacityReservation")
    def to_modify_capacity_reservation(self) -> "Ec2":
        '''(experimental) Grants permission to modify a Capacity Reservation's capacity and the conditions under which it is to be released.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyCapacityReservation.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyCapacityReservation", []))

    @jsii.member(jsii_name="toModifyClientVpnEndpoint")
    def to_modify_client_vpn_endpoint(self) -> "Ec2":
        '''(experimental) Grants permission to modify a Client VPN endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyClientVpnEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyClientVpnEndpoint", []))

    @jsii.member(jsii_name="toModifyDefaultCreditSpecification")
    def to_modify_default_credit_specification(self) -> "Ec2":
        '''(experimental) Grants permission to change the account level default credit option for CPU usage of burstable performance instances.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyDefaultCreditSpecification.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyDefaultCreditSpecification", []))

    @jsii.member(jsii_name="toModifyEbsDefaultKmsKeyId")
    def to_modify_ebs_default_kms_key_id(self) -> "Ec2":
        '''(experimental) Grants permission to change the default customer master key (CMK) for EBS encryption by default for your account.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyEbsDefaultKmsKeyId.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyEbsDefaultKmsKeyId", []))

    @jsii.member(jsii_name="toModifyFleet")
    def to_modify_fleet(self) -> "Ec2":
        '''(experimental) Grants permission to modify an EC2 Fleet.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyFleet.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyFleet", []))

    @jsii.member(jsii_name="toModifyFpgaImageAttribute")
    def to_modify_fpga_image_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to modify an attribute of an Amazon FPGA Image (AFI).

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyFpgaImageAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyFpgaImageAttribute", []))

    @jsii.member(jsii_name="toModifyHosts")
    def to_modify_hosts(self) -> "Ec2":
        '''(experimental) Grants permission to modify a Dedicated Host.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyHosts.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyHosts", []))

    @jsii.member(jsii_name="toModifyIdentityIdFormat")
    def to_modify_identity_id_format(self) -> "Ec2":
        '''(experimental) Grants permission to modify the ID format of a resource for a specific principal in your account.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyIdentityIdFormat.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyIdentityIdFormat", []))

    @jsii.member(jsii_name="toModifyIdFormat")
    def to_modify_id_format(self) -> "Ec2":
        '''(experimental) Grants permission to modify the ID format for a resource.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyIdFormat.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyIdFormat", []))

    @jsii.member(jsii_name="toModifyImageAttribute")
    def to_modify_image_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to modify an attribute of an Amazon Machine Image (AMI).

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyImageAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyImageAttribute", []))

    @jsii.member(jsii_name="toModifyInstanceAttribute")
    def to_modify_instance_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to modify an attribute of an instance.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyInstanceAttribute", []))

    @jsii.member(jsii_name="toModifyInstanceCapacityReservationAttributes")
    def to_modify_instance_capacity_reservation_attributes(self) -> "Ec2":
        '''(experimental) Grants permission to modify the Capacity Reservation settings for a stopped instance.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceCapacityReservationAttributes.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyInstanceCapacityReservationAttributes", []))

    @jsii.member(jsii_name="toModifyInstanceCreditSpecification")
    def to_modify_instance_credit_specification(self) -> "Ec2":
        '''(experimental) Grants permission to modify the credit option for CPU usage on an instance.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceCreditSpecification.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyInstanceCreditSpecification", []))

    @jsii.member(jsii_name="toModifyInstanceEventStartTime")
    def to_modify_instance_event_start_time(self) -> "Ec2":
        '''(experimental) Grants permission to modify the start time for a scheduled EC2 instance event.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceEventStartTime.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyInstanceEventStartTime", []))

    @jsii.member(jsii_name="toModifyInstanceMetadataOptions")
    def to_modify_instance_metadata_options(self) -> "Ec2":
        '''(experimental) Grants permission to modify the metadata options for an instance.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyInstanceMetadataOptions", []))

    @jsii.member(jsii_name="toModifyInstancePlacement")
    def to_modify_instance_placement(self) -> "Ec2":
        '''(experimental) Grants permission to modify the placement attributes for an instance.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstancePlacement.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyInstancePlacement", []))

    @jsii.member(jsii_name="toModifyLaunchTemplate")
    def to_modify_launch_template(self) -> "Ec2":
        '''(experimental) Grants permission to modify a launch template.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyLaunchTemplate.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyLaunchTemplate", []))

    @jsii.member(jsii_name="toModifyManagedPrefixList")
    def to_modify_managed_prefix_list(self) -> "Ec2":
        '''(experimental) Grants permission to modify a managed prefix list.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyManagedPrefixList.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyManagedPrefixList", []))

    @jsii.member(jsii_name="toModifyNetworkInterfaceAttribute")
    def to_modify_network_interface_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to modify an attribute of a network interface.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyNetworkInterfaceAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyNetworkInterfaceAttribute", []))

    @jsii.member(jsii_name="toModifyReservedInstances")
    def to_modify_reserved_instances(self) -> "Ec2":
        '''(experimental) Grants permission to modify attributes of one or more Reserved Instances.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyReservedInstances.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyReservedInstances", []))

    @jsii.member(jsii_name="toModifySnapshotAttribute")
    def to_modify_snapshot_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to add or remove permission settings for a snapshot.

        Access Level: Permissions management

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifySnapshotAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifySnapshotAttribute", []))

    @jsii.member(jsii_name="toModifySpotFleetRequest")
    def to_modify_spot_fleet_request(self) -> "Ec2":
        '''(experimental) Grants permission to modify a Spot Fleet request.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifySpotFleetRequest.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifySpotFleetRequest", []))

    @jsii.member(jsii_name="toModifySubnetAttribute")
    def to_modify_subnet_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to modify an attribute of a subnet.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifySubnetAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifySubnetAttribute", []))

    @jsii.member(jsii_name="toModifyTrafficMirrorFilterNetworkServices")
    def to_modify_traffic_mirror_filter_network_services(self) -> "Ec2":
        '''(experimental) Grants permission to allow or restrict mirroring network services.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyTrafficMirrorFilterNetworkServices.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyTrafficMirrorFilterNetworkServices", []))

    @jsii.member(jsii_name="toModifyTrafficMirrorFilterRule")
    def to_modify_traffic_mirror_filter_rule(self) -> "Ec2":
        '''(experimental) Grants permission to modify a traffic mirror rule.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyTrafficMirrorFilterRule.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyTrafficMirrorFilterRule", []))

    @jsii.member(jsii_name="toModifyTrafficMirrorSession")
    def to_modify_traffic_mirror_session(self) -> "Ec2":
        '''(experimental) Grants permission to modify a traffic mirror session.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyTrafficMirrorSession.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyTrafficMirrorSession", []))

    @jsii.member(jsii_name="toModifyTransitGateway")
    def to_modify_transit_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to modify a transit gateway.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyTransitGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyTransitGateway", []))

    @jsii.member(jsii_name="toModifyTransitGatewayPrefixListReference")
    def to_modify_transit_gateway_prefix_list_reference(self) -> "Ec2":
        '''(experimental) Grants permission to modify a transit gateway prefix list reference.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyTransitGatewayPrefixListReference.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyTransitGatewayPrefixListReference", []))

    @jsii.member(jsii_name="toModifyTransitGatewayVpcAttachment")
    def to_modify_transit_gateway_vpc_attachment(self) -> "Ec2":
        '''(experimental) Grants permission to modify a VPC attachment on a transit gateway.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyTransitGatewayVpcAttachment.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyTransitGatewayVpcAttachment", []))

    @jsii.member(jsii_name="toModifyVolume")
    def to_modify_volume(self) -> "Ec2":
        '''(experimental) Grants permission to modify the parameters of an EBS volume.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyVolume.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyVolume", []))

    @jsii.member(jsii_name="toModifyVolumeAttribute")
    def to_modify_volume_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to modify an attribute of a volume.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyVolumeAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyVolumeAttribute", []))

    @jsii.member(jsii_name="toModifyVpcAttribute")
    def to_modify_vpc_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to modify an attribute of a VPC.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyVpcAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyVpcAttribute", []))

    @jsii.member(jsii_name="toModifyVpcEndpoint")
    def to_modify_vpc_endpoint(self) -> "Ec2":
        '''(experimental) Grants permission to modify an attribute of a VPC endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyVpcEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyVpcEndpoint", []))

    @jsii.member(jsii_name="toModifyVpcEndpointConnectionNotification")
    def to_modify_vpc_endpoint_connection_notification(self) -> "Ec2":
        '''(experimental) Grants permission to modify a connection notification for a VPC endpoint or VPC endpoint service.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyVpcEndpointConnectionNotification.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyVpcEndpointConnectionNotification", []))

    @jsii.member(jsii_name="toModifyVpcEndpointServiceConfiguration")
    def to_modify_vpc_endpoint_service_configuration(self) -> "Ec2":
        '''(experimental) Grants permission to modify the attributes of a VPC endpoint service configuration.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyVpcEndpointServiceConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyVpcEndpointServiceConfiguration", []))

    @jsii.member(jsii_name="toModifyVpcEndpointServicePermissions")
    def to_modify_vpc_endpoint_service_permissions(self) -> "Ec2":
        '''(experimental) Grants permission to modify the permissions for a VPC endpoint service.

        Access Level: Permissions management

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyVpcEndpointServicePermissions.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyVpcEndpointServicePermissions", []))

    @jsii.member(jsii_name="toModifyVpcPeeringConnectionOptions")
    def to_modify_vpc_peering_connection_options(self) -> "Ec2":
        '''(experimental) Grants permission to modify the VPC peering connection options on one side of a VPC peering connection.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyVpcPeeringConnectionOptions.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyVpcPeeringConnectionOptions", []))

    @jsii.member(jsii_name="toModifyVpcTenancy")
    def to_modify_vpc_tenancy(self) -> "Ec2":
        '''(experimental) Grants permission to modify the instance tenancy attribute of a VPC.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyVpcTenancy.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyVpcTenancy", []))

    @jsii.member(jsii_name="toModifyVpnConnection")
    def to_modify_vpn_connection(self) -> "Ec2":
        '''(experimental) Grants permission to modify the target gateway of a Site-to-Site VPN connection.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyVpnConnection.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyVpnConnection", []))

    @jsii.member(jsii_name="toModifyVpnConnectionOptions")
    def to_modify_vpn_connection_options(self) -> "Ec2":
        '''(experimental) Grants permission to modify the connection options for your Site-to-Site VPN connection.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyVpnConnectionOptions.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyVpnConnectionOptions", []))

    @jsii.member(jsii_name="toModifyVpnTunnelCertificate")
    def to_modify_vpn_tunnel_certificate(self) -> "Ec2":
        '''(experimental) Grants permission to modify the certificate for a Site-to-Site VPN connection.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyVpnTunnelCertificate

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyVpnTunnelCertificate", []))

    @jsii.member(jsii_name="toModifyVpnTunnelOptions")
    def to_modify_vpn_tunnel_options(self) -> "Ec2":
        '''(experimental) Grants permission to modify the options for a Site-to-Site VPN connection.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyVpnTunnelOptions.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyVpnTunnelOptions", []))

    @jsii.member(jsii_name="toMonitorInstances")
    def to_monitor_instances(self) -> "Ec2":
        '''(experimental) Grants permission to enable detailed monitoring for a running instance.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_MonitorInstances.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toMonitorInstances", []))

    @jsii.member(jsii_name="toMoveAddressToVpc")
    def to_move_address_to_vpc(self) -> "Ec2":
        '''(experimental) Grants permission to move an Elastic IP address from the EC2-Classic platform to the EC2-VPC platform.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_MoveAddressToVpc.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toMoveAddressToVpc", []))

    @jsii.member(jsii_name="toProvisionByoipCidr")
    def to_provision_byoip_cidr(self) -> "Ec2":
        '''(experimental) Grants permission to provision an address range for use in AWS through bring your own IP addresses (BYOIP), and to create a corresponding address pool.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ProvisionByoipCidr.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toProvisionByoipCidr", []))

    @jsii.member(jsii_name="toPurchaseHostReservation")
    def to_purchase_host_reservation(self) -> "Ec2":
        '''(experimental) Grants permission to purchase a reservation with configurations that match those of a Dedicated Host.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_PurchaseHostReservation.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toPurchaseHostReservation", []))

    @jsii.member(jsii_name="toPurchaseReservedInstancesOffering")
    def to_purchase_reserved_instances_offering(self) -> "Ec2":
        '''(experimental) Grants permission to purchase a Reserved Instance offering.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_PurchaseReservedInstancesOffering.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toPurchaseReservedInstancesOffering", []))

    @jsii.member(jsii_name="toPurchaseScheduledInstances")
    def to_purchase_scheduled_instances(self) -> "Ec2":
        '''(experimental) Grants permission to purchase one or more Scheduled Instances with a specified schedule.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_PurchaseScheduledInstances.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toPurchaseScheduledInstances", []))

    @jsii.member(jsii_name="toRebootInstances")
    def to_reboot_instances(self) -> "Ec2":
        '''(experimental) Grants permission to request a reboot of one or more instances.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RebootInstances.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRebootInstances", []))

    @jsii.member(jsii_name="toRegisterImage")
    def to_register_image(self) -> "Ec2":
        '''(experimental) Grants permission to register an Amazon Machine Image (AMI).

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RegisterImage.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRegisterImage", []))

    @jsii.member(jsii_name="toRegisterInstanceEventNotificationAttributes")
    def to_register_instance_event_notification_attributes(self) -> "Ec2":
        '''(experimental) Grants permission to add tags to the set of tags to include in notifications about scheduled events for your instances.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RegisterInstanceEventNotificationAttributes.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRegisterInstanceEventNotificationAttributes", []))

    @jsii.member(jsii_name="toRegisterTransitGatewayMulticastGroupMembers")
    def to_register_transit_gateway_multicast_group_members(self) -> "Ec2":
        '''(experimental) Grants permission to register one or more network interfaces as a member of a group IP address in a transit gateway multicast domain.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RegisterTransitGatewayMulticastGroupMembers.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRegisterTransitGatewayMulticastGroupMembers", []))

    @jsii.member(jsii_name="toRegisterTransitGatewayMulticastGroupSources")
    def to_register_transit_gateway_multicast_group_sources(self) -> "Ec2":
        '''(experimental) Grants permission to register one or more network interfaces as a source of a group IP address in a transit gateway multicast domain.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RegisterTransitGatewayMulticastGroupSources.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRegisterTransitGatewayMulticastGroupSources", []))

    @jsii.member(jsii_name="toRejectTransitGatewayMulticastDomainAssociations")
    def to_reject_transit_gateway_multicast_domain_associations(self) -> "Ec2":
        '''(experimental) Grants permission to reject requests to associate cross-account subnets with a transit gateway multicast domain.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RejectTransitGatewayMulticastDomainAssociations.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRejectTransitGatewayMulticastDomainAssociations", []))

    @jsii.member(jsii_name="toRejectTransitGatewayPeeringAttachment")
    def to_reject_transit_gateway_peering_attachment(self) -> "Ec2":
        '''(experimental) Grants permission to reject a transit gateway peering attachment request.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RejectTransitGatewayPeeringAttachment.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRejectTransitGatewayPeeringAttachment", []))

    @jsii.member(jsii_name="toRejectTransitGatewayVpcAttachment")
    def to_reject_transit_gateway_vpc_attachment(self) -> "Ec2":
        '''(experimental) Grants permission to reject a request to attach a VPC to a transit gateway.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RejectTransitGatewayVpcAttachment.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRejectTransitGatewayVpcAttachment", []))

    @jsii.member(jsii_name="toRejectVpcEndpointConnections")
    def to_reject_vpc_endpoint_connections(self) -> "Ec2":
        '''(experimental) Grants permission to reject one or more VPC endpoint connection requests to a VPC endpoint service.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RejectVpcEndpointConnections.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRejectVpcEndpointConnections", []))

    @jsii.member(jsii_name="toRejectVpcPeeringConnection")
    def to_reject_vpc_peering_connection(self) -> "Ec2":
        '''(experimental) Grants permission to reject a VPC peering connection request.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RejectVpcPeeringConnection.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRejectVpcPeeringConnection", []))

    @jsii.member(jsii_name="toReleaseAddress")
    def to_release_address(self) -> "Ec2":
        '''(experimental) Grants permission to release an Elastic IP address.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ReleaseAddress.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toReleaseAddress", []))

    @jsii.member(jsii_name="toReleaseHosts")
    def to_release_hosts(self) -> "Ec2":
        '''(experimental) Grants permission to release one or more On-Demand Dedicated Hosts.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ReleaseHosts.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toReleaseHosts", []))

    @jsii.member(jsii_name="toReplaceIamInstanceProfileAssociation")
    def to_replace_iam_instance_profile_association(self) -> "Ec2":
        '''(experimental) Grants permission to replace an IAM instance profile for an instance.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ReplaceIamInstanceProfileAssociation.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toReplaceIamInstanceProfileAssociation", []))

    @jsii.member(jsii_name="toReplaceNetworkAclAssociation")
    def to_replace_network_acl_association(self) -> "Ec2":
        '''(experimental) Grants permission to change which network ACL a subnet is associated with.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ReplaceNetworkAclAssociation.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toReplaceNetworkAclAssociation", []))

    @jsii.member(jsii_name="toReplaceNetworkAclEntry")
    def to_replace_network_acl_entry(self) -> "Ec2":
        '''(experimental) Grants permission to replace an entry (rule) in a network ACL.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ReplaceNetworkAclEntry.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toReplaceNetworkAclEntry", []))

    @jsii.member(jsii_name="toReplaceRoute")
    def to_replace_route(self) -> "Ec2":
        '''(experimental) Grants permission to replace a route within a route table in a VPC.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ReplaceRoute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toReplaceRoute", []))

    @jsii.member(jsii_name="toReplaceRouteTableAssociation")
    def to_replace_route_table_association(self) -> "Ec2":
        '''(experimental) Grants permission to change the route table that is associated with a subnet.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ReplaceRouteTableAssociation.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toReplaceRouteTableAssociation", []))

    @jsii.member(jsii_name="toReplaceTransitGatewayRoute")
    def to_replace_transit_gateway_route(self) -> "Ec2":
        '''(experimental) Grants permission to replace a route in a transit gateway route table.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ReplaceTransitGatewayRoute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toReplaceTransitGatewayRoute", []))

    @jsii.member(jsii_name="toReportInstanceStatus")
    def to_report_instance_status(self) -> "Ec2":
        '''(experimental) Grants permission to submit feedback about the status of an instance.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ReportInstanceStatus.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toReportInstanceStatus", []))

    @jsii.member(jsii_name="toRequestSpotFleet")
    def to_request_spot_fleet(self) -> "Ec2":
        '''(experimental) Grants permission to create a Spot Fleet request.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RequestSpotFleet.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRequestSpotFleet", []))

    @jsii.member(jsii_name="toRequestSpotInstances")
    def to_request_spot_instances(self) -> "Ec2":
        '''(experimental) Grants permission to create a Spot Instance request.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RequestSpotInstances.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRequestSpotInstances", []))

    @jsii.member(jsii_name="toResetAddressAttribute")
    def to_reset_address_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to reset the attribute of the specified IP address.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ResetAddressAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toResetAddressAttribute", []))

    @jsii.member(jsii_name="toResetEbsDefaultKmsKeyId")
    def to_reset_ebs_default_kms_key_id(self) -> "Ec2":
        '''(experimental) Grants permission to reset the default customer master key (CMK) for EBS encryption for your account to use the AWS-managed CMK for EBS.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ResetEbsDefaultKmsKeyId.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toResetEbsDefaultKmsKeyId", []))

    @jsii.member(jsii_name="toResetFpgaImageAttribute")
    def to_reset_fpga_image_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to reset an attribute of an Amazon FPGA Image (AFI) to its default value.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ResetFpgaImageAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toResetFpgaImageAttribute", []))

    @jsii.member(jsii_name="toResetImageAttribute")
    def to_reset_image_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to reset an attribute of an Amazon Machine Image (AMI) to its default value.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ResetImageAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toResetImageAttribute", []))

    @jsii.member(jsii_name="toResetInstanceAttribute")
    def to_reset_instance_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to reset an attribute of an instance to its default value.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ResetInstanceAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toResetInstanceAttribute", []))

    @jsii.member(jsii_name="toResetNetworkInterfaceAttribute")
    def to_reset_network_interface_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to reset an attribute of a network interface.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ResetNetworkInterfaceAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toResetNetworkInterfaceAttribute", []))

    @jsii.member(jsii_name="toResetSnapshotAttribute")
    def to_reset_snapshot_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to reset permission settings for a snapshot.

        Access Level: Permissions management

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ResetSnapshotAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toResetSnapshotAttribute", []))

    @jsii.member(jsii_name="toRestoreAddressToClassic")
    def to_restore_address_to_classic(self) -> "Ec2":
        '''(experimental) Grants permission to restore an Elastic IP address that was previously moved to the EC2-VPC platform back to the EC2-Classic platform.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RestoreAddressToClassic.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRestoreAddressToClassic", []))

    @jsii.member(jsii_name="toRestoreManagedPrefixListVersion")
    def to_restore_managed_prefix_list_version(self) -> "Ec2":
        '''(experimental) Grants permission to restore the entries from a previous version of a managed prefix list to a new version of the prefix list.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RestoreManagedPrefixListVersion.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRestoreManagedPrefixListVersion", []))

    @jsii.member(jsii_name="toRevokeClientVpnIngress")
    def to_revoke_client_vpn_ingress(self) -> "Ec2":
        '''(experimental) Grants permission to remove an inbound authorization rule from a Client VPN endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RevokeClientVpnIngress.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRevokeClientVpnIngress", []))

    @jsii.member(jsii_name="toRevokeSecurityGroupEgress")
    def to_revoke_security_group_egress(self) -> "Ec2":
        '''(experimental) Grants permission to remove one or more outbound rules from a VPC security group.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RevokeSecurityGroupEgress.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRevokeSecurityGroupEgress", []))

    @jsii.member(jsii_name="toRevokeSecurityGroupIngress")
    def to_revoke_security_group_ingress(self) -> "Ec2":
        '''(experimental) Grants permission to remove one or more inbound rules from a security group.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RevokeSecurityGroupIngress.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRevokeSecurityGroupIngress", []))

    @jsii.member(jsii_name="toRunInstances")
    def to_run_instances(self) -> "Ec2":
        '''(experimental) Grants permission to launch one or more instances.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRunInstances", []))

    @jsii.member(jsii_name="toRunScheduledInstances")
    def to_run_scheduled_instances(self) -> "Ec2":
        '''(experimental) Grants permission to launch one or more Scheduled Instances.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunScheduledInstances.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRunScheduledInstances", []))

    @jsii.member(jsii_name="toSearchLocalGatewayRoutes")
    def to_search_local_gateway_routes(self) -> "Ec2":
        '''(experimental) Grants permission to search for routes in a local gateway route table.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_SearchLocalGatewayRoutes.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toSearchLocalGatewayRoutes", []))

    @jsii.member(jsii_name="toSearchTransitGatewayMulticastGroups")
    def to_search_transit_gateway_multicast_groups(self) -> "Ec2":
        '''(experimental) Grants permission to search for groups, sources, and members in a transit gateway multicast domain.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_SearchTransitGatewayMulticastGroups.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toSearchTransitGatewayMulticastGroups", []))

    @jsii.member(jsii_name="toSearchTransitGatewayRoutes")
    def to_search_transit_gateway_routes(self) -> "Ec2":
        '''(experimental) Grants permission to search for routes in a transit gateway route table.

        Access Level: List

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_SearchTransitGatewayRoutes.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toSearchTransitGatewayRoutes", []))

    @jsii.member(jsii_name="toSendDiagnosticInterrupt")
    def to_send_diagnostic_interrupt(self) -> "Ec2":
        '''(experimental) Grants permission to send a diagnostic interrupt to an Amazon EC2 instance.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_SendDiagnosticInterrupt.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toSendDiagnosticInterrupt", []))

    @jsii.member(jsii_name="toStartInstances")
    def to_start_instances(self) -> "Ec2":
        '''(experimental) Grants permission to start a stopped instance.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_StartInstances.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toStartInstances", []))

    @jsii.member(jsii_name="toStartNetworkInsightsAnalysis")
    def to_start_network_insights_analysis(self) -> "Ec2":
        '''(experimental) Grants permission to start analyzing a specified path.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_StartNetworkInsightsAnalysis.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toStartNetworkInsightsAnalysis", []))

    @jsii.member(jsii_name="toStartVpcEndpointServicePrivateDnsVerification")
    def to_start_vpc_endpoint_service_private_dns_verification(self) -> "Ec2":
        '''(experimental) Grants permission to start the private DNS verification process for a VPC endpoint service.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_StartVpcEndpointServicePrivateDnsVerification.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toStartVpcEndpointServicePrivateDnsVerification", []))

    @jsii.member(jsii_name="toStopInstances")
    def to_stop_instances(self) -> "Ec2":
        '''(experimental) Grants permission to stop an Amazon EBS-backed instance.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_StopInstances.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toStopInstances", []))

    @jsii.member(jsii_name="toTerminateClientVpnConnections")
    def to_terminate_client_vpn_connections(self) -> "Ec2":
        '''(experimental) Grants permission to terminate active Client VPN endpoint connections.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_TerminateClientVpnConnections.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toTerminateClientVpnConnections", []))

    @jsii.member(jsii_name="toTerminateInstances")
    def to_terminate_instances(self) -> "Ec2":
        '''(experimental) Grants permission to shut down one or more instances.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_TerminateInstances.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toTerminateInstances", []))

    @jsii.member(jsii_name="toUnassignIpv6Addresses")
    def to_unassign_ipv6_addresses(self) -> "Ec2":
        '''(experimental) Grants permission to unassign one or more IPv6 addresses from a network interface.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_UnassignIpv6Addresses.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toUnassignIpv6Addresses", []))

    @jsii.member(jsii_name="toUnassignPrivateIpAddresses")
    def to_unassign_private_ip_addresses(self) -> "Ec2":
        '''(experimental) Grants permission to unassign one or more secondary private IP addresses from a network interface.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_UnassignPrivateIpAddresses.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toUnassignPrivateIpAddresses", []))

    @jsii.member(jsii_name="toUnmonitorInstances")
    def to_unmonitor_instances(self) -> "Ec2":
        '''(experimental) Grants permission to disable detailed monitoring for a running instance.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_UnmonitorInstances.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toUnmonitorInstances", []))

    @jsii.member(jsii_name="toUpdateSecurityGroupRuleDescriptionsEgress")
    def to_update_security_group_rule_descriptions_egress(self) -> "Ec2":
        '''(experimental) Grants permission to update descriptions for one or more outbound rules in a VPC security group.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_UpdateSecurityGroupRuleDescriptionsEgress.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toUpdateSecurityGroupRuleDescriptionsEgress", []))

    @jsii.member(jsii_name="toUpdateSecurityGroupRuleDescriptionsIngress")
    def to_update_security_group_rule_descriptions_ingress(self) -> "Ec2":
        '''(experimental) Grants permission to update descriptions for one or more inbound rules in a security group.

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_UpdateSecurityGroupRuleDescriptionsIngress.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toUpdateSecurityGroupRuleDescriptionsIngress", []))

    @jsii.member(jsii_name="toWithdrawByoipCidr")
    def to_withdraw_byoip_cidr(self) -> "Ec2":
        '''(experimental) Grants permission to stop advertising an address range that was provisioned for use in AWS through bring your own IP addresses (BYOIP).

        Access Level: Write

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_WithdrawByoipCidr.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toWithdrawByoipCidr", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Ec2InstanceConnect(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Ec2InstanceConnect",
):
    '''(experimental) Statement provider for service `ec2-instance-connect <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2instanceconnect.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `ec2-instance-connect <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2instanceconnect.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Ec2InstanceConnect, self, [sid])

    @jsii.member(jsii_name="ifEc2Osuser")
    def if_ec2_osuser(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2InstanceConnect":
        '''(experimental) Filters access by specifying the default user name for the AMI that you used to launch your instance.

        https://docs.aws.amazon.com/ec2-instance-connect/latest/APIReference/API_SendSSHPublicKey.html

        Applies to actions:

        - .toSendSSHPublicKey()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2InstanceConnect", jsii.invoke(self, "ifEc2Osuser", [value, operator]))

    @jsii.member(jsii_name="ifEc2ResourceTag")
    def if_ec2_resource_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2InstanceConnect":
        '''(experimental) Filters access based on the tags associated with the resource.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourcetag

        Applies to resource types:

        - instance

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ec2InstanceConnect", jsii.invoke(self, "ifEc2ResourceTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="onInstance")
    def on_instance(
        self,
        instance_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2InstanceConnect":
        '''(experimental) Adds a resource of type instance to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#EC2_ARN_Format

        :param instance_id: - Identifier for the instanceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifEc2ResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ec2InstanceConnect", jsii.invoke(self, "onInstance", [instance_id, account, region, partition]))

    @jsii.member(jsii_name="toSendSerialConsoleSSHPublicKey")
    def to_send_serial_console_ssh_public_key(self) -> "Ec2InstanceConnect":
        '''(experimental) Grants access to push an SSH public key to the specified EC2 instance to be used for serial console SSH.

        Access Level: Write

        https://docs.aws.amazon.com/ec2-instance-connect/latest/APIReference/API_SendSerialConsoleSSHPublicKey.html

        :stability: experimental
        '''
        return typing.cast("Ec2InstanceConnect", jsii.invoke(self, "toSendSerialConsoleSSHPublicKey", []))

    @jsii.member(jsii_name="toSendSSHPublicKey")
    def to_send_ssh_public_key(self) -> "Ec2InstanceConnect":
        '''(experimental) Grants access to push an SSH public key to the specified EC2 instance to be used for standard SSH.

        Access Level: Write

        Possible conditions:

        - .ifEc2Osuser()

        https://docs.aws.amazon.com/ec2-instance-connect/latest/APIReference/API_SendSSHPublicKey.html

        :stability: experimental
        '''
        return typing.cast("Ec2InstanceConnect", jsii.invoke(self, "toSendSSHPublicKey", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Ec2messages(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Ec2messages",
):
    '''(experimental) Statement provider for service `ec2messages <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmessagedeliveryservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `ec2messages <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmessagedeliveryservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Ec2messages, self, [sid])

    @jsii.member(jsii_name="toAcknowledgeMessage")
    def to_acknowledge_message(self) -> "Ec2messages":
        '''(experimental) Grants permission to acknowledge a message, ensuring it will not be delivered again.

        Access Level: Write

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmessagedeliveryservice.html

        :stability: experimental
        '''
        return typing.cast("Ec2messages", jsii.invoke(self, "toAcknowledgeMessage", []))

    @jsii.member(jsii_name="toDeleteMessage")
    def to_delete_message(self) -> "Ec2messages":
        '''(experimental) Grants permission to delete a message.

        Access Level: Write

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmessagedeliveryservice.html

        :stability: experimental
        '''
        return typing.cast("Ec2messages", jsii.invoke(self, "toDeleteMessage", []))

    @jsii.member(jsii_name="toFailMessage")
    def to_fail_message(self) -> "Ec2messages":
        '''(experimental) Grants permission to fail a message, signifying the message could not be processed successfully, ensuring it cannot be replied to or delivered again.

        Access Level: Write

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmessagedeliveryservice.html

        :stability: experimental
        '''
        return typing.cast("Ec2messages", jsii.invoke(self, "toFailMessage", []))

    @jsii.member(jsii_name="toGetEndpoint")
    def to_get_endpoint(self) -> "Ec2messages":
        '''(experimental) Grants permission to route traffic to the correct endpoint based on the given destination for the messages.

        Access Level: Read

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmessagedeliveryservice.html

        :stability: experimental
        '''
        return typing.cast("Ec2messages", jsii.invoke(self, "toGetEndpoint", []))

    @jsii.member(jsii_name="toGetMessages")
    def to_get_messages(self) -> "Ec2messages":
        '''(experimental) Grants permission to deliver messages to clients/instances using long polling.

        Access Level: Read

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmessagedeliveryservice.html

        :stability: experimental
        '''
        return typing.cast("Ec2messages", jsii.invoke(self, "toGetMessages", []))

    @jsii.member(jsii_name="toSendReply")
    def to_send_reply(self) -> "Ec2messages":
        '''(experimental) Grants permission to send replies from clients/instances to upstream service.

        Access Level: Write

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmessagedeliveryservice.html

        :stability: experimental
        '''
        return typing.cast("Ec2messages", jsii.invoke(self, "toSendReply", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Ecr(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Ecr"):
    '''(experimental) Statement provider for service `ecr <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticcontainerregistry.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `ecr <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticcontainerregistry.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Ecr, self, [sid])

    @jsii.member(jsii_name="ifResourceTag")
    def if_resource_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ecr":
        '''(experimental) Filters actions based on tag-value associated with the resource.

        https://docs.aws.amazon.com/AmazonECR/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        Applies to resource types:

        - repository

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "ifResourceTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="onRepository")
    def on_repository(
        self,
        repository_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ecr":
        '''(experimental) Adds a resource of type repository to the statement.

        https://docs.aws.amazon.com/AmazonECR/latest/userguide/Repositories.html

        :param repository_name: - Identifier for the repositoryName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "onRepository", [repository_name, account, region, partition]))

    @jsii.member(jsii_name="toBatchCheckLayerAvailability")
    def to_batch_check_layer_availability(self) -> "Ecr":
        '''(experimental) Grants permission to check the availability of multiple image layers in a specified registry and repository.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_BatchCheckLayerAvailability.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toBatchCheckLayerAvailability", []))

    @jsii.member(jsii_name="toBatchDeleteImage")
    def to_batch_delete_image(self) -> "Ecr":
        '''(experimental) Grants permission to delete a list of specified images within a specified repository.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_BatchDeleteImage.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toBatchDeleteImage", []))

    @jsii.member(jsii_name="toBatchGetImage")
    def to_batch_get_image(self) -> "Ecr":
        '''(experimental) Grants permission to get detailed information for specified images within a specified repository.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_BatchGetImage.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toBatchGetImage", []))

    @jsii.member(jsii_name="toCompleteLayerUpload")
    def to_complete_layer_upload(self) -> "Ecr":
        '''(experimental) Grants permission to inform Amazon ECR that the image layer upload for a specified registry, repository name, and upload ID, has completed.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_CompleteLayerUpload.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toCompleteLayerUpload", []))

    @jsii.member(jsii_name="toCreateRepository")
    def to_create_repository(self) -> "Ecr":
        '''(experimental) Grants permission to create an image repository.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_CreateRepository.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toCreateRepository", []))

    @jsii.member(jsii_name="toDeleteLifecyclePolicy")
    def to_delete_lifecycle_policy(self) -> "Ecr":
        '''(experimental) Grants permission to delete the specified lifecycle policy.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_DeleteLifecyclePolicy.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toDeleteLifecyclePolicy", []))

    @jsii.member(jsii_name="toDeleteRegistryPolicy")
    def to_delete_registry_policy(self) -> "Ecr":
        '''(experimental) Grants permission to delete the registry policy.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_DeleteRegistryPolicy.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toDeleteRegistryPolicy", []))

    @jsii.member(jsii_name="toDeleteRepository")
    def to_delete_repository(self) -> "Ecr":
        '''(experimental) Grants permission to delete an existing image repository.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_DeleteRepository.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toDeleteRepository", []))

    @jsii.member(jsii_name="toDeleteRepositoryPolicy")
    def to_delete_repository_policy(self) -> "Ecr":
        '''(experimental) Grants permission to delete the repository policy from a specified repository.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_DeleteRepositoryPolicy.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toDeleteRepositoryPolicy", []))

    @jsii.member(jsii_name="toDescribeImages")
    def to_describe_images(self) -> "Ecr":
        '''(experimental) Grants permission to get metadata about the images in a repository, including image size, image tags, and creation date.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_DescribeImages.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toDescribeImages", []))

    @jsii.member(jsii_name="toDescribeImageScanFindings")
    def to_describe_image_scan_findings(self) -> "Ecr":
        '''(experimental) Grants permission to describe the image scan findings for the specified image.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_DescribeImageScanFindings.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toDescribeImageScanFindings", []))

    @jsii.member(jsii_name="toDescribeRegistry")
    def to_describe_registry(self) -> "Ecr":
        '''(experimental) Grants permission to describe the registry settings.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_DescribeRegistry.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toDescribeRegistry", []))

    @jsii.member(jsii_name="toDescribeRepositories")
    def to_describe_repositories(self) -> "Ecr":
        '''(experimental) Grants permission to describe image repositories in a registry.

        Access Level: List

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_DescribeRepositories.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toDescribeRepositories", []))

    @jsii.member(jsii_name="toGetAuthorizationToken")
    def to_get_authorization_token(self) -> "Ecr":
        '''(experimental) Grants permission to retrieve a token that is valid for a specified registry for 12 hours.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_GetAuthorizationToken.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toGetAuthorizationToken", []))

    @jsii.member(jsii_name="toGetDownloadUrlForLayer")
    def to_get_download_url_for_layer(self) -> "Ecr":
        '''(experimental) Grants permission to retrieve the download URL corresponding to an image layer.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_GetDownloadUrlForLayer.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toGetDownloadUrlForLayer", []))

    @jsii.member(jsii_name="toGetLifecyclePolicy")
    def to_get_lifecycle_policy(self) -> "Ecr":
        '''(experimental) Grants permission to retrieve the specified lifecycle policy.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_GetLifecyclePolicy.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toGetLifecyclePolicy", []))

    @jsii.member(jsii_name="toGetLifecyclePolicyPreview")
    def to_get_lifecycle_policy_preview(self) -> "Ecr":
        '''(experimental) Grants permission to retrieve the results of the specified lifecycle policy preview request.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_GetLifecyclePolicyPreview.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toGetLifecyclePolicyPreview", []))

    @jsii.member(jsii_name="toGetRegistryPolicy")
    def to_get_registry_policy(self) -> "Ecr":
        '''(experimental) Grants permission to retrieve the registry policy.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_GetRegistryPolicy.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toGetRegistryPolicy", []))

    @jsii.member(jsii_name="toGetRepositoryPolicy")
    def to_get_repository_policy(self) -> "Ecr":
        '''(experimental) Grants permission to retrieve the repository policy for a specified repository.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_GetRepositoryPolicy.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toGetRepositoryPolicy", []))

    @jsii.member(jsii_name="toInitiateLayerUpload")
    def to_initiate_layer_upload(self) -> "Ecr":
        '''(experimental) Grants permission to notify Amazon ECR that you intend to upload an image layer.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_InitiateLayerUpload.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toInitiateLayerUpload", []))

    @jsii.member(jsii_name="toListImages")
    def to_list_images(self) -> "Ecr":
        '''(experimental) Grants permission to list all the image IDs for a given repository.

        Access Level: List

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_ListImages.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toListImages", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Ecr":
        '''(experimental) Grants permission to list the tags for an Amazon ECR resource.

        Access Level: List

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutImage")
    def to_put_image(self) -> "Ecr":
        '''(experimental) Grants permission to create or update the image manifest associated with an image.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_PutImage.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toPutImage", []))

    @jsii.member(jsii_name="toPutImageScanningConfiguration")
    def to_put_image_scanning_configuration(self) -> "Ecr":
        '''(experimental) Grants permission to update the image scanning configuration for a repository.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_PutImageScanningConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toPutImageScanningConfiguration", []))

    @jsii.member(jsii_name="toPutImageTagMutability")
    def to_put_image_tag_mutability(self) -> "Ecr":
        '''(experimental) Grants permission to update the image tag mutability settings for a repository.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_PutImageTagMutability.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toPutImageTagMutability", []))

    @jsii.member(jsii_name="toPutLifecyclePolicy")
    def to_put_lifecycle_policy(self) -> "Ecr":
        '''(experimental) Grants permission to create or update a lifecycle policy.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_PutLifecyclePolicy.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toPutLifecyclePolicy", []))

    @jsii.member(jsii_name="toPutRegistryPolicy")
    def to_put_registry_policy(self) -> "Ecr":
        '''(experimental) Grants permission to update the registry policy.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_PutRegistryPolicy.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toPutRegistryPolicy", []))

    @jsii.member(jsii_name="toPutReplicationConfiguration")
    def to_put_replication_configuration(self) -> "Ecr":
        '''(experimental) Grants permission to update the replication configuration for the registry.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_PutReplicationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toPutReplicationConfiguration", []))

    @jsii.member(jsii_name="toReplicateImage")
    def to_replicate_image(self) -> "Ecr":
        '''(experimental) Grants permission to replicate images to the destination registry.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECR/latest/userguide/registry-permissions.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toReplicateImage", []))

    @jsii.member(jsii_name="toSetRepositoryPolicy")
    def to_set_repository_policy(self) -> "Ecr":
        '''(experimental) Grants permission to apply a repository policy on a specified repository to control access permissions.

        Access Level: Permissions management

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_SetRepositoryPolicy.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toSetRepositoryPolicy", []))

    @jsii.member(jsii_name="toStartImageScan")
    def to_start_image_scan(self) -> "Ecr":
        '''(experimental) Grants permission to start an image scan.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_StartImageScan.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toStartImageScan", []))

    @jsii.member(jsii_name="toStartLifecyclePolicyPreview")
    def to_start_lifecycle_policy_preview(self) -> "Ecr":
        '''(experimental) Grants permission to start a preview of the specified lifecycle policy.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_StartLifecyclePolicyPreview.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toStartLifecyclePolicyPreview", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Ecr":
        '''(experimental) Grants permission to tag an Amazon ECR resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Ecr":
        '''(experimental) Grants permission to untag an Amazon ECR resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUploadLayerPart")
    def to_upload_layer_part(self) -> "Ecr":
        '''(experimental) Grants permission to upload an image layer part to Amazon ECR.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_UploadLayerPart.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toUploadLayerPart", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class EcrPublic(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.EcrPublic",
):
    '''(experimental) Statement provider for service `ecr-public <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticcontainerregistrypublic.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `ecr-public <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticcontainerregistrypublic.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(EcrPublic, self, [sid])

    @jsii.member(jsii_name="ifResourceTag")
    def if_resource_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "EcrPublic":
        '''(experimental) Filters actions based on tag-value associated with the resource.

        https://docs.aws.amazon.com/AmazonECR/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        Applies to resource types:

        - repository

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "ifResourceTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="onRegistry")
    def on_registry(
        self,
        registry_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "EcrPublic":
        '''(experimental) Adds a resource of type registry to the statement.

        https://docs.aws.amazon.com/AmazonECR/latest/userguide/iam-policy-structure.html#ECR-Public_ARN_Format

        :param registry_id: - Identifier for the registryId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "onRegistry", [registry_id, account, partition]))

    @jsii.member(jsii_name="onRepository")
    def on_repository(
        self,
        repository_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "EcrPublic":
        '''(experimental) Adds a resource of type repository to the statement.

        https://docs.aws.amazon.com/AmazonECR/latest/userguide/iam-policy-structure.html#ECR-Public_ARN_Format

        :param repository_name: - Identifier for the repositoryName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "onRepository", [repository_name, account, partition]))

    @jsii.member(jsii_name="toBatchCheckLayerAvailability")
    def to_batch_check_layer_availability(self) -> "EcrPublic":
        '''(experimental) Grants permission to check the availability of multiple image layers in a specified registry and repository.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_BatchCheckLayerAvailability.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toBatchCheckLayerAvailability", []))

    @jsii.member(jsii_name="toBatchDeleteImage")
    def to_batch_delete_image(self) -> "EcrPublic":
        '''(experimental) Grants permission to delete a list of specified images within a specified repository.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_BatchDeleteImage.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toBatchDeleteImage", []))

    @jsii.member(jsii_name="toCompleteLayerUpload")
    def to_complete_layer_upload(self) -> "EcrPublic":
        '''(experimental) Grants permission to inform Amazon ECR that the image layer upload for a specified registry, repository name, and upload ID, has completed.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_CompleteLayerUpload.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toCompleteLayerUpload", []))

    @jsii.member(jsii_name="toCreateRepository")
    def to_create_repository(self) -> "EcrPublic":
        '''(experimental) Grants permission to create an image repository.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_CreateRepository.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toCreateRepository", []))

    @jsii.member(jsii_name="toDeleteRepository")
    def to_delete_repository(self) -> "EcrPublic":
        '''(experimental) Grants permission to delete an existing image repository.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_DeleteRepository.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toDeleteRepository", []))

    @jsii.member(jsii_name="toDeleteRepositoryPolicy")
    def to_delete_repository_policy(self) -> "EcrPublic":
        '''(experimental) Grants permission to delete the repository policy from a specified repository.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_DeleteRepositoryPolicy.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toDeleteRepositoryPolicy", []))

    @jsii.member(jsii_name="toDescribeImages")
    def to_describe_images(self) -> "EcrPublic":
        '''(experimental) Grants permission to get metadata about the images in a repository, including image size, image tags, and creation date.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_DescribeImages.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toDescribeImages", []))

    @jsii.member(jsii_name="toDescribeImageTags")
    def to_describe_image_tags(self) -> "EcrPublic":
        '''(experimental) Grants permission to describe all the image tags for a given repository.

        Access Level: List

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_DescribeImageTags.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toDescribeImageTags", []))

    @jsii.member(jsii_name="toDescribeRegistries")
    def to_describe_registries(self) -> "EcrPublic":
        '''(experimental) Grants permission to retrieve the catalog data associated with a registry.

        Access Level: List

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_DescribeRegistries.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toDescribeRegistries", []))

    @jsii.member(jsii_name="toDescribeRepositories")
    def to_describe_repositories(self) -> "EcrPublic":
        '''(experimental) Grants permission to describe image repositories in a registry.

        Access Level: List

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_DescribeRepositories.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toDescribeRepositories", []))

    @jsii.member(jsii_name="toGetAuthorizationToken")
    def to_get_authorization_token(self) -> "EcrPublic":
        '''(experimental) Grants permission to retrieve a token that is valid for a specified registry for 12 hours.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_GetAuthorizationToken.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toGetAuthorizationToken", []))

    @jsii.member(jsii_name="toGetRegistryCatalogData")
    def to_get_registry_catalog_data(self) -> "EcrPublic":
        '''(experimental) Grants permission to retrieve the catalog data associated with a registry.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_GetRegistryCatalogData.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toGetRegistryCatalogData", []))

    @jsii.member(jsii_name="toGetRepositoryCatalogData")
    def to_get_repository_catalog_data(self) -> "EcrPublic":
        '''(experimental) Grants permission to retrieve the catalog data associated with a repository.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_GetRepositoryCatalogData.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toGetRepositoryCatalogData", []))

    @jsii.member(jsii_name="toGetRepositoryPolicy")
    def to_get_repository_policy(self) -> "EcrPublic":
        '''(experimental) Grants permission to retrieve the repository policy for a specified repository.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_GetRepositoryPolicy.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toGetRepositoryPolicy", []))

    @jsii.member(jsii_name="toInitiateLayerUpload")
    def to_initiate_layer_upload(self) -> "EcrPublic":
        '''(experimental) Grants permission to notify Amazon ECR that you intend to upload an image layer.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_InitiateLayerUpload.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toInitiateLayerUpload", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "EcrPublic":
        '''(experimental) Grants permission to list the tags for an Amazon ECR resource.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutImage")
    def to_put_image(self) -> "EcrPublic":
        '''(experimental) Grants permission to create or update the image manifest associated with an image.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_PutImage.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toPutImage", []))

    @jsii.member(jsii_name="toPutRegistryCatalogData")
    def to_put_registry_catalog_data(self) -> "EcrPublic":
        '''(experimental) Grants permission to create and update the catalog data associated with a registry.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_PutRegistryCatalogData.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toPutRegistryCatalogData", []))

    @jsii.member(jsii_name="toPutRepositoryCatalogData")
    def to_put_repository_catalog_data(self) -> "EcrPublic":
        '''(experimental) Grants permission to update the catalog data associated with a repository.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_PutRepositoryCatalogData.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toPutRepositoryCatalogData", []))

    @jsii.member(jsii_name="toSetRepositoryPolicy")
    def to_set_repository_policy(self) -> "EcrPublic":
        '''(experimental) Grants permission to apply a repository policy on a specified repository to control access permissions.

        Access Level: Permissions management

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_SetRepositoryPolicy.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toSetRepositoryPolicy", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "EcrPublic":
        '''(experimental) Grants permission to tag an Amazon ECR resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "EcrPublic":
        '''(experimental) Grants permission to untag an Amazon ECR resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUploadLayerPart")
    def to_upload_layer_part(self) -> "EcrPublic":
        '''(experimental) Grants permission to upload an image layer part to Amazon ECR Public.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_UploadLayerPart.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toUploadLayerPart", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Ecs(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Ecs"):
    '''(experimental) Statement provider for service `ecs <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticcontainerservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `ecs <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticcontainerservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Ecs, self, [sid])

    @jsii.member(jsii_name="ifCapacityProvider")
    def if_capacity_provider(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ecs":
        '''(experimental) The ARN of an Amazon ECS capacity provider.

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/iam-policy-structure.html#amazon-ecs-keys

        Applies to actions:

        - .toCreateCluster()
        - .toCreateService()
        - .toPutClusterCapacityProviders()
        - .toRunTask()
        - .toUpdateService()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "ifCapacityProvider", [value, operator]))

    @jsii.member(jsii_name="ifCluster")
    def if_cluster(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ecs":
        '''(experimental) The ARN of an Amazon ECS cluster.

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/iam-policy-structure.html#amazon-ecs-keys

        Applies to actions:

        - .toCreateService()
        - .toCreateTaskSet()
        - .toDeleteAttributes()
        - .toDeleteService()
        - .toDeleteTaskSet()
        - .toDescribeContainerInstances()
        - .toDescribeServices()
        - .toDescribeTaskSets()
        - .toDescribeTasks()
        - .toListServices()
        - .toListTasks()
        - .toPoll()
        - .toPutAttributes()
        - .toRunTask()
        - .toStartTask()
        - .toStartTelemetrySession()
        - .toStopTask()
        - .toUpdateContainerAgent()
        - .toUpdateContainerInstancesState()
        - .toUpdateService()
        - .toUpdateServicePrimaryTaskSet()
        - .toUpdateTaskSet()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "ifCluster", [value, operator]))

    @jsii.member(jsii_name="ifContainerInstances")
    def if_container_instances(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ecs":
        '''(experimental) The ARN of an Amazon ECS container instance.

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/iam-policy-structure.html#amazon-ecs-keys

        Applies to actions:

        - .toStartTask()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "ifContainerInstances", [value, operator]))

    @jsii.member(jsii_name="ifResourceTag")
    def if_resource_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ecs":
        '''(experimental) Filters actions based on tag key-value pairs attached to the resource.

        Applies to resource types:

        - cluster
        - container-instance
        - service
        - task
        - task-definition
        - capacity-provider
        - task-set

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "ifResourceTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifService")
    def if_service(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ecs":
        '''(experimental) The ARN of an Amazon ECS service.

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/iam-policy-structure.html#amazon-ecs-keys

        Applies to actions:

        - .toCreateTaskSet()
        - .toDeleteTaskSet()
        - .toDescribeTaskSets()
        - .toUpdateTaskSet()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "ifService", [value, operator]))

    @jsii.member(jsii_name="ifTaskDefinition")
    def if_task_definition(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ecs":
        '''(experimental) The ARN of an Amazon ECS task definition.

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/iam-policy-structure.html#amazon-ecs-keys

        Applies to actions:

        - .toCreateService()
        - .toCreateTaskSet()
        - .toUpdateService()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "ifTaskDefinition", [value, operator]))

    @jsii.member(jsii_name="onCapacityProvider")
    def on_capacity_provider(
        self,
        capacity_provider_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ecs":
        '''(experimental) Adds a resource of type capacity-provider to the statement.

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/capacity_provider_definitions.html

        :param capacity_provider_name: - Identifier for the capacityProviderName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "onCapacityProvider", [capacity_provider_name, account, region, partition]))

    @jsii.member(jsii_name="onCluster")
    def on_cluster(
        self,
        cluster_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ecs":
        '''(experimental) Adds a resource of type cluster to the statement.

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ECS_clusters.html

        :param cluster_name: - Identifier for the clusterName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "onCluster", [cluster_name, account, region, partition]))

    @jsii.member(jsii_name="onContainerInstance")
    def on_container_instance(
        self,
        container_instance_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ecs":
        '''(experimental) Adds a resource of type container-instance to the statement.

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ECS_instances.html

        :param container_instance_id: - Identifier for the containerInstanceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "onContainerInstance", [container_instance_id, account, region, partition]))

    @jsii.member(jsii_name="onService")
    def on_service(
        self,
        service_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ecs":
        '''(experimental) Adds a resource of type service to the statement.

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs_services.html

        :param service_name: - Identifier for the serviceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "onService", [service_name, account, region, partition]))

    @jsii.member(jsii_name="onTask")
    def on_task(
        self,
        task_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ecs":
        '''(experimental) Adds a resource of type task to the statement.

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/scheduling_tasks.html

        :param task_id: - Identifier for the taskId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "onTask", [task_id, account, region, partition]))

    @jsii.member(jsii_name="onTaskDefinition")
    def on_task_definition(
        self,
        task_definition_family_name: builtins.str,
        task_definition_revision_number: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ecs":
        '''(experimental) Adds a resource of type task-definition to the statement.

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definitions.html

        :param task_definition_family_name: - Identifier for the taskDefinitionFamilyName.
        :param task_definition_revision_number: - Identifier for the taskDefinitionRevisionNumber.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "onTaskDefinition", [task_definition_family_name, task_definition_revision_number, account, region, partition]))

    @jsii.member(jsii_name="onTaskSet")
    def on_task_set(
        self,
        cluster_name: builtins.str,
        service_name: builtins.str,
        task_set_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ecs":
        '''(experimental) Adds a resource of type task-set to the statement.

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_sets.html

        :param cluster_name: - Identifier for the clusterName.
        :param service_name: - Identifier for the serviceName.
        :param task_set_id: - Identifier for the taskSetId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "onTaskSet", [cluster_name, service_name, task_set_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateCapacityProvider")
    def to_create_capacity_provider(self) -> "Ecs":
        '''(experimental) Creates a new capacity provider.

        Capacity providers are associated with an Amazon ECS cluster and are used in capacity provider strategies to facilitate cluster auto scaling.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_CreateCapacityProvider.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toCreateCapacityProvider", []))

    @jsii.member(jsii_name="toCreateCluster")
    def to_create_cluster(self) -> "Ecs":
        '''(experimental) Creates a new Amazon ECS cluster.

        Access Level: Write

        Possible conditions:

        - .ifCapacityProvider()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_CreateCluster.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toCreateCluster", []))

    @jsii.member(jsii_name="toCreateService")
    def to_create_service(self) -> "Ecs":
        '''(experimental) Runs and maintains a desired number of tasks from a specified task definition.

        Access Level: Write

        Possible conditions:

        - .ifCluster()
        - .ifCapacityProvider()
        - .ifTaskDefinition()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_CreateService.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toCreateService", []))

    @jsii.member(jsii_name="toCreateTaskSet")
    def to_create_task_set(self) -> "Ecs":
        '''(experimental) Creates a new Amazon ECS task set.

        Access Level: Write

        Possible conditions:

        - .ifCluster()
        - .ifService()
        - .ifTaskDefinition()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_CreateTaskSet.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toCreateTaskSet", []))

    @jsii.member(jsii_name="toDeleteAccountSetting")
    def to_delete_account_setting(self) -> "Ecs":
        '''(experimental) Modifies the ARN and resource ID format of a resource for a specified IAM user, IAM role, or the root user for an account.

        You can specify whether the new ARN and resource ID format are disabled for new resources that are created.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DeleteAccountSetting.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toDeleteAccountSetting", []))

    @jsii.member(jsii_name="toDeleteAttributes")
    def to_delete_attributes(self) -> "Ecs":
        '''(experimental) Deletes one or more custom attributes from an Amazon ECS resource.

        Access Level: Write

        Possible conditions:

        - .ifCluster()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DeleteAttributes.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toDeleteAttributes", []))

    @jsii.member(jsii_name="toDeleteCapacityProvider")
    def to_delete_capacity_provider(self) -> "Ecs":
        '''(experimental) Deletes the specified capacity provider.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DeleteCapacityProvider.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toDeleteCapacityProvider", []))

    @jsii.member(jsii_name="toDeleteCluster")
    def to_delete_cluster(self) -> "Ecs":
        '''(experimental) Deletes the specified cluster.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DeleteCluster.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toDeleteCluster", []))

    @jsii.member(jsii_name="toDeleteService")
    def to_delete_service(self) -> "Ecs":
        '''(experimental) Deletes a specified service within a cluster.

        Access Level: Write

        Possible conditions:

        - .ifCluster()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DeleteService.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toDeleteService", []))

    @jsii.member(jsii_name="toDeleteTaskSet")
    def to_delete_task_set(self) -> "Ecs":
        '''(experimental) Deletes the specified task set.

        Access Level: Write

        Possible conditions:

        - .ifCluster()
        - .ifService()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DeleteTaskSet.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toDeleteTaskSet", []))

    @jsii.member(jsii_name="toDeregisterContainerInstance")
    def to_deregister_container_instance(self) -> "Ecs":
        '''(experimental) Deregisters an Amazon ECS container instance from the specified cluster.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DeregisterContainerInstance.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toDeregisterContainerInstance", []))

    @jsii.member(jsii_name="toDeregisterTaskDefinition")
    def to_deregister_task_definition(self) -> "Ecs":
        '''(experimental) Deregisters the specified task definition by family and revision.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DeregisterTaskDefinition.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toDeregisterTaskDefinition", []))

    @jsii.member(jsii_name="toDescribeCapacityProviders")
    def to_describe_capacity_providers(self) -> "Ecs":
        '''(experimental) Describes one or more Amazon ECS capacity providers.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DescribeCapacityProviders.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toDescribeCapacityProviders", []))

    @jsii.member(jsii_name="toDescribeClusters")
    def to_describe_clusters(self) -> "Ecs":
        '''(experimental) Describes one or more of your clusters.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DescribeClusters.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toDescribeClusters", []))

    @jsii.member(jsii_name="toDescribeContainerInstances")
    def to_describe_container_instances(self) -> "Ecs":
        '''(experimental) Describes Amazon ECS container instances.

        Access Level: Read

        Possible conditions:

        - .ifCluster()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DescribeContainerInstances.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toDescribeContainerInstances", []))

    @jsii.member(jsii_name="toDescribeServices")
    def to_describe_services(self) -> "Ecs":
        '''(experimental) Describes the specified services running in your cluster.

        Access Level: Read

        Possible conditions:

        - .ifCluster()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DescribeServices.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toDescribeServices", []))

    @jsii.member(jsii_name="toDescribeTaskDefinition")
    def to_describe_task_definition(self) -> "Ecs":
        '''(experimental) Describes a task definition.

        You can specify a family and revision to find information about a specific task definition, or you can simply specify the family to find the latest ACTIVE revision in that family.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DescribeTaskDefinition.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toDescribeTaskDefinition", []))

    @jsii.member(jsii_name="toDescribeTasks")
    def to_describe_tasks(self) -> "Ecs":
        '''(experimental) Describes a specified task or tasks.

        Access Level: Read

        Possible conditions:

        - .ifCluster()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DescribeTasks.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toDescribeTasks", []))

    @jsii.member(jsii_name="toDescribeTaskSets")
    def to_describe_task_sets(self) -> "Ecs":
        '''(experimental) Describes Amazon ECS task sets.

        Access Level: Read

        Possible conditions:

        - .ifCluster()
        - .ifService()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DescribeTaskSets.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toDescribeTaskSets", []))

    @jsii.member(jsii_name="toDiscoverPollEndpoint")
    def to_discover_poll_endpoint(self) -> "Ecs":
        '''(experimental) Returns an endpoint for the Amazon ECS agent to poll for updates.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DiscoverPollEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toDiscoverPollEndpoint", []))

    @jsii.member(jsii_name="toListAccountSettings")
    def to_list_account_settings(self) -> "Ecs":
        '''(experimental) Lists the account settings for an Amazon ECS resource for a specified principal.

        Access Level: List

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ListAccountSettings.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toListAccountSettings", []))

    @jsii.member(jsii_name="toListAttributes")
    def to_list_attributes(self) -> "Ecs":
        '''(experimental) Lists the attributes for Amazon ECS resources within a specified target type and cluster.

        Access Level: List

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ListAttributes.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toListAttributes", []))

    @jsii.member(jsii_name="toListClusters")
    def to_list_clusters(self) -> "Ecs":
        '''(experimental) Returns a list of existing clusters.

        Access Level: List

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ListClusters.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toListClusters", []))

    @jsii.member(jsii_name="toListContainerInstances")
    def to_list_container_instances(self) -> "Ecs":
        '''(experimental) Returns a list of container instances in a specified cluster.

        Access Level: List

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ListContainerInstances.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toListContainerInstances", []))

    @jsii.member(jsii_name="toListServices")
    def to_list_services(self) -> "Ecs":
        '''(experimental) Lists the services that are running in a specified cluster.

        Access Level: List

        Possible conditions:

        - .ifCluster()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ListServices.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toListServices", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Ecs":
        '''(experimental) List tags for the specified resource.

        Access Level: List

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTaskDefinitionFamilies")
    def to_list_task_definition_families(self) -> "Ecs":
        '''(experimental) Returns a list of task definition families that are registered to your account (which may include task definition families that no longer have any ACTIVE task definitions).

        Access Level: List

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ListServices.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toListTaskDefinitionFamilies", []))

    @jsii.member(jsii_name="toListTaskDefinitions")
    def to_list_task_definitions(self) -> "Ecs":
        '''(experimental) Returns a list of task definitions that are registered to your account.

        Access Level: List

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ListTaskDefinitions.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toListTaskDefinitions", []))

    @jsii.member(jsii_name="toListTasks")
    def to_list_tasks(self) -> "Ecs":
        '''(experimental) Returns a list of tasks for a specified cluster.

        Access Level: List

        Possible conditions:

        - .ifCluster()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ListTasks.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toListTasks", []))

    @jsii.member(jsii_name="toPoll")
    def to_poll(self) -> "Ecs":
        '''(experimental) Grants permission to an agent to connect with the Amazon ECS service to report status and get commands.

        Access Level: Write

        Possible conditions:

        - .ifCluster()

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/instance_IAM_role.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toPoll", []))

    @jsii.member(jsii_name="toPutAccountSetting")
    def to_put_account_setting(self) -> "Ecs":
        '''(experimental) Modifies the ARN and resource ID format of a resource for a specified IAM user, IAM role, or the root user for an account.

        You can specify whether the new ARN and resource ID format are enabled for new resources that are created. Enabling this setting is required to use new Amazon ECS features such as resource tagging.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_PutAccountSetting.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toPutAccountSetting", []))

    @jsii.member(jsii_name="toPutAccountSettingDefault")
    def to_put_account_setting_default(self) -> "Ecs":
        '''(experimental) Modifies the ARN and resource ID format of a resource type for all IAM users on an account for which no individual account setting has been set.

        Enabling this setting is required to use new Amazon ECS features such as resource tagging.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_PutAccountSettingDefault.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toPutAccountSettingDefault", []))

    @jsii.member(jsii_name="toPutAttributes")
    def to_put_attributes(self) -> "Ecs":
        '''(experimental) Create or update an attribute on an Amazon ECS resource.

        Access Level: Write

        Possible conditions:

        - .ifCluster()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_PutAttributes.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toPutAttributes", []))

    @jsii.member(jsii_name="toPutClusterCapacityProviders")
    def to_put_cluster_capacity_providers(self) -> "Ecs":
        '''(experimental) Modifies the available capacity providers and the default capacity provider strategy for a cluster.

        Access Level: Write

        Possible conditions:

        - .ifCapacityProvider()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_PutClusterCapacityProviders.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toPutClusterCapacityProviders", []))

    @jsii.member(jsii_name="toRegisterContainerInstance")
    def to_register_container_instance(self) -> "Ecs":
        '''(experimental) Registers an EC2 instance into the specified cluster.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_RegisterContainerInstance.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toRegisterContainerInstance", []))

    @jsii.member(jsii_name="toRegisterTaskDefinition")
    def to_register_task_definition(self) -> "Ecs":
        '''(experimental) Registers a new task definition from the supplied family and containerDefinitions.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_RegisterTaskDefinition.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toRegisterTaskDefinition", []))

    @jsii.member(jsii_name="toRunTask")
    def to_run_task(self) -> "Ecs":
        '''(experimental) Start a task using random placement and the default Amazon ECS scheduler.

        Access Level: Write

        Possible conditions:

        - .ifCluster()
        - .ifCapacityProvider()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_RunTask.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toRunTask", []))

    @jsii.member(jsii_name="toStartTask")
    def to_start_task(self) -> "Ecs":
        '''(experimental) Starts a new task from the specified task definition on the specified container instance or instances.

        Access Level: Write

        Possible conditions:

        - .ifCluster()
        - .ifContainerInstances()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_StartTask.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toStartTask", []))

    @jsii.member(jsii_name="toStartTelemetrySession")
    def to_start_telemetry_session(self) -> "Ecs":
        '''(experimental) Grants permission to start a telemetry session.

        Access Level: Write

        Possible conditions:

        - .ifCluster()

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/cloudwatch-metrics.html#enable_cloudwatch

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toStartTelemetrySession", []))

    @jsii.member(jsii_name="toStopTask")
    def to_stop_task(self) -> "Ecs":
        '''(experimental) Stops a running task.

        Access Level: Write

        Possible conditions:

        - .ifCluster()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_StopTask.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toStopTask", []))

    @jsii.member(jsii_name="toSubmitAttachmentStateChanges")
    def to_submit_attachment_state_changes(self) -> "Ecs":
        '''(experimental) Sent to acknowledge that attachments changed states.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_SubmitAttachmentStateChanges.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toSubmitAttachmentStateChanges", []))

    @jsii.member(jsii_name="toSubmitContainerStateChange")
    def to_submit_container_state_change(self) -> "Ecs":
        '''(experimental) Sent to acknowledge that a container changed states.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_SubmitContainerStateChange.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toSubmitContainerStateChange", []))

    @jsii.member(jsii_name="toSubmitTaskStateChange")
    def to_submit_task_state_change(self) -> "Ecs":
        '''(experimental) Sent to acknowledge that a task changed states.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_SubmitTaskStateChange.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toSubmitTaskStateChange", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Ecs":
        '''(experimental) Tags the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Ecs":
        '''(experimental) Untags the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateClusterSettings")
    def to_update_cluster_settings(self) -> "Ecs":
        '''(experimental) Modifies the settings to use for a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_UpdateClusterSettings.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toUpdateClusterSettings", []))

    @jsii.member(jsii_name="toUpdateContainerAgent")
    def to_update_container_agent(self) -> "Ecs":
        '''(experimental) Updates the Amazon ECS container agent on a specified container instance.

        Access Level: Write

        Possible conditions:

        - .ifCluster()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_UpdateContainerAgent.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toUpdateContainerAgent", []))

    @jsii.member(jsii_name="toUpdateContainerInstancesState")
    def to_update_container_instances_state(self) -> "Ecs":
        '''(experimental) Enables the user to modify the status of an Amazon ECS container instance.

        Access Level: Write

        Possible conditions:

        - .ifCluster()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_UpdateContainerInstancesState.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toUpdateContainerInstancesState", []))

    @jsii.member(jsii_name="toUpdateService")
    def to_update_service(self) -> "Ecs":
        '''(experimental) Modifies the parameters of a service.

        Access Level: Write

        Possible conditions:

        - .ifCluster()
        - .ifCapacityProvider()
        - .ifTaskDefinition()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_UpdateService.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toUpdateService", []))

    @jsii.member(jsii_name="toUpdateServicePrimaryTaskSet")
    def to_update_service_primary_task_set(self) -> "Ecs":
        '''(experimental) Modifies the primary task set used in a service.

        Access Level: Write

        Possible conditions:

        - .ifCluster()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_UpdateServicePrimaryTaskSet.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toUpdateServicePrimaryTaskSet", []))

    @jsii.member(jsii_name="toUpdateTaskSet")
    def to_update_task_set(self) -> "Ecs":
        '''(experimental) Updates the specified task set.

        Access Level: Write

        Possible conditions:

        - .ifCluster()
        - .ifService()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_UpdateTaskSet.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toUpdateTaskSet", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Eks(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Eks"):
    '''(experimental) Statement provider for service `eks <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelastickubernetesservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `eks <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelastickubernetesservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Eks, self, [sid])

    @jsii.member(jsii_name="ifClientId")
    def if_client_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Eks":
        '''(experimental) Filters access by the clientId present in the associateIdentityProviderConfig request the user makes to the EKS service.

        https://docs.aws.amazon.com/eks/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies

        Applies to actions:

        - .toAssociateIdentityProviderConfig()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "ifClientId", [value, operator]))

    @jsii.member(jsii_name="ifIssuerUrl")
    def if_issuer_url(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Eks":
        '''(experimental) Filters access by the issuerUrl present in the associateIdentityProviderConfig request the user makes to the EKS service.

        https://docs.aws.amazon.com/eks/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies

        Applies to actions:

        - .toAssociateIdentityProviderConfig()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "ifIssuerUrl", [value, operator]))

    @jsii.member(jsii_name="onAddon")
    def on_addon(
        self,
        cluster_name: builtins.str,
        addon_name: builtins.str,
        u_uid: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Eks":
        '''(experimental) Adds a resource of type addon to the statement.

        https://docs.aws.amazon.com/eks/latest/userguide/managed-addons.html

        :param cluster_name: - Identifier for the clusterName.
        :param addon_name: - Identifier for the addonName.
        :param u_uid: - Identifier for the uUID.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "onAddon", [cluster_name, addon_name, u_uid, account, region, partition]))

    @jsii.member(jsii_name="onCluster")
    def on_cluster(
        self,
        cluster_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Eks":
        '''(experimental) Adds a resource of type cluster to the statement.

        https://docs.aws.amazon.com/eks/latest/userguide/clusters.html

        :param cluster_name: - Identifier for the clusterName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "onCluster", [cluster_name, account, region, partition]))

    @jsii.member(jsii_name="onFargateprofile")
    def on_fargateprofile(
        self,
        cluster_name: builtins.str,
        fargate_profile_name: builtins.str,
        u_uid: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Eks":
        '''(experimental) Adds a resource of type fargateprofile to the statement.

        https://docs.aws.amazon.com/eks/latest/userguide/fargate-profile.html

        :param cluster_name: - Identifier for the clusterName.
        :param fargate_profile_name: - Identifier for the fargateProfileName.
        :param u_uid: - Identifier for the uUID.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "onFargateprofile", [cluster_name, fargate_profile_name, u_uid, account, region, partition]))

    @jsii.member(jsii_name="onIdentityproviderconfig")
    def on_identityproviderconfig(
        self,
        cluster_name: builtins.str,
        identity_provider_type: builtins.str,
        identity_provider_config_name: builtins.str,
        u_uid: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Eks":
        '''(experimental) Adds a resource of type identityproviderconfig to the statement.

        https://docs.aws.amazon.com/eks/latest/userguide/authenticate-oidc-identity-provider.html

        :param cluster_name: - Identifier for the clusterName.
        :param identity_provider_type: - Identifier for the identityProviderType.
        :param identity_provider_config_name: - Identifier for the identityProviderConfigName.
        :param u_uid: - Identifier for the uUID.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "onIdentityproviderconfig", [cluster_name, identity_provider_type, identity_provider_config_name, u_uid, account, region, partition]))

    @jsii.member(jsii_name="onNodegroup")
    def on_nodegroup(
        self,
        cluster_name: builtins.str,
        nodegroup_name: builtins.str,
        u_uid: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Eks":
        '''(experimental) Adds a resource of type nodegroup to the statement.

        https://docs.aws.amazon.com/eks/latest/userguide/managed-node-groups.html

        :param cluster_name: - Identifier for the clusterName.
        :param nodegroup_name: - Identifier for the nodegroupName.
        :param u_uid: - Identifier for the uUID.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "onNodegroup", [cluster_name, nodegroup_name, u_uid, account, region, partition]))

    @jsii.member(jsii_name="toAccessKubernetesApi")
    def to_access_kubernetes_api(self) -> "Eks":
        '''(experimental) Grants permission to view Kubernetes objects via AWS EKS console.

        Access Level: Read

        https://docs.aws.amazon.com/eks/latest/userguide/view-workloads.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toAccessKubernetesApi", []))

    @jsii.member(jsii_name="toAssociateEncryptionConfig")
    def to_associate_encryption_config(self) -> "Eks":
        '''(experimental) Grants permission to associate encryption configuration to a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/eks/latest/APIReference/API_AssociateEncryptionConfig.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toAssociateEncryptionConfig", []))

    @jsii.member(jsii_name="toAssociateIdentityProviderConfig")
    def to_associate_identity_provider_config(self) -> "Eks":
        '''(experimental) Grants permission to associate an identity provider configuration to a cluster.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifClientId()
        - .ifIssuerUrl()

        https://docs.aws.amazon.com/eks/latest/APIReference/API_AssociateIdentityProviderConfig.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toAssociateIdentityProviderConfig", []))

    @jsii.member(jsii_name="toCreateAddon")
    def to_create_addon(self) -> "Eks":
        '''(experimental) Grants permission to create an Amazon EKS add-on.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/eks/latest/APIReference/API_CreateAddon.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toCreateAddon", []))

    @jsii.member(jsii_name="toCreateCluster")
    def to_create_cluster(self) -> "Eks":
        '''(experimental) Grants permission to create an Amazon EKS cluster.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/eks/latest/APIReference/API_CreateCluster.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toCreateCluster", []))

    @jsii.member(jsii_name="toCreateFargateProfile")
    def to_create_fargate_profile(self) -> "Eks":
        '''(experimental) Grants permission to create an AWS Fargate profile.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/eks/latest/APIReference/API_CreateFargateProfile.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toCreateFargateProfile", []))

    @jsii.member(jsii_name="toCreateNodegroup")
    def to_create_nodegroup(self) -> "Eks":
        '''(experimental) Grants permission to create an Amazon EKS Nodegroup.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/eks/latest/APIReference/API_CreateNodegroup.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toCreateNodegroup", []))

    @jsii.member(jsii_name="toDeleteAddon")
    def to_delete_addon(self) -> "Eks":
        '''(experimental) Grants permission to delete an Amazon EKS add-on.

        Access Level: Write

        https://docs.aws.amazon.com/eks/latest/APIReference/API_DeleteAddon.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toDeleteAddon", []))

    @jsii.member(jsii_name="toDeleteCluster")
    def to_delete_cluster(self) -> "Eks":
        '''(experimental) Grants permission to delete an Amazon EKS cluster.

        Access Level: Write

        https://docs.aws.amazon.com/eks/latest/APIReference/API_DeleteCluster.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toDeleteCluster", []))

    @jsii.member(jsii_name="toDeleteFargateProfile")
    def to_delete_fargate_profile(self) -> "Eks":
        '''(experimental) Grants permission to delete an AWS Fargate profile.

        Access Level: Write

        https://docs.aws.amazon.com/eks/latest/APIReference/API_DeleteFargateProfile.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toDeleteFargateProfile", []))

    @jsii.member(jsii_name="toDeleteNodegroup")
    def to_delete_nodegroup(self) -> "Eks":
        '''(experimental) Grants permission to delete an Amazon EKS Nodegroup.

        Access Level: Write

        https://docs.aws.amazon.com/eks/latest/APIReference/API_DeleteNodegroup.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toDeleteNodegroup", []))

    @jsii.member(jsii_name="toDescribeAddon")
    def to_describe_addon(self) -> "Eks":
        '''(experimental) Grants permission to retrieve descriptive information about an Amazon EKS add-on.

        Access Level: Read

        https://docs.aws.amazon.com/eks/latest/APIReference/API_DescribeAddon.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toDescribeAddon", []))

    @jsii.member(jsii_name="toDescribeAddonVersions")
    def to_describe_addon_versions(self) -> "Eks":
        '''(experimental) Grants permission to retrieve descriptive version information about the add-ons that Amazon EKS Add-ons supports.

        Access Level: Read

        https://docs.aws.amazon.com/eks/latest/APIReference/API_DescribeAddonVersions.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toDescribeAddonVersions", []))

    @jsii.member(jsii_name="toDescribeCluster")
    def to_describe_cluster(self) -> "Eks":
        '''(experimental) Grants permission to retrieve descriptive information about an Amazon EKS cluster.

        Access Level: Read

        https://docs.aws.amazon.com/eks/latest/APIReference/API_DescribeCluster.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toDescribeCluster", []))

    @jsii.member(jsii_name="toDescribeFargateProfile")
    def to_describe_fargate_profile(self) -> "Eks":
        '''(experimental) Grants permission to retrieve descriptive information about an AWS Fargate profile associated with a cluster.

        Access Level: Read

        https://docs.aws.amazon.com/eks/latest/APIReference/API_DescribeFargateProfile.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toDescribeFargateProfile", []))

    @jsii.member(jsii_name="toDescribeIdentityProviderConfig")
    def to_describe_identity_provider_config(self) -> "Eks":
        '''(experimental) Grants permission to retrieve descriptive information about an Idp config associated with a cluster.

        Access Level: Read

        https://docs.aws.amazon.com/eks/latest/APIReference/API_DescribeIdentityProviderConfig.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toDescribeIdentityProviderConfig", []))

    @jsii.member(jsii_name="toDescribeNodegroup")
    def to_describe_nodegroup(self) -> "Eks":
        '''(experimental) Grants permission to retrieve descriptive information about an Amazon EKS nodegroup.

        Access Level: Read

        https://docs.aws.amazon.com/eks/latest/APIReference/API_DescribeNodegroup.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toDescribeNodegroup", []))

    @jsii.member(jsii_name="toDescribeUpdate")
    def to_describe_update(self) -> "Eks":
        '''(experimental) Grants permission to retrieve a given update for a given Amazon EKS cluster/nodegroup/add-on (in the specified or default region).

        Access Level: Read

        https://docs.aws.amazon.com/eks/latest/APIReference/API_DescribeUpdate.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toDescribeUpdate", []))

    @jsii.member(jsii_name="toDisassociateIdentityProviderConfig")
    def to_disassociate_identity_provider_config(self) -> "Eks":
        '''(experimental) Grants permission to delete an asssociated Idp config.

        Access Level: Write

        https://docs.aws.amazon.com/eks/latest/APIReference/API_DisassociateIdentityProviderConfig.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toDisassociateIdentityProviderConfig", []))

    @jsii.member(jsii_name="toListAddons")
    def to_list_addons(self) -> "Eks":
        '''(experimental) Grants permission to list the Amazon EKS add-ons in your AWS account (in the specified or default region) for a given cluster.

        Access Level: List

        https://docs.aws.amazon.com/eks/latest/APIReference/API_ListAddons.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toListAddons", []))

    @jsii.member(jsii_name="toListClusters")
    def to_list_clusters(self) -> "Eks":
        '''(experimental) Grants permission to list the Amazon EKS clusters in your AWS account (in the specified or default region).

        Access Level: List

        https://docs.aws.amazon.com/eks/latest/APIReference/API_ListClusters.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toListClusters", []))

    @jsii.member(jsii_name="toListFargateProfiles")
    def to_list_fargate_profiles(self) -> "Eks":
        '''(experimental) Grants permission to list the AWS Fargate profiles in your AWS account (in the specified or default region) associated with a given cluster.

        Access Level: List

        https://docs.aws.amazon.com/eks/latest/APIReference/API_ListFargateProfiles.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toListFargateProfiles", []))

    @jsii.member(jsii_name="toListIdentityProviderConfigs")
    def to_list_identity_provider_configs(self) -> "Eks":
        '''(experimental) Grants permission to list the Idp configs in your AWS account (in the specified or default region) associated with a given cluster.

        Access Level: List

        https://docs.aws.amazon.com/eks/latest/APIReference/API_ListIdentityProviderConfigs.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toListIdentityProviderConfigs", []))

    @jsii.member(jsii_name="toListNodegroups")
    def to_list_nodegroups(self) -> "Eks":
        '''(experimental) Grants permission to list the Amazon EKS nodegroups in your AWS account (in the specified or default region) attached to given cluster.

        Access Level: List

        https://docs.aws.amazon.com/eks/latest/APIReference/API_ListNodegroups.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toListNodegroups", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Eks":
        '''(experimental) Grants permission to list tags for the specified resource.

        Access Level: Read

        https://docs.aws.amazon.com/eks/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListUpdates")
    def to_list_updates(self) -> "Eks":
        '''(experimental) Grants permission to list the updates for a given Amazon EKS cluster/nodegroup/add-on (in the specified or default region).

        Access Level: List

        https://docs.aws.amazon.com/eks/latest/APIReference/API_ListUpdates.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toListUpdates", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Eks":
        '''(experimental) Grants permission to tag the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/eks/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Eks":
        '''(experimental) Grants permission to untag the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/eks/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAddon")
    def to_update_addon(self) -> "Eks":
        '''(experimental) Grants permission to update Amazon EKS add-on configurations, such as the VPC-CNI version.

        Access Level: Write

        https://docs.aws.amazon.com/eks/latest/APIReference/API_UpdateAddon.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toUpdateAddon", []))

    @jsii.member(jsii_name="toUpdateClusterConfig")
    def to_update_cluster_config(self) -> "Eks":
        '''(experimental) Grants permission to update Amazon EKS cluster configurations (eg: API server endpoint access).

        Access Level: Write

        https://docs.aws.amazon.com/eks/latest/APIReference/API_UpdateClusterConfig.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toUpdateClusterConfig", []))

    @jsii.member(jsii_name="toUpdateClusterVersion")
    def to_update_cluster_version(self) -> "Eks":
        '''(experimental) Grants permission to update the Kubernetes version of an Amazon EKS cluster.

        Access Level: Write

        https://docs.aws.amazon.com/eks/latest/APIReference/API_UpdateClusterVersion.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toUpdateClusterVersion", []))

    @jsii.member(jsii_name="toUpdateNodegroupConfig")
    def to_update_nodegroup_config(self) -> "Eks":
        '''(experimental) Grants permission to update Amazon EKS nodegroup configurations (eg: min/max/desired capacity or labels).

        Access Level: Write

        https://docs.aws.amazon.com/eks/latest/APIReference/API_UpdateNodegroupConfig.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toUpdateNodegroupConfig", []))

    @jsii.member(jsii_name="toUpdateNodegroupVersion")
    def to_update_nodegroup_version(self) -> "Eks":
        '''(experimental) Grants permission to update the Kubernetes version of an Amazon EKS nodegroup.

        Access Level: Write

        https://docs.aws.amazon.com/eks/latest/APIReference/API_UpdateNodegroupVersion.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toUpdateNodegroupVersion", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class ElasticInference(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.ElasticInference",
):
    '''(experimental) Statement provider for service `elastic-inference <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticinference.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `elastic-inference <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticinference.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(ElasticInference, self, [sid])

    @jsii.member(jsii_name="onAccelerator")
    def on_accelerator(
        self,
        accelerator_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ElasticInference":
        '''(experimental) Adds a resource of type accelerator to the statement.

        :param accelerator_id: - Identifier for the acceleratorId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("ElasticInference", jsii.invoke(self, "onAccelerator", [accelerator_id, account, region, partition]))

    @jsii.member(jsii_name="toConnect")
    def to_connect(self) -> "ElasticInference":
        '''(experimental) Connects customer to Elastic Inference accelerator.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("ElasticInference", jsii.invoke(self, "toConnect", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Elasticache(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Elasticache",
):
    '''(experimental) Statement provider for service `elasticache <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticache.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `elasticache <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticache.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Elasticache, self, [sid])

    @jsii.member(jsii_name="ifAtRestEncryptionEnabled")
    def if_at_rest_encryption_enabled(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Elasticache":
        '''(experimental) Filters access by the AtRestEncryptionEnabled parameter present in the request or default false value if parameter is not present.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/IAM.ConditionKeys.html#IAM.SpecifyingConditions

        Applies to actions:

        - .toCreateReplicationGroup()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "ifAtRestEncryptionEnabled", [value]))

    @jsii.member(jsii_name="ifAuthTokenEnabled")
    def if_auth_token_enabled(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Elasticache":
        '''(experimental) Filters access by the presence of non empty AuthToken parameter in the request.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/IAM.ConditionKeys.html#IAM.SpecifyingConditions

        Applies to actions:

        - .toCreateCacheCluster()
        - .toCreateReplicationGroup()
        - .toModifyCacheCluster()
        - .toModifyReplicationGroup()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "ifAuthTokenEnabled", [value]))

    @jsii.member(jsii_name="ifAutomaticFailoverEnabled")
    def if_automatic_failover_enabled(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Elasticache":
        '''(experimental) Filters access by the AutomaticFailoverEnabled parameter in the request.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/IAM.ConditionKeys.html#IAM.SpecifyingConditions

        Applies to actions:

        - .toCreateReplicationGroup()
        - .toModifyGlobalReplicationGroup()
        - .toModifyReplicationGroup()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "ifAutomaticFailoverEnabled", [value]))

    @jsii.member(jsii_name="ifCacheNodeType")
    def if_cache_node_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticache":
        '''(experimental) Filters access by the cacheNodeType parameter present in the request.

        This key can be used to restrict which cache node types can be used on cluster creation or scaling operations

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/IAM.ConditionKeys.html#IAM.SpecifyingConditions

        Applies to actions:

        - .toCreateCacheCluster()
        - .toCreateReplicationGroup()
        - .toModifyCacheCluster()
        - .toModifyGlobalReplicationGroup()
        - .toModifyReplicationGroup()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "ifCacheNodeType", [value, operator]))

    @jsii.member(jsii_name="ifCacheParameterGroupName")
    def if_cache_parameter_group_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticache":
        '''(experimental) Filters access by the the CacheParameterGroupName parameter in the request.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/IAM.ConditionKeys.html#IAM.SpecifyingConditions

        Applies to actions:

        - .toCreateCacheCluster()
        - .toCreateCacheParameterGroup()
        - .toCreateReplicationGroup()
        - .toDeleteCacheParameterGroup()
        - .toModifyCacheCluster()
        - .toModifyCacheParameterGroup()
        - .toModifyReplicationGroup()
        - .toResetCacheParameterGroup()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "ifCacheParameterGroupName", [value, operator]))

    @jsii.member(jsii_name="ifClusterModeEnabled")
    def if_cluster_mode_enabled(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Elasticache":
        '''(experimental) Filters access by the cluster mode parameter present in the request.

        Default value for single node group (shard) creations is false

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/IAM.ConditionKeys.html#IAM.SpecifyingConditions

        Applies to actions:

        - .toCreateReplicationGroup()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "ifClusterModeEnabled", [value]))

    @jsii.member(jsii_name="ifEngineType")
    def if_engine_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticache":
        '''(experimental) Filters access by the engine type present in creation requests.

        For replication group creations, default engine ‘redis’ is used as key if parameter is not present

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/IAM.ConditionKeys.html#IAM.SpecifyingConditions

        Applies to actions:

        - .toCreateCacheCluster()
        - .toCreateReplicationGroup()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "ifEngineType", [value, operator]))

    @jsii.member(jsii_name="ifEngineVersion")
    def if_engine_version(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticache":
        '''(experimental) Filters access by the engineVersion parameter present in creation or cluster modification requests.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/IAM.ConditionKeys.html#IAM.SpecifyingConditions

        Applies to actions:

        - .toCreateCacheCluster()
        - .toCreateReplicationGroup()
        - .toModifyCacheCluster()
        - .toModifyGlobalReplicationGroup()
        - .toModifyReplicationGroup()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "ifEngineVersion", [value, operator]))

    @jsii.member(jsii_name="ifKmsKeyId")
    def if_kms_key_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticache":
        '''(experimental) Filters access by the KmsKeyId parameter in the request.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/IAM.ConditionKeys.html#IAM.SpecifyingConditions

        Applies to actions:

        - .toCopySnapshot()
        - .toCreateReplicationGroup()
        - .toCreateSnapshot()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "ifKmsKeyId", [value, operator]))

    @jsii.member(jsii_name="ifMultiAZEnabled")
    def if_multi_az_enabled(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Elasticache":
        '''(experimental) Filters access by the AZMode parameter, MultiAZEnabled parameter or the number of availability zones that the cluster or replication group can be placed in.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/IAM.ConditionKeys.html#IAM.SpecifyingConditions

        Applies to actions:

        - .toCreateCacheCluster()
        - .toCreateReplicationGroup()
        - .toModifyCacheCluster()
        - .toModifyReplicationGroup()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "ifMultiAZEnabled", [value]))

    @jsii.member(jsii_name="ifNumNodeGroups")
    def if_num_node_groups(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticache":
        '''(experimental) Filters access by the NumNodeGroups or NodeGroupCount parameter specified in the request.

        This key can be used to restrict the number of node groups (shards) clusters can have after creation or scaling operations

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/IAM.ConditionKeys.html#IAM.SpecifyingConditions

        Applies to actions:

        - .toCreateReplicationGroup()
        - .toDecreaseNodeGroupsInGlobalReplicationGroup()
        - .toIncreaseNodeGroupsInGlobalReplicationGroup()
        - .toModifyReplicationGroupShardConfiguration()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "ifNumNodeGroups", [value, operator]))

    @jsii.member(jsii_name="ifReplicasPerNodeGroup")
    def if_replicas_per_node_group(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticache":
        '''(experimental) Filters access by the number of replicas per node group (shards) specified in creations or scaling requests.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/IAM.ConditionKeys.html#IAM.SpecifyingConditions

        Applies to actions:

        - .toCreateReplicationGroup()
        - .toDecreaseReplicaCount()
        - .toIncreaseReplicaCount()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "ifReplicasPerNodeGroup", [value, operator]))

    @jsii.member(jsii_name="ifSnapshotRetentionLimit")
    def if_snapshot_retention_limit(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticache":
        '''(experimental) Filters access by the SnapshotRetentionLimit parameter in the request.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/IAM.ConditionKeys.html#IAM.SpecifyingConditions

        Applies to actions:

        - .toCreateCacheCluster()
        - .toCreateReplicationGroup()
        - .toModifyCacheCluster()
        - .toModifyReplicationGroup()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "ifSnapshotRetentionLimit", [value, operator]))

    @jsii.member(jsii_name="ifTransitEncryptionEnabled")
    def if_transit_encryption_enabled(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Elasticache":
        '''(experimental) Filters access by the TransitEncryptionEnabled parameter present in the request or default false value if parameter is not present.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/IAM.ConditionKeys.html#IAM.SpecifyingConditions

        Applies to actions:

        - .toCreateReplicationGroup()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "ifTransitEncryptionEnabled", [value]))

    @jsii.member(jsii_name="onCluster")
    def on_cluster(
        self,
        cache_cluster_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticache":
        '''(experimental) Adds a resource of type cluster to the statement.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/WhatIs.Components.html#WhatIs.Components.Clusters

        :param cache_cluster_id: - Identifier for the cacheClusterId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "onCluster", [cache_cluster_id, account, region, partition]))

    @jsii.member(jsii_name="onGlobalreplicationgroup")
    def on_globalreplicationgroup(
        self,
        global_replication_group_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticache":
        '''(experimental) Adds a resource of type globalreplicationgroup to the statement.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Redis-Global-Datastore.html

        :param global_replication_group_id: - Identifier for the globalReplicationGroupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "onGlobalreplicationgroup", [global_replication_group_id, account, partition]))

    @jsii.member(jsii_name="onParametergroup")
    def on_parametergroup(
        self,
        cache_parameter_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticache":
        '''(experimental) Adds a resource of type parametergroup to the statement.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/WhatIs.Components.html#WhatIs.Components.ParameterGroups

        :param cache_parameter_group_name: - Identifier for the cacheParameterGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "onParametergroup", [cache_parameter_group_name, account, region, partition]))

    @jsii.member(jsii_name="onReplicationgroup")
    def on_replicationgroup(
        self,
        replication_group_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticache":
        '''(experimental) Adds a resource of type replicationgroup to the statement.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/WhatIs.Components.html#WhatIs.Components.ReplicationGroups

        :param replication_group_id: - Identifier for the replicationGroupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "onReplicationgroup", [replication_group_id, account, region, partition]))

    @jsii.member(jsii_name="onReservedInstance")
    def on_reserved_instance(
        self,
        reserved_cache_node_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticache":
        '''(experimental) Adds a resource of type reserved-instance to the statement.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/reserved-nodes.html

        :param reserved_cache_node_id: - Identifier for the reservedCacheNodeId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "onReservedInstance", [reserved_cache_node_id, account, region, partition]))

    @jsii.member(jsii_name="onSecuritygroup")
    def on_securitygroup(
        self,
        cache_security_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticache":
        '''(experimental) Adds a resource of type securitygroup to the statement.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/WhatIs.Components.html#WhatIs.Components.SecurityGroups

        :param cache_security_group_name: - Identifier for the cacheSecurityGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "onSecuritygroup", [cache_security_group_name, account, region, partition]))

    @jsii.member(jsii_name="onSnapshot")
    def on_snapshot(
        self,
        snapshot_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticache":
        '''(experimental) Adds a resource of type snapshot to the statement.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/WhatIs.Components.html#WhatIs.Components.Snapshots

        :param snapshot_name: - Identifier for the snapshotName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "onSnapshot", [snapshot_name, account, region, partition]))

    @jsii.member(jsii_name="onSubnetgroup")
    def on_subnetgroup(
        self,
        cache_subnet_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticache":
        '''(experimental) Adds a resource of type subnetgroup to the statement.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/WhatIs.Components.html#WhatIs.Components.SubnetGroups

        :param cache_subnet_group_name: - Identifier for the cacheSubnetGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "onSubnetgroup", [cache_subnet_group_name, account, region, partition]))

    @jsii.member(jsii_name="onUser")
    def on_user(
        self,
        user_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticache":
        '''(experimental) Adds a resource of type user to the statement.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Clusters.RBAC.html

        :param user_id: - Identifier for the userId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "onUser", [user_id, account, region, partition]))

    @jsii.member(jsii_name="onUsergroup")
    def on_usergroup(
        self,
        user_group_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticache":
        '''(experimental) Adds a resource of type usergroup to the statement.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Clusters.RBAC.html

        :param user_group_id: - Identifier for the userGroupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "onUsergroup", [user_group_id, account, region, partition]))

    @jsii.member(jsii_name="toAddTagsToResource")
    def to_add_tags_to_resource(self) -> "Elasticache":
        '''(experimental) Grants permission to add tags to an ElastiCache resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_AddTagsToResource.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toAddTagsToResource", []))

    @jsii.member(jsii_name="toAuthorizeCacheSecurityGroupIngress")
    def to_authorize_cache_security_group_ingress(self) -> "Elasticache":
        '''(experimental) Grants permission to authorize an EC2 security group on a ElastiCache security group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - ec2:AuthorizeSecurityGroupIngress

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_AuthorizeCacheSecurityGroupIngress.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toAuthorizeCacheSecurityGroupIngress", []))

    @jsii.member(jsii_name="toBatchApplyUpdateAction")
    def to_batch_apply_update_action(self) -> "Elasticache":
        '''(experimental) Grants permission to apply ElastiCache service updates to sets of clusters and replication groups.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:DeleteNetworkInterface
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs
        - s3:GetObject

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_BatchApplyUpdateAction.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toBatchApplyUpdateAction", []))

    @jsii.member(jsii_name="toBatchStopUpdateAction")
    def to_batch_stop_update_action(self) -> "Elasticache":
        '''(experimental) Grants permission to stop ElastiCache service updates from being executed on a set of clusters.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_BatchStopUpdateAction.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toBatchStopUpdateAction", []))

    @jsii.member(jsii_name="toCompleteMigration")
    def to_complete_migration(self) -> "Elasticache":
        '''(experimental) Grants permission to complete an online migration of data from hosted Redis on Amazon EC2 to ElastiCache.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_CompleteMigration.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toCompleteMigration", []))

    @jsii.member(jsii_name="toCopySnapshot")
    def to_copy_snapshot(self) -> "Elasticache":
        '''(experimental) Grants permission to make a copy of an existing snapshot.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifKmsKeyId()

        Dependent actions:

        - elasticache:AddTagsToResource
        - s3:DeleteObject
        - s3:GetBucketAcl
        - s3:PutObject

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_CopySnapshot.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toCopySnapshot", []))

    @jsii.member(jsii_name="toCreateCacheCluster")
    def to_create_cache_cluster(self) -> "Elasticache":
        '''(experimental) Grants permission to create a cache cluster.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifCacheNodeType()
        - .ifEngineVersion()
        - .ifEngineType()
        - .ifMultiAZEnabled()
        - .ifAuthTokenEnabled()
        - .ifSnapshotRetentionLimit()
        - .ifCacheParameterGroupName()

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:DeleteNetworkInterface
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs
        - elasticache:AddTagsToResource
        - s3:GetObject

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_CreateCacheCluster.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toCreateCacheCluster", []))

    @jsii.member(jsii_name="toCreateCacheParameterGroup")
    def to_create_cache_parameter_group(self) -> "Elasticache":
        '''(experimental) Grants permission to create a parameter group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifCacheParameterGroupName()

        Dependent actions:

        - elasticache:AddTagsToResource

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_CreateCacheParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toCreateCacheParameterGroup", []))

    @jsii.member(jsii_name="toCreateCacheSecurityGroup")
    def to_create_cache_security_group(self) -> "Elasticache":
        '''(experimental) Grants permission to create a cache security group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - elasticache:AddTagsToResource

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_CreateCacheSecurityGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toCreateCacheSecurityGroup", []))

    @jsii.member(jsii_name="toCreateCacheSubnetGroup")
    def to_create_cache_subnet_group(self) -> "Elasticache":
        '''(experimental) Grants permission to create a cache subnet group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - elasticache:AddTagsToResource

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_CreateCacheSubnetGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toCreateCacheSubnetGroup", []))

    @jsii.member(jsii_name="toCreateGlobalReplicationGroup")
    def to_create_global_replication_group(self) -> "Elasticache":
        '''(experimental) Grants permission to create a global replication group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_CreateGlobalReplicationGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toCreateGlobalReplicationGroup", []))

    @jsii.member(jsii_name="toCreateReplicationGroup")
    def to_create_replication_group(self) -> "Elasticache":
        '''(experimental) Grants permission to create a replication group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifNumNodeGroups()
        - .ifCacheNodeType()
        - .ifReplicasPerNodeGroup()
        - .ifEngineVersion()
        - .ifEngineType()
        - .ifAtRestEncryptionEnabled()
        - .ifTransitEncryptionEnabled()
        - .ifAutomaticFailoverEnabled()
        - .ifMultiAZEnabled()
        - .ifClusterModeEnabled()
        - .ifAuthTokenEnabled()
        - .ifSnapshotRetentionLimit()
        - .ifKmsKeyId()
        - .ifCacheParameterGroupName()

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:DeleteNetworkInterface
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs
        - elasticache:AddTagsToResource
        - s3:GetObject

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_CreateReplicationGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toCreateReplicationGroup", []))

    @jsii.member(jsii_name="toCreateSnapshot")
    def to_create_snapshot(self) -> "Elasticache":
        '''(experimental) Grants permission to create a copy of an entire Redis cluster at a specific moment in time.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifKmsKeyId()

        Dependent actions:

        - elasticache:AddTagsToResource
        - s3:DeleteObject
        - s3:GetBucketAcl
        - s3:PutObject

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_CreateSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toCreateSnapshot", []))

    @jsii.member(jsii_name="toCreateUser")
    def to_create_user(self) -> "Elasticache":
        '''(experimental) Grants permission to create a Redis user for Redis engine version 6.x and onwards.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - elasticache:AddTagsToResource

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_CreateUser.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toCreateUser", []))

    @jsii.member(jsii_name="toCreateUserGroup")
    def to_create_user_group(self) -> "Elasticache":
        '''(experimental) Grants permission to create a Redis user group for Redis engine version 6.x and onwards.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        Dependent actions:

        - elasticache:AddTagsToResource

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_CreateUserGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toCreateUserGroup", []))

    @jsii.member(jsii_name="toDecreaseNodeGroupsInGlobalReplicationGroup")
    def to_decrease_node_groups_in_global_replication_group(self) -> "Elasticache":
        '''(experimental) Grants permission to decrease the number of node groups in global replication groups.

        Access Level: Write

        Possible conditions:

        - .ifNumNodeGroups()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DecreaseNodeGroupsInGlobalReplicationGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDecreaseNodeGroupsInGlobalReplicationGroup", []))

    @jsii.member(jsii_name="toDecreaseReplicaCount")
    def to_decrease_replica_count(self) -> "Elasticache":
        '''(experimental) Grants permission to decrease the number of replicas in a Redis (cluster mode disabled) replication group or the number of replica nodes in one or more node groups (shards) of a Redis (cluster mode enabled) replication group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifReplicasPerNodeGroup()

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:DeleteNetworkInterface
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DecreaseReplicaCount.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDecreaseReplicaCount", []))

    @jsii.member(jsii_name="toDeleteCacheCluster")
    def to_delete_cache_cluster(self) -> "Elasticache":
        '''(experimental) Grants permission to delete a previously provisioned cluster.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:DeleteNetworkInterface
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DeleteCacheCluster.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDeleteCacheCluster", []))

    @jsii.member(jsii_name="toDeleteCacheParameterGroup")
    def to_delete_cache_parameter_group(self) -> "Elasticache":
        '''(experimental) Grants permission to delete the specified cache parameter group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifCacheParameterGroupName()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DeleteCacheParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDeleteCacheParameterGroup", []))

    @jsii.member(jsii_name="toDeleteCacheSecurityGroup")
    def to_delete_cache_security_group(self) -> "Elasticache":
        '''(experimental) Grants permission to delete a cache security group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DeleteCacheSecurityGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDeleteCacheSecurityGroup", []))

    @jsii.member(jsii_name="toDeleteCacheSubnetGroup")
    def to_delete_cache_subnet_group(self) -> "Elasticache":
        '''(experimental) Grants permission to delete a cache subnet group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:DeleteNetworkInterface
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DeleteCacheSubnetGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDeleteCacheSubnetGroup", []))

    @jsii.member(jsii_name="toDeleteGlobalReplicationGroup")
    def to_delete_global_replication_group(self) -> "Elasticache":
        '''(experimental) Grants permission to delete an existing global replication group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DeleteGlobalReplicationGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDeleteGlobalReplicationGroup", []))

    @jsii.member(jsii_name="toDeleteReplicationGroup")
    def to_delete_replication_group(self) -> "Elasticache":
        '''(experimental) Grants permission to delete an existing replication group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:DeleteNetworkInterface
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DeleteReplicationGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDeleteReplicationGroup", []))

    @jsii.member(jsii_name="toDeleteSnapshot")
    def to_delete_snapshot(self) -> "Elasticache":
        '''(experimental) Grants permission to delete an existing snapshot.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DeleteSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDeleteSnapshot", []))

    @jsii.member(jsii_name="toDeleteUser")
    def to_delete_user(self) -> "Elasticache":
        '''(experimental) Grants permission to delete an existing user and thus remove it from all user groups and replication groups where it was assigned.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DeleteUser.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDeleteUser", []))

    @jsii.member(jsii_name="toDeleteUserGroup")
    def to_delete_user_group(self) -> "Elasticache":
        '''(experimental) Grants permission to delete an existing user group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DeleteUserGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDeleteUserGroup", []))

    @jsii.member(jsii_name="toDescribeCacheClusters")
    def to_describe_cache_clusters(self) -> "Elasticache":
        '''(experimental) Grants permission to list information about provisioned cache clusters.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeCacheClusters.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDescribeCacheClusters", []))

    @jsii.member(jsii_name="toDescribeCacheEngineVersions")
    def to_describe_cache_engine_versions(self) -> "Elasticache":
        '''(experimental) Grants permission list available cache engines and their versions.

        Access Level: List

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeCacheEngineVersions.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDescribeCacheEngineVersions", []))

    @jsii.member(jsii_name="toDescribeCacheParameterGroups")
    def to_describe_cache_parameter_groups(self) -> "Elasticache":
        '''(experimental) Grants permission to list cache parameter group descriptions.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeCacheParameterGroups.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDescribeCacheParameterGroups", []))

    @jsii.member(jsii_name="toDescribeCacheParameters")
    def to_describe_cache_parameters(self) -> "Elasticache":
        '''(experimental) Grants permission to retrieve the detailed parameter list for a particular cache parameter group.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeCacheParameters.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDescribeCacheParameters", []))

    @jsii.member(jsii_name="toDescribeCacheSecurityGroups")
    def to_describe_cache_security_groups(self) -> "Elasticache":
        '''(experimental) Grants permission to list cache security group descriptions.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeCacheSecurityGroups.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDescribeCacheSecurityGroups", []))

    @jsii.member(jsii_name="toDescribeCacheSubnetGroups")
    def to_describe_cache_subnet_groups(self) -> "Elasticache":
        '''(experimental) Grants permission to list cache subnet group descriptions.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeCacheSubnetGroups.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDescribeCacheSubnetGroups", []))

    @jsii.member(jsii_name="toDescribeEngineDefaultParameters")
    def to_describe_engine_default_parameters(self) -> "Elasticache":
        '''(experimental) Grants permission to retrieve the default engine and system parameter information for the specified cache engine.

        Access Level: List

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeEngineDefaultParameters.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDescribeEngineDefaultParameters", []))

    @jsii.member(jsii_name="toDescribeEvents")
    def to_describe_events(self) -> "Elasticache":
        '''(experimental) Grants permission to list events related to clusters, cache security groups, and cache parameter groups.

        Access Level: List

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeEvents.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDescribeEvents", []))

    @jsii.member(jsii_name="toDescribeGlobalReplicationGroups")
    def to_describe_global_replication_groups(self) -> "Elasticache":
        '''(experimental) Grants permission to list information about global replication groups.

        Access Level: List

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeGlobalReplicationGroups.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDescribeGlobalReplicationGroups", []))

    @jsii.member(jsii_name="toDescribeReplicationGroups")
    def to_describe_replication_groups(self) -> "Elasticache":
        '''(experimental) Grants permission to list information about provisioned replication groups.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeReplicationGroups.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDescribeReplicationGroups", []))

    @jsii.member(jsii_name="toDescribeReservedCacheNodes")
    def to_describe_reserved_cache_nodes(self) -> "Elasticache":
        '''(experimental) Grants permission to list information about purchased reserved cache nodes.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeReservedCacheNodes.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDescribeReservedCacheNodes", []))

    @jsii.member(jsii_name="toDescribeReservedCacheNodesOfferings")
    def to_describe_reserved_cache_nodes_offerings(self) -> "Elasticache":
        '''(experimental) Grants permission to list available reserved cache node offerings.

        Access Level: List

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeReservedCacheNodesOfferings.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDescribeReservedCacheNodesOfferings", []))

    @jsii.member(jsii_name="toDescribeServiceUpdates")
    def to_describe_service_updates(self) -> "Elasticache":
        '''(experimental) Grants permission to list details of the service updates.

        Access Level: List

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeServiceUpdates.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDescribeServiceUpdates", []))

    @jsii.member(jsii_name="toDescribeSnapshots")
    def to_describe_snapshots(self) -> "Elasticache":
        '''(experimental) Grants permission to list information about cluster or replication group snapshots.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeSnapshots.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDescribeSnapshots", []))

    @jsii.member(jsii_name="toDescribeUpdateActions")
    def to_describe_update_actions(self) -> "Elasticache":
        '''(experimental) Grants permission to list details of the update actions for a set of clusters or replication groups.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeUpdateActions.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDescribeUpdateActions", []))

    @jsii.member(jsii_name="toDescribeUserGroups")
    def to_describe_user_groups(self) -> "Elasticache":
        '''(experimental) Grants permission to list information about Redis user groups.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeUserGroups.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDescribeUserGroups", []))

    @jsii.member(jsii_name="toDescribeUsers")
    def to_describe_users(self) -> "Elasticache":
        '''(experimental) Grants permission to list information about Redis users.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeUsers.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDescribeUsers", []))

    @jsii.member(jsii_name="toDisassociateGlobalReplicationGroup")
    def to_disassociate_global_replication_group(self) -> "Elasticache":
        '''(experimental) Grants permission to remove a secondary replication group from the global replication group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DisassociateGlobalReplicationGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDisassociateGlobalReplicationGroup", []))

    @jsii.member(jsii_name="toFailoverGlobalReplicationGroup")
    def to_failover_global_replication_group(self) -> "Elasticache":
        '''(experimental) Grants permission to failover the primary region to a selected secondary region of a global replication group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_FailoverGlobalReplicationGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toFailoverGlobalReplicationGroup", []))

    @jsii.member(jsii_name="toIncreaseNodeGroupsInGlobalReplicationGroup")
    def to_increase_node_groups_in_global_replication_group(self) -> "Elasticache":
        '''(experimental) Grants permission to increase the number of node groups in a global replication group.

        Access Level: Write

        Possible conditions:

        - .ifNumNodeGroups()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_IncreaseNodeGroupsInGlobalReplicationGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toIncreaseNodeGroupsInGlobalReplicationGroup", []))

    @jsii.member(jsii_name="toIncreaseReplicaCount")
    def to_increase_replica_count(self) -> "Elasticache":
        '''(experimental) Grants permission to increase the number of replicas in a Redis (cluster mode disabled) replication group or the number of replica nodes in one or more node groups (shards) of a Redis (cluster mode enabled) replication group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifReplicasPerNodeGroup()

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:DeleteNetworkInterface
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_IncreaseReplicaCount.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toIncreaseReplicaCount", []))

    @jsii.member(jsii_name="toListAllowedNodeTypeModifications")
    def to_list_allowed_node_type_modifications(self) -> "Elasticache":
        '''(experimental) Grants permission to list available node type that can be used to scale a particular Redis cluster or replication group.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_ListAllowedNodeTypeModifications.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toListAllowedNodeTypeModifications", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Elasticache":
        '''(experimental) Grants permission to list tags for an ElastiCache resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toModifyCacheCluster")
    def to_modify_cache_cluster(self) -> "Elasticache":
        '''(experimental) Grants permission to modify settings for a cluster.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifCacheNodeType()
        - .ifEngineVersion()
        - .ifMultiAZEnabled()
        - .ifAuthTokenEnabled()
        - .ifSnapshotRetentionLimit()
        - .ifCacheParameterGroupName()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_ModifyCacheCluster.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toModifyCacheCluster", []))

    @jsii.member(jsii_name="toModifyCacheParameterGroup")
    def to_modify_cache_parameter_group(self) -> "Elasticache":
        '''(experimental) Grants permission to modify parameters of a cache parameter group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifCacheParameterGroupName()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_ModifyCacheParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toModifyCacheParameterGroup", []))

    @jsii.member(jsii_name="toModifyCacheSubnetGroup")
    def to_modify_cache_subnet_group(self) -> "Elasticache":
        '''(experimental) Grants permission to modify an existing cache subnet group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_ModifyCacheSubnetGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toModifyCacheSubnetGroup", []))

    @jsii.member(jsii_name="toModifyGlobalReplicationGroup")
    def to_modify_global_replication_group(self) -> "Elasticache":
        '''(experimental) Grants permission to modify settings for a global replication group.

        Access Level: Write

        Possible conditions:

        - .ifCacheNodeType()
        - .ifEngineVersion()
        - .ifAutomaticFailoverEnabled()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_ModifyGlobalReplicationGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toModifyGlobalReplicationGroup", []))

    @jsii.member(jsii_name="toModifyReplicationGroup")
    def to_modify_replication_group(self) -> "Elasticache":
        '''(experimental) Grants permission to modify the settings for a replication group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifCacheNodeType()
        - .ifEngineVersion()
        - .ifAutomaticFailoverEnabled()
        - .ifMultiAZEnabled()
        - .ifAuthTokenEnabled()
        - .ifSnapshotRetentionLimit()
        - .ifCacheParameterGroupName()

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:DeleteNetworkInterface
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_ModifyReplicationGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toModifyReplicationGroup", []))

    @jsii.member(jsii_name="toModifyReplicationGroupShardConfiguration")
    def to_modify_replication_group_shard_configuration(self) -> "Elasticache":
        '''(experimental) Grants permission to add shards, remove shards, or rebalance the keyspaces among existing shards of a replication group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifNumNodeGroups()

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:DeleteNetworkInterface
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_ModifyReplicationGroupShardConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toModifyReplicationGroupShardConfiguration", []))

    @jsii.member(jsii_name="toModifyUser")
    def to_modify_user(self) -> "Elasticache":
        '''(experimental) Grants permission to change Redis user password(s) and/or access string.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_ModifyUser.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toModifyUser", []))

    @jsii.member(jsii_name="toModifyUserGroup")
    def to_modify_user_group(self) -> "Elasticache":
        '''(experimental) Grants permission to change list of users that belong to the user group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_ModifyUserGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toModifyUserGroup", []))

    @jsii.member(jsii_name="toPurchaseReservedCacheNodesOffering")
    def to_purchase_reserved_cache_nodes_offering(self) -> "Elasticache":
        '''(experimental) Grants permission to purchase a reserved cache node offering.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - elasticache:AddTagsToResource

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_PurchaseReservedCacheNodesOffering.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toPurchaseReservedCacheNodesOffering", []))

    @jsii.member(jsii_name="toRebalanceSlotsInGlobalReplicationGroup")
    def to_rebalance_slots_in_global_replication_group(self) -> "Elasticache":
        '''(experimental) Grants permission to perform a key space rebalance operation to redistribute slots and ensure uniform key distribution across existing shards in a global replication group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_RebalanceSlotsInGlobalReplicationGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toRebalanceSlotsInGlobalReplicationGroup", []))

    @jsii.member(jsii_name="toRebootCacheCluster")
    def to_reboot_cache_cluster(self) -> "Elasticache":
        '''(experimental) Grants permission to reboot some, or all, of the cache nodes within a provisioned cache cluster or replication group (cluster mode disabled).

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_RebootCacheCluster.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toRebootCacheCluster", []))

    @jsii.member(jsii_name="toRemoveTagsFromResource")
    def to_remove_tags_from_resource(self) -> "Elasticache":
        '''(experimental) Grants permission to remove tags from a ElastiCache resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_RemoveTagsFromResource.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toRemoveTagsFromResource", []))

    @jsii.member(jsii_name="toResetCacheParameterGroup")
    def to_reset_cache_parameter_group(self) -> "Elasticache":
        '''(experimental) Grants permission to modify parameters of a cache parameter group back to their default values.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifCacheParameterGroupName()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_ResetCacheParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toResetCacheParameterGroup", []))

    @jsii.member(jsii_name="toRevokeCacheSecurityGroupIngress")
    def to_revoke_cache_security_group_ingress(self) -> "Elasticache":
        '''(experimental) Grants permission to remove an EC2 security group ingress from a ElastiCache security group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_RevokeCacheSecurityGroupIngress.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toRevokeCacheSecurityGroupIngress", []))

    @jsii.member(jsii_name="toStartMigration")
    def to_start_migration(self) -> "Elasticache":
        '''(experimental) Grants permission to start a migration of data from hosted Redis on Amazon EC2 to ElastiCache for Redis.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_StartMigration.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toStartMigration", []))

    @jsii.member(jsii_name="toTestFailover")
    def to_test_failover(self) -> "Elasticache":
        '''(experimental) Grants permission to test automatic failover on a specified node group in a replication group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:DeleteNetworkInterface
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_TestFailover.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toTestFailover", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Elasticbeanstalk(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Elasticbeanstalk",
):
    '''(experimental) Statement provider for service `elasticbeanstalk <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselasticbeanstalk.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `elasticbeanstalk <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselasticbeanstalk.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Elasticbeanstalk, self, [sid])

    @jsii.member(jsii_name="ifFromApplication")
    def if_from_application(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticbeanstalk":
        '''(experimental) Filters access by an application as a dependency or a constraint on an input parameter.

        https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.iam.policies.actions.html#AWSHowTo.iam.policies.conditions

        Applies to actions:

        - .toCreateConfigurationTemplate()
        - .toUpdateConfigurationTemplate()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "ifFromApplication", [value, operator]))

    @jsii.member(jsii_name="ifFromApplicationVersion")
    def if_from_application_version(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticbeanstalk":
        '''(experimental) Filters access by an application version as a dependency or a constraint on an input parameter.

        https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.iam.policies.actions.html#AWSHowTo.iam.policies.conditions

        Applies to actions:

        - .toCreateConfigurationTemplate()
        - .toCreateEnvironment()
        - .toUpdateConfigurationTemplate()
        - .toUpdateEnvironment()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "ifFromApplicationVersion", [value, operator]))

    @jsii.member(jsii_name="ifFromConfigurationTemplate")
    def if_from_configuration_template(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticbeanstalk":
        '''(experimental) Filters access by a configuration template as a dependency or a constraint on an input parameter.

        https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.iam.policies.actions.html#AWSHowTo.iam.policies.conditions

        Applies to actions:

        - .toCreateConfigurationTemplate()
        - .toCreateEnvironment()
        - .toUpdateConfigurationTemplate()
        - .toUpdateEnvironment()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "ifFromConfigurationTemplate", [value, operator]))

    @jsii.member(jsii_name="ifFromEnvironment")
    def if_from_environment(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticbeanstalk":
        '''(experimental) Filters access by an environment as a dependency or a constraint on an input parameter.

        https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.iam.policies.actions.html#AWSHowTo.iam.policies.conditions

        Applies to actions:

        - .toCreateConfigurationTemplate()
        - .toSwapEnvironmentCNAMEs()
        - .toUpdateConfigurationTemplate()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "ifFromEnvironment", [value, operator]))

    @jsii.member(jsii_name="ifFromPlatform")
    def if_from_platform(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticbeanstalk":
        '''(experimental) Filters access by a platform as a dependency or a constraint on an input parameter.

        https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.iam.policies.actions.html#AWSHowTo.iam.policies.conditions

        Applies to actions:

        - .toCreateConfigurationTemplate()
        - .toCreateEnvironment()
        - .toUpdateConfigurationTemplate()
        - .toUpdateEnvironment()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "ifFromPlatform", [value, operator]))

    @jsii.member(jsii_name="ifFromSolutionStack")
    def if_from_solution_stack(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticbeanstalk":
        '''(experimental) Filters access by a solution stack as a dependency or a constraint on an input parameter.

        https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.iam.policies.actions.html#AWSHowTo.iam.policies.conditions

        Applies to actions:

        - .toCreateConfigurationTemplate()
        - .toCreateEnvironment()
        - .toUpdateConfigurationTemplate()
        - .toUpdateEnvironment()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "ifFromSolutionStack", [value, operator]))

    @jsii.member(jsii_name="ifInApplication")
    def if_in_application(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticbeanstalk":
        '''(experimental) Filters access by the application that contains the resource that the action operates on.

        https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.iam.policies.actions.html#AWSHowTo.iam.policies.conditions

        Applies to actions:

        - .toAbortEnvironmentUpdate()
        - .toApplyEnvironmentManagedAction()
        - .toComposeEnvironments()
        - .toCreateApplicationVersion()
        - .toCreateConfigurationTemplate()
        - .toCreateEnvironment()
        - .toDeleteApplicationVersion()
        - .toDeleteConfigurationTemplate()
        - .toDeleteEnvironmentConfiguration()
        - .toDescribeApplicationVersions()
        - .toDescribeConfigurationOptions()
        - .toDescribeConfigurationSettings()
        - .toDescribeEnvironmentManagedActionHistory()
        - .toDescribeEnvironmentManagedActions()
        - .toDescribeEnvironmentResources()
        - .toDescribeEnvironments()
        - .toDescribeEvents()
        - .toRebuildEnvironment()
        - .toRequestEnvironmentInfo()
        - .toRestartAppServer()
        - .toRetrieveEnvironmentInfo()
        - .toSwapEnvironmentCNAMEs()
        - .toTerminateEnvironment()
        - .toUpdateApplicationVersion()
        - .toUpdateConfigurationTemplate()
        - .toUpdateEnvironment()
        - .toValidateConfigurationSettings()

        Applies to resource types:

        - applicationversion
        - configurationtemplate
        - environment

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "ifInApplication", [value, operator]))

    @jsii.member(jsii_name="onApplication")
    def on_application(
        self,
        application_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticbeanstalk":
        '''(experimental) Adds a resource of type application to the statement.

        https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.iam.policies.arn.html

        :param application_name: - Identifier for the applicationName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "onApplication", [application_name, account, region, partition]))

    @jsii.member(jsii_name="onApplicationversion")
    def on_applicationversion(
        self,
        application_name: builtins.str,
        version_label: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticbeanstalk":
        '''(experimental) Adds a resource of type applicationversion to the statement.

        https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.iam.policies.arn.html

        :param application_name: - Identifier for the applicationName.
        :param version_label: - Identifier for the versionLabel.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifInApplication()

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "onApplicationversion", [application_name, version_label, account, region, partition]))

    @jsii.member(jsii_name="onConfigurationtemplate")
    def on_configurationtemplate(
        self,
        application_name: builtins.str,
        template_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticbeanstalk":
        '''(experimental) Adds a resource of type configurationtemplate to the statement.

        https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.iam.policies.arn.html

        :param application_name: - Identifier for the applicationName.
        :param template_name: - Identifier for the templateName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifInApplication()

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "onConfigurationtemplate", [application_name, template_name, account, region, partition]))

    @jsii.member(jsii_name="onEnvironment")
    def on_environment(
        self,
        application_name: builtins.str,
        environment_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticbeanstalk":
        '''(experimental) Adds a resource of type environment to the statement.

        https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.iam.policies.arn.html

        :param application_name: - Identifier for the applicationName.
        :param environment_name: - Identifier for the environmentName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifInApplication()

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "onEnvironment", [application_name, environment_name, account, region, partition]))

    @jsii.member(jsii_name="onPlatform")
    def on_platform(
        self,
        platform_name_with_version: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticbeanstalk":
        '''(experimental) Adds a resource of type platform to the statement.

        https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.iam.policies.arn.html

        :param platform_name_with_version: - Identifier for the platformNameWithVersion.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "onPlatform", [platform_name_with_version, region, partition]))

    @jsii.member(jsii_name="onSolutionstack")
    def on_solutionstack(
        self,
        solution_stack_name: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticbeanstalk":
        '''(experimental) Adds a resource of type solutionstack to the statement.

        https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.iam.policies.arn.html

        :param solution_stack_name: - Identifier for the solutionStackName.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "onSolutionstack", [solution_stack_name, region, partition]))

    @jsii.member(jsii_name="toAbortEnvironmentUpdate")
    def to_abort_environment_update(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to cancel in-progress environment configuration update or application version deployment.

        Access Level: Write

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_AbortEnvironmentUpdate.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toAbortEnvironmentUpdate", []))

    @jsii.member(jsii_name="toAddTags")
    def to_add_tags(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to add tags to an Elastic Beanstalk resource and to update tag values.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_UpdateTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toAddTags", []))

    @jsii.member(jsii_name="toApplyEnvironmentManagedAction")
    def to_apply_environment_managed_action(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to apply a scheduled managed action immediately.

        Access Level: Write

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_ApplyEnvironmentManagedAction.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toApplyEnvironmentManagedAction", []))

    @jsii.member(jsii_name="toAssociateEnvironmentOperationsRole")
    def to_associate_environment_operations_role(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to associate an operations role with an environment.

        Access Level: Write

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_AssociateEnvironmentOperationsRole.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toAssociateEnvironmentOperationsRole", []))

    @jsii.member(jsii_name="toCheckDNSAvailability")
    def to_check_dns_availability(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to check CNAME availability.

        Access Level: Read

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_CheckDNSAvailability.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toCheckDNSAvailability", []))

    @jsii.member(jsii_name="toComposeEnvironments")
    def to_compose_environments(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to create or update a group of environments, each running a separate component of a single application.

        Access Level: Write

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_ComposeEnvironments.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toComposeEnvironments", []))

    @jsii.member(jsii_name="toCreateApplication")
    def to_create_application(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to create a new application.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_CreateApplication.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toCreateApplication", []))

    @jsii.member(jsii_name="toCreateApplicationVersion")
    def to_create_application_version(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to create an application version for an application.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_CreateApplicationVersion.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toCreateApplicationVersion", []))

    @jsii.member(jsii_name="toCreateConfigurationTemplate")
    def to_create_configuration_template(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to create a configuration template.

        Access Level: Write

        Possible conditions:

        - .ifFromApplication()
        - .ifFromApplicationVersion()
        - .ifFromConfigurationTemplate()
        - .ifFromEnvironment()
        - .ifFromSolutionStack()
        - .ifFromPlatform()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_CreateConfigurationTemplate.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toCreateConfigurationTemplate", []))

    @jsii.member(jsii_name="toCreateEnvironment")
    def to_create_environment(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to launch an environment for an application.

        Access Level: Write

        Possible conditions:

        - .ifFromApplicationVersion()
        - .ifFromConfigurationTemplate()
        - .ifFromSolutionStack()
        - .ifFromPlatform()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_CreateEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toCreateEnvironment", []))

    @jsii.member(jsii_name="toCreatePlatformVersion")
    def to_create_platform_version(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to create a new version of a custom platform.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_CreatePlatformVersion.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toCreatePlatformVersion", []))

    @jsii.member(jsii_name="toCreateStorageLocation")
    def to_create_storage_location(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to create the Amazon S3 storage location for the account.

        Access Level: Write

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_CreateStorageLocation.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toCreateStorageLocation", []))

    @jsii.member(jsii_name="toDeleteApplication")
    def to_delete_application(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to delete an application along with all associated versions and configurations.

        Access Level: Write

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DeleteApplication.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDeleteApplication", []))

    @jsii.member(jsii_name="toDeleteApplicationVersion")
    def to_delete_application_version(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to delete an application version from an application.

        Access Level: Write

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DeleteApplicationVersion.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDeleteApplicationVersion", []))

    @jsii.member(jsii_name="toDeleteConfigurationTemplate")
    def to_delete_configuration_template(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to delete a configuration template.

        Access Level: Write

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DeleteConfigurationTemplate.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDeleteConfigurationTemplate", []))

    @jsii.member(jsii_name="toDeleteEnvironmentConfiguration")
    def to_delete_environment_configuration(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to delete the draft configuration associated with the running environment.

        Access Level: Write

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DeleteEnvironmentConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDeleteEnvironmentConfiguration", []))

    @jsii.member(jsii_name="toDeletePlatformVersion")
    def to_delete_platform_version(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to delete a version of a custom platform.

        Access Level: Write

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DeletePlatformVersion.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDeletePlatformVersion", []))

    @jsii.member(jsii_name="toDescribeAccountAttributes")
    def to_describe_account_attributes(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to retrieve a list of account attributes, including resource quotas.

        Access Level: Read

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DescribeAccountAttributes.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDescribeAccountAttributes", []))

    @jsii.member(jsii_name="toDescribeApplications")
    def to_describe_applications(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to retrieve the descriptions of existing applications.

        Access Level: List

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DescribeApplications.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDescribeApplications", []))

    @jsii.member(jsii_name="toDescribeApplicationVersions")
    def to_describe_application_versions(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to retrieve a list of application versions stored in an AWS Elastic Beanstalk storage bucket.

        Access Level: List

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DescribeApplicationVersions.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDescribeApplicationVersions", []))

    @jsii.member(jsii_name="toDescribeConfigurationOptions")
    def to_describe_configuration_options(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to retrieve descriptions of environment configuration options.

        Access Level: Read

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DescribeConfigurationOptions.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDescribeConfigurationOptions", []))

    @jsii.member(jsii_name="toDescribeConfigurationSettings")
    def to_describe_configuration_settings(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to retrieve a description of the settings for a configuration set.

        Access Level: Read

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DescribeConfigurationSettings.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDescribeConfigurationSettings", []))

    @jsii.member(jsii_name="toDescribeEnvironmentHealth")
    def to_describe_environment_health(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to retrieve information about the overall health of an environment.

        Access Level: Read

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DescribeEnvironmentHealth.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDescribeEnvironmentHealth", []))

    @jsii.member(jsii_name="toDescribeEnvironmentManagedActionHistory")
    def to_describe_environment_managed_action_history(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to retrieve a list of an environment's completed and failed managed actions.

        Access Level: Read

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DescribeEnvironmentManagedActionHistory.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDescribeEnvironmentManagedActionHistory", []))

    @jsii.member(jsii_name="toDescribeEnvironmentManagedActions")
    def to_describe_environment_managed_actions(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to retrieve a list of an environment's upcoming and in-progress managed actions.

        Access Level: Read

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DescribeEnvironmentManagedActions.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDescribeEnvironmentManagedActions", []))

    @jsii.member(jsii_name="toDescribeEnvironmentResources")
    def to_describe_environment_resources(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to retrieve a list of AWS resources for an environment.

        Access Level: Read

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DescribeEnvironmentResources.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDescribeEnvironmentResources", []))

    @jsii.member(jsii_name="toDescribeEnvironments")
    def to_describe_environments(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to retrieve descriptions for existing environments.

        Access Level: List

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DescribeEnvironments.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDescribeEnvironments", []))

    @jsii.member(jsii_name="toDescribeEvents")
    def to_describe_events(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to retrieve a list of event descriptions matching a set of criteria.

        Access Level: Read

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DescribeEvents.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDescribeEvents", []))

    @jsii.member(jsii_name="toDescribeInstancesHealth")
    def to_describe_instances_health(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to retrieve more detailed information about the health of environment instances.

        Access Level: Read

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DescribeInstancesHealth.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDescribeInstancesHealth", []))

    @jsii.member(jsii_name="toDescribePlatformVersion")
    def to_describe_platform_version(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to retrieve a description of a platform version.

        Access Level: Read

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DescribePlatformVersion.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDescribePlatformVersion", []))

    @jsii.member(jsii_name="toDisassociateEnvironmentOperationsRole")
    def to_disassociate_environment_operations_role(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to disassociate an operations role with an environment.

        Access Level: Write

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DisassociateEnvironmentOperationsRole.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDisassociateEnvironmentOperationsRole", []))

    @jsii.member(jsii_name="toListAvailableSolutionStacks")
    def to_list_available_solution_stacks(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to retrieve a list of the available solution stack names.

        Access Level: List

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_ListAvailableSolutionStacks.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toListAvailableSolutionStacks", []))

    @jsii.member(jsii_name="toListPlatformBranches")
    def to_list_platform_branches(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to retrieve a list of the available platform branches.

        Access Level: List

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_ListPlatformBranches.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toListPlatformBranches", []))

    @jsii.member(jsii_name="toListPlatformVersions")
    def to_list_platform_versions(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to retrieve a list of the available platforms.

        Access Level: List

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_ListPlatformVersions.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toListPlatformVersions", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to retrieve a list of tags of an Elastic Beanstalk resource.

        Access Level: Read

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutInstanceStatistics")
    def to_put_instance_statistics(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to submit instance statistics for enhanced health.

        Access Level: Write

        https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/health-enhanced.html#health-enhanced-authz

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toPutInstanceStatistics", []))

    @jsii.member(jsii_name="toRebuildEnvironment")
    def to_rebuild_environment(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to delete and recreate all of the AWS resources for an environment and to force a restart.

        Access Level: Write

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_RebuildEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toRebuildEnvironment", []))

    @jsii.member(jsii_name="toRemoveTags")
    def to_remove_tags(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to remove tags from an Elastic Beanstalk resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_UpdateTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toRemoveTags", []))

    @jsii.member(jsii_name="toRequestEnvironmentInfo")
    def to_request_environment_info(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to initiate a request to compile information of the deployed environment.

        Access Level: Read

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_RequestEnvironmentInfo.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toRequestEnvironmentInfo", []))

    @jsii.member(jsii_name="toRestartAppServer")
    def to_restart_app_server(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to request an environment to restart the application container server running on each Amazon EC2 instance.

        Access Level: Write

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_RestartAppServer.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toRestartAppServer", []))

    @jsii.member(jsii_name="toRetrieveEnvironmentInfo")
    def to_retrieve_environment_info(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to retrieve the compiled information from a RequestEnvironmentInfo request.

        Access Level: Read

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_RetrieveEnvironmentInfo.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toRetrieveEnvironmentInfo", []))

    @jsii.member(jsii_name="toSwapEnvironmentCNAMEs")
    def to_swap_environment_cnam_es(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to swap the CNAMEs of two environments.

        Access Level: Write

        Possible conditions:

        - .ifFromEnvironment()

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_SwapEnvironmentCNAMEs.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toSwapEnvironmentCNAMEs", []))

    @jsii.member(jsii_name="toTerminateEnvironment")
    def to_terminate_environment(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to terminate an environment.

        Access Level: Write

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_TerminateEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toTerminateEnvironment", []))

    @jsii.member(jsii_name="toUpdateApplication")
    def to_update_application(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to update an application with specified properties.

        Access Level: Write

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_UpdateApplication.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toUpdateApplication", []))

    @jsii.member(jsii_name="toUpdateApplicationResourceLifecycle")
    def to_update_application_resource_lifecycle(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to update the application version lifecycle policy associated with the application.

        Access Level: Write

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_UpdateApplicationResourceLifecycle.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toUpdateApplicationResourceLifecycle", []))

    @jsii.member(jsii_name="toUpdateApplicationVersion")
    def to_update_application_version(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to update an application version with specified properties.

        Access Level: Write

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_UpdateApplicationVersion.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toUpdateApplicationVersion", []))

    @jsii.member(jsii_name="toUpdateConfigurationTemplate")
    def to_update_configuration_template(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to update a configuration template with specified properties or configuration option values.

        Access Level: Write

        Possible conditions:

        - .ifFromApplication()
        - .ifFromApplicationVersion()
        - .ifFromConfigurationTemplate()
        - .ifFromEnvironment()
        - .ifFromSolutionStack()
        - .ifFromPlatform()

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_UpdateConfigurationTemplate.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toUpdateConfigurationTemplate", []))

    @jsii.member(jsii_name="toUpdateEnvironment")
    def to_update_environment(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to update an environment.

        Access Level: Write

        Possible conditions:

        - .ifFromApplicationVersion()
        - .ifFromConfigurationTemplate()
        - .ifFromSolutionStack()
        - .ifFromPlatform()

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_UpdateEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toUpdateEnvironment", []))

    @jsii.member(jsii_name="toValidateConfigurationSettings")
    def to_validate_configuration_settings(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to check the validity of a set of configuration settings for a configuration template or an environment.

        Access Level: Read

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_ValidateConfigurationSettings.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toValidateConfigurationSettings", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Elasticfilesystem(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Elasticfilesystem",
):
    '''(experimental) Statement provider for service `elasticfilesystem <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticfilesystem.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `elasticfilesystem <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticfilesystem.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Elasticfilesystem, self, [sid])

    @jsii.member(jsii_name="ifAccessedViaMountTarget")
    def if_accessed_via_mount_target(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Elasticfilesystem":
        '''(experimental) Filters access by whether the file system is accessed via mount targets.

        https://docs.aws.amazon.com/efs/latest/ug/mounting-fs.html

        Applies to actions:

        - .toClientMount()
        - .toClientRootAccess()
        - .toClientWrite()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "ifAccessedViaMountTarget", [value]))

    @jsii.member(jsii_name="ifAccessPointArn")
    def if_access_point_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticfilesystem":
        '''(experimental) Filters access by the ARN of the access point used to mount the file system.

        https://docs.aws.amazon.com/efs/latest/ug/efs-access-points.html

        Applies to actions:

        - .toClientMount()
        - .toClientRootAccess()
        - .toClientWrite()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "ifAccessPointArn", [value, operator]))

    @jsii.member(jsii_name="ifEncrypted")
    def if_encrypted(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Elasticfilesystem":
        '''(experimental) Filters access by whether users can create only encrypted or unencrypted file systems.

        https://docs.aws.amazon.com/efs/latest/ug/encryption.html

        Applies to actions:

        - .toCreateFileSystem()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "ifEncrypted", [value]))

    @jsii.member(jsii_name="onAccessPoint")
    def on_access_point(
        self,
        access_point_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticfilesystem":
        '''(experimental) Adds a resource of type access-point to the statement.

        https://docs.aws.amazon.com/efs/latest/ug/access-control-overview.html#access-control-resources

        :param access_point_id: - Identifier for the accessPointId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "onAccessPoint", [access_point_id, account, region, partition]))

    @jsii.member(jsii_name="onFileSystem")
    def on_file_system(
        self,
        file_system_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticfilesystem":
        '''(experimental) Adds a resource of type file-system to the statement.

        https://docs.aws.amazon.com/efs/latest/ug/access-control-overview.html#access-control-resources

        :param file_system_id: - Identifier for the fileSystemId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "onFileSystem", [file_system_id, account, region, partition]))

    @jsii.member(jsii_name="toBackup")
    def to_backup(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to start a backup job for an existing file system.

        Access Level: Write

        https://docs.aws.amazon.com/efs/latest/ug/efs-backup-solutions.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toBackup", []))

    @jsii.member(jsii_name="toClientMount")
    def to_client_mount(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to allow an NFS client read-access to a file system.

        Access Level: Read

        Possible conditions:

        - .ifAccessPointArn()
        - .ifAccessedViaMountTarget()

        https://docs.aws.amazon.com/efs/latest/ug/efs-client-authorization.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toClientMount", []))

    @jsii.member(jsii_name="toClientRootAccess")
    def to_client_root_access(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to allow an NFS client root-access to a file system.

        Access Level: Write

        Possible conditions:

        - .ifAccessPointArn()
        - .ifAccessedViaMountTarget()

        https://docs.aws.amazon.com/efs/latest/ug/efs-client-authorization.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toClientRootAccess", []))

    @jsii.member(jsii_name="toClientWrite")
    def to_client_write(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to allow an NFS client write-access to a file system.

        Access Level: Write

        Possible conditions:

        - .ifAccessPointArn()
        - .ifAccessedViaMountTarget()

        https://docs.aws.amazon.com/efs/latest/ug/efs-client-authorization.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toClientWrite", []))

    @jsii.member(jsii_name="toCreateAccessPoint")
    def to_create_access_point(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to create an access point for the specified file system.

        Access Level: Write

        https://docs.aws.amazon.com/efs/latest/ug/API_CreateAccessPoint.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toCreateAccessPoint", []))

    @jsii.member(jsii_name="toCreateFileSystem")
    def to_create_file_system(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to create a new, empty file system.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifEncrypted()

        https://docs.aws.amazon.com/efs/latest/ug/API_CreateFileSystem.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toCreateFileSystem", []))

    @jsii.member(jsii_name="toCreateMountTarget")
    def to_create_mount_target(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to create a mount target for a file system.

        Access Level: Write

        https://docs.aws.amazon.com/efs/latest/ug/API_CreateMountTarget.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toCreateMountTarget", []))

    @jsii.member(jsii_name="toCreateTags")
    def to_create_tags(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to create or overwrite tags associated with a file system; deprecated, see TagResource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/efs/latest/ug/API_CreateTags.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toCreateTags", []))

    @jsii.member(jsii_name="toDeleteAccessPoint")
    def to_delete_access_point(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to delete the specified access point.

        Access Level: Write

        https://docs.aws.amazon.com/efs/latest/ug/API_DeleteAccessPoint.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toDeleteAccessPoint", []))

    @jsii.member(jsii_name="toDeleteFileSystem")
    def to_delete_file_system(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to delete a file system, permanently severing access to its contents.

        Access Level: Write

        https://docs.aws.amazon.com/efs/latest/ug/API_DeleteFileSystem.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toDeleteFileSystem", []))

    @jsii.member(jsii_name="toDeleteFileSystemPolicy")
    def to_delete_file_system_policy(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to delete the resource-level policy for a file system.

        Access Level: Write

        https://docs.aws.amazon.com/efs/latest/ug/API_DeleteFileSystemPolicy.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toDeleteFileSystemPolicy", []))

    @jsii.member(jsii_name="toDeleteMountTarget")
    def to_delete_mount_target(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to delete the specified mount target.

        Access Level: Write

        https://docs.aws.amazon.com/efs/latest/ug/API_DeleteMountTarget.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toDeleteMountTarget", []))

    @jsii.member(jsii_name="toDeleteTags")
    def to_delete_tags(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to delete the specified tags from a file system; deprecated, see UntagResource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/efs/latest/ug/API_DeleteTags.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toDeleteTags", []))

    @jsii.member(jsii_name="toDescribeAccessPoints")
    def to_describe_access_points(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to view the descriptions of Amazon EFS access points.

        Access Level: List

        https://docs.aws.amazon.com/efs/latest/ug/API_DescribeAccessPoints.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toDescribeAccessPoints", []))

    @jsii.member(jsii_name="toDescribeBackupPolicy")
    def to_describe_backup_policy(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to view the BackupPolicy object for an Amazon EFS file system.

        Access Level: Read

        https://docs.aws.amazon.com/efs/latest/ug/API_DescribeBackupPolicy.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toDescribeBackupPolicy", []))

    @jsii.member(jsii_name="toDescribeFileSystemPolicy")
    def to_describe_file_system_policy(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to view the resource-level policy for an Amazon EFS file system.

        Access Level: Read

        https://docs.aws.amazon.com/efs/latest/ug/API_DescribeFileSystemPolicy.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toDescribeFileSystemPolicy", []))

    @jsii.member(jsii_name="toDescribeFileSystems")
    def to_describe_file_systems(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to view the description of an Amazon EFS file system specified by file system CreationToken or FileSystemId;

        or to view the description of all file systems owned by the caller's AWS account in the AWS region of the endpoint that is being called

        Access Level: List

        https://docs.aws.amazon.com/efs/latest/ug/API_DescribeFileSystems.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toDescribeFileSystems", []))

    @jsii.member(jsii_name="toDescribeLifecycleConfiguration")
    def to_describe_lifecycle_configuration(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to view the LifecycleConfiguration object for an Amazon EFS file system.

        Access Level: Read

        https://docs.aws.amazon.com/efs/latest/ug/API_DescribeLifecycleConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toDescribeLifecycleConfiguration", []))

    @jsii.member(jsii_name="toDescribeMountTargets")
    def to_describe_mount_targets(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to view the descriptions of all mount targets, or a specific mount target, for a file system.

        Access Level: Read

        https://docs.aws.amazon.com/efs/latest/ug/API_DescribeMountTargets.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toDescribeMountTargets", []))

    @jsii.member(jsii_name="toDescribeMountTargetSecurityGroups")
    def to_describe_mount_target_security_groups(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to view the security groups in effect for a mount target.

        Access Level: Read

        https://docs.aws.amazon.com/efs/latest/ug/API_DescribeMountTargetSecurityGroups.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toDescribeMountTargetSecurityGroups", []))

    @jsii.member(jsii_name="toDescribeTags")
    def to_describe_tags(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to view the tags associated with a file system.

        Access Level: Read

        https://docs.aws.amazon.com/efs/latest/ug/API_DescribeTags.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toDescribeTags", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to view the tags associated with the specified Amazon EFS resource.

        Access Level: Read

        https://docs.aws.amazon.com/efs/latest/ug/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toModifyMountTargetSecurityGroups")
    def to_modify_mount_target_security_groups(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to modify the set of security groups in effect for a mount target.

        Access Level: Write

        https://docs.aws.amazon.com/efs/latest/ug/API_ModifyMountTargetSecurityGroups.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toModifyMountTargetSecurityGroups", []))

    @jsii.member(jsii_name="toPutBackupPolicy")
    def to_put_backup_policy(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to enable or disable automatic backups with AWS Backup by creating a new BackupPolicy object.

        Access Level: Write

        https://docs.aws.amazon.com/efs/latest/ug/API_PutBackupPolicy.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toPutBackupPolicy", []))

    @jsii.member(jsii_name="toPutFileSystemPolicy")
    def to_put_file_system_policy(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to apply a resource-level policy that defines the actions allowed or denied from given actors for the specified file system.

        Access Level: Write

        https://docs.aws.amazon.com/efs/latest/ug/API_PutFileSystemPolicy.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toPutFileSystemPolicy", []))

    @jsii.member(jsii_name="toPutLifecycleConfiguration")
    def to_put_lifecycle_configuration(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to enable lifecycle management by creating a new LifecycleConfiguration object.

        Access Level: Write

        https://docs.aws.amazon.com/efs/latest/ug/API_PutLifecycleConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toPutLifecycleConfiguration", []))

    @jsii.member(jsii_name="toRestore")
    def to_restore(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to start a restore job for a backup of a file system.

        Access Level: Write

        https://docs.aws.amazon.com/efs/latest/ug/efs-backup-solutions.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toRestore", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to create or overwrite tags associated with the specified Amazon EFS resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/efs/latest/ug/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to delete the specified tags from an Amazon EFS resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/efs/latest/ug/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateFileSystem")
    def to_update_file_system(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to update the throughput mode or the amount of provisioned throughput of an existing file system.

        Access Level: Write

        https://docs.aws.amazon.com/efs/latest/ug/API_UpdateFileSystem.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toUpdateFileSystem", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Elasticloadbalancing(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Elasticloadbalancing",
):
    '''(experimental) Statement provider for service `elasticloadbalancing <https://docs.aws.amazon.com/service-authorization/latest/reference/list_elasticloadbalancing.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `elasticloadbalancing <https://docs.aws.amazon.com/service-authorization/latest/reference/list_elasticloadbalancing.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Elasticloadbalancing, self, [sid])

    @jsii.member(jsii_name="ifResourceTag")
    def if_resource_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticloadbalancing":
        '''(experimental) A tag key and value pair.

        Applies to resource types:

        - loadbalancer

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "ifResourceTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifResourceTagExists")
    def if_resource_tag_exists(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticloadbalancing":
        '''(experimental) The preface string for a tag key and value pair attached to a resource.

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "ifResourceTagExists", [value, operator]))

    @jsii.member(jsii_name="onLoadbalancer")
    def on_loadbalancer(
        self,
        load_balancer_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticloadbalancing":
        '''(experimental) Adds a resource of type loadbalancer to the statement.

        https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/what-is-load-balancing.html

        :param load_balancer_name: - Identifier for the loadBalancerName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "onLoadbalancer", [load_balancer_name, account, region, partition]))

    @jsii.member(jsii_name="toAddTags")
    def to_add_tags(self) -> "Elasticloadbalancing":
        '''(experimental) Adds the specified tags to the specified load balancer. Each load balancer can have a maximum of 10 tags.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_AddTags.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toAddTags", []))

    @jsii.member(jsii_name="toApplySecurityGroupsToLoadBalancer")
    def to_apply_security_groups_to_load_balancer(self) -> "Elasticloadbalancing":
        '''(experimental) Associates one or more security groups with your load balancer in a virtual private cloud (VPC).

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_ApplySecurityGroupsToLoadBalancer.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toApplySecurityGroupsToLoadBalancer", []))

    @jsii.member(jsii_name="toAttachLoadBalancerToSubnets")
    def to_attach_load_balancer_to_subnets(self) -> "Elasticloadbalancing":
        '''(experimental) Adds one or more subnets to the set of configured subnets for the specified load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_AttachLoadBalancerToSubnets.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toAttachLoadBalancerToSubnets", []))

    @jsii.member(jsii_name="toConfigureHealthCheck")
    def to_configure_health_check(self) -> "Elasticloadbalancing":
        '''(experimental) Specifies the health check settings to use when evaluating the health state of your back-end instances.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_ConfigureHealthCheck.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toConfigureHealthCheck", []))

    @jsii.member(jsii_name="toCreateAppCookieStickinessPolicy")
    def to_create_app_cookie_stickiness_policy(self) -> "Elasticloadbalancing":
        '''(experimental) Generates a stickiness policy with sticky session lifetimes that follow that of an application-generated cookie.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_CreateAppCookieStickinessPolicy.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toCreateAppCookieStickinessPolicy", []))

    @jsii.member(jsii_name="toCreateLBCookieStickinessPolicy")
    def to_create_lb_cookie_stickiness_policy(self) -> "Elasticloadbalancing":
        '''(experimental) Generates a stickiness policy with sticky session lifetimes controlled by the lifetime of the browser (user-agent) or a specified expiration period.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_CreateLBCookieStickinessPolicy.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toCreateLBCookieStickinessPolicy", []))

    @jsii.member(jsii_name="toCreateLoadBalancer")
    def to_create_load_balancer(self) -> "Elasticloadbalancing":
        '''(experimental) Creates a load balancer.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_CreateLoadBalancer.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toCreateLoadBalancer", []))

    @jsii.member(jsii_name="toCreateLoadBalancerListeners")
    def to_create_load_balancer_listeners(self) -> "Elasticloadbalancing":
        '''(experimental) Creates one or more listeners for the specified load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_CreateLoadBalancerListeners.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toCreateLoadBalancerListeners", []))

    @jsii.member(jsii_name="toCreateLoadBalancerPolicy")
    def to_create_load_balancer_policy(self) -> "Elasticloadbalancing":
        '''(experimental) Creates a policy with the specified attributes for the specified load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_CreateLoadBalancerPolicy.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toCreateLoadBalancerPolicy", []))

    @jsii.member(jsii_name="toDeleteLoadBalancer")
    def to_delete_load_balancer(self) -> "Elasticloadbalancing":
        '''(experimental) Deletes the specified load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_DeleteLoadBalancer.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toDeleteLoadBalancer", []))

    @jsii.member(jsii_name="toDeleteLoadBalancerListeners")
    def to_delete_load_balancer_listeners(self) -> "Elasticloadbalancing":
        '''(experimental) Deletes the specified listeners from the specified load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_DeleteLoadBalancerListeners.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toDeleteLoadBalancerListeners", []))

    @jsii.member(jsii_name="toDeleteLoadBalancerPolicy")
    def to_delete_load_balancer_policy(self) -> "Elasticloadbalancing":
        '''(experimental) Deletes the specified policy from the specified load balancer. This policy must not be enabled for any listeners.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_DeleteLoadBalancerPolicy.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toDeleteLoadBalancerPolicy", []))

    @jsii.member(jsii_name="toDeregisterInstancesFromLoadBalancer")
    def to_deregister_instances_from_load_balancer(self) -> "Elasticloadbalancing":
        '''(experimental) Deregisters the specified instances from the specified load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_DeregisterInstancesFromLoadBalancer.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toDeregisterInstancesFromLoadBalancer", []))

    @jsii.member(jsii_name="toDescribeInstanceHealth")
    def to_describe_instance_health(self) -> "Elasticloadbalancing":
        '''(experimental) Describes the state of the specified instances with respect to the specified load balancer.

        Access Level: Read

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_DescribeInstanceHealth.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toDescribeInstanceHealth", []))

    @jsii.member(jsii_name="toDescribeLoadBalancerAttributes")
    def to_describe_load_balancer_attributes(self) -> "Elasticloadbalancing":
        '''(experimental) Describes the attributes for the specified load balancer.

        Access Level: Read

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_DescribeLoadBalancerAttributes.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toDescribeLoadBalancerAttributes", []))

    @jsii.member(jsii_name="toDescribeLoadBalancerPolicies")
    def to_describe_load_balancer_policies(self) -> "Elasticloadbalancing":
        '''(experimental) Describes the specified policies.

        Access Level: Read

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_DescribeLoadBalancerPolicies.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toDescribeLoadBalancerPolicies", []))

    @jsii.member(jsii_name="toDescribeLoadBalancerPolicyTypes")
    def to_describe_load_balancer_policy_types(self) -> "Elasticloadbalancing":
        '''(experimental) Describes the specified load balancer policy types.

        Access Level: Read

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_DescribeLoadBalancerPolicyTypes.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toDescribeLoadBalancerPolicyTypes", []))

    @jsii.member(jsii_name="toDescribeLoadBalancers")
    def to_describe_load_balancers(self) -> "Elasticloadbalancing":
        '''(experimental) Describes the specified the load balancers.

        If no load balancers are specified, the call describes all of your load balancers

        Access Level: List

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_DescribeLoadBalancers.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toDescribeLoadBalancers", []))

    @jsii.member(jsii_name="toDescribeTags")
    def to_describe_tags(self) -> "Elasticloadbalancing":
        '''(experimental) Describes the tags associated with the specified load balancers.

        Access Level: Read

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_DescribeTags.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toDescribeTags", []))

    @jsii.member(jsii_name="toDetachLoadBalancerFromSubnets")
    def to_detach_load_balancer_from_subnets(self) -> "Elasticloadbalancing":
        '''(experimental) Removes the specified subnets from the set of configured subnets for the load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_DetachLoadBalancerFromSubnets.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toDetachLoadBalancerFromSubnets", []))

    @jsii.member(jsii_name="toDisableAvailabilityZonesForLoadBalancer")
    def to_disable_availability_zones_for_load_balancer(self) -> "Elasticloadbalancing":
        '''(experimental) Removes the specified Availability Zones from the set of Availability Zones for the specified load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_DisableAvailabilityZonesForLoadBalancer.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toDisableAvailabilityZonesForLoadBalancer", []))

    @jsii.member(jsii_name="toEnableAvailabilityZonesForLoadBalancer")
    def to_enable_availability_zones_for_load_balancer(self) -> "Elasticloadbalancing":
        '''(experimental) Adds the specified Availability Zones to the set of Availability Zones for the specified load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_EnableAvailabilityZonesForLoadBalancer.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toEnableAvailabilityZonesForLoadBalancer", []))

    @jsii.member(jsii_name="toModifyLoadBalancerAttributes")
    def to_modify_load_balancer_attributes(self) -> "Elasticloadbalancing":
        '''(experimental) Modifies the attributes of the specified load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_ModifyLoadBalancerAttributes.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toModifyLoadBalancerAttributes", []))

    @jsii.member(jsii_name="toRegisterInstancesWithLoadBalancer")
    def to_register_instances_with_load_balancer(self) -> "Elasticloadbalancing":
        '''(experimental) Adds the specified instances to the specified load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_RegisterInstancesWithLoadBalancer.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toRegisterInstancesWithLoadBalancer", []))

    @jsii.member(jsii_name="toRemoveTags")
    def to_remove_tags(self) -> "Elasticloadbalancing":
        '''(experimental) Removes one or more tags from the specified load balancer.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_RemoveTags.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toRemoveTags", []))

    @jsii.member(jsii_name="toSetLoadBalancerListenerSSLCertificate")
    def to_set_load_balancer_listener_ssl_certificate(self) -> "Elasticloadbalancing":
        '''(experimental) Sets the certificate that terminates the specified listener's SSL connections.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_SetLoadBalancerListenerSSLCertificate.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toSetLoadBalancerListenerSSLCertificate", []))

    @jsii.member(jsii_name="toSetLoadBalancerPoliciesForBackendServer")
    def to_set_load_balancer_policies_for_backend_server(
        self,
    ) -> "Elasticloadbalancing":
        '''(experimental) Replaces the set of policies associated with the specified port on which the back-end server is listening with a new set of policies.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_SetLoadBalancerPoliciesForBackendServer.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toSetLoadBalancerPoliciesForBackendServer", []))

    @jsii.member(jsii_name="toSetLoadBalancerPoliciesOfListener")
    def to_set_load_balancer_policies_of_listener(self) -> "Elasticloadbalancing":
        '''(experimental) Replaces the current set of policies for the specified load balancer port with the specified set of policies.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_SetLoadBalancerPoliciesOfListener.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toSetLoadBalancerPoliciesOfListener", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class ElasticloadbalancingV2(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.ElasticloadbalancingV2",
):
    '''(experimental) Statement provider for service `elasticloadbalancing-v2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_elasticloadbalancingv2.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `elasticloadbalancing-v2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_elasticloadbalancingv2.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(ElasticloadbalancingV2, self, [sid])

    @jsii.member(jsii_name="ifResourceTag")
    def if_resource_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ElasticloadbalancingV2":
        '''(experimental) A tag key and value pair.

        Applies to resource types:

        - listener/app
        - listener-rule/app
        - listener/net
        - listener-rule/net
        - loadbalancer/app/
        - loadbalancer/net/
        - targetgroup

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "ifResourceTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="onListenerApp")
    def on_listener_app(
        self,
        load_balancer_name: builtins.str,
        load_balancer_id: builtins.str,
        listener_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ElasticloadbalancingV2":
        '''(experimental) Adds a resource of type listener/app to the statement.

        https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-listeners.html

        :param load_balancer_name: - Identifier for the loadBalancerName.
        :param load_balancer_id: - Identifier for the loadBalancerId.
        :param listener_id: - Identifier for the listenerId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "onListenerApp", [load_balancer_name, load_balancer_id, listener_id, account, region, partition]))

    @jsii.member(jsii_name="onListenerNet")
    def on_listener_net(
        self,
        load_balancer_name: builtins.str,
        load_balancer_id: builtins.str,
        listener_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ElasticloadbalancingV2":
        '''(experimental) Adds a resource of type listener/net to the statement.

        https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-listeners.html

        :param load_balancer_name: - Identifier for the loadBalancerName.
        :param load_balancer_id: - Identifier for the loadBalancerId.
        :param listener_id: - Identifier for the listenerId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "onListenerNet", [load_balancer_name, load_balancer_id, listener_id, account, region, partition]))

    @jsii.member(jsii_name="onListenerRuleApp")
    def on_listener_rule_app(
        self,
        load_balancer_name: builtins.str,
        load_balancer_id: builtins.str,
        listener_id: builtins.str,
        listener_rule_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ElasticloadbalancingV2":
        '''(experimental) Adds a resource of type listener-rule/app to the statement.

        https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-update-rules.html

        :param load_balancer_name: - Identifier for the loadBalancerName.
        :param load_balancer_id: - Identifier for the loadBalancerId.
        :param listener_id: - Identifier for the listenerId.
        :param listener_rule_id: - Identifier for the listenerRuleId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "onListenerRuleApp", [load_balancer_name, load_balancer_id, listener_id, listener_rule_id, account, region, partition]))

    @jsii.member(jsii_name="onListenerRuleNet")
    def on_listener_rule_net(
        self,
        load_balancer_name: builtins.str,
        load_balancer_id: builtins.str,
        listener_id: builtins.str,
        listener_rule_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ElasticloadbalancingV2":
        '''(experimental) Adds a resource of type listener-rule/net to the statement.

        https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-update-rules.html

        :param load_balancer_name: - Identifier for the loadBalancerName.
        :param load_balancer_id: - Identifier for the loadBalancerId.
        :param listener_id: - Identifier for the listenerId.
        :param listener_rule_id: - Identifier for the listenerRuleId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "onListenerRuleNet", [load_balancer_name, load_balancer_id, listener_id, listener_rule_id, account, region, partition]))

    @jsii.member(jsii_name="onLoadbalancerApp")
    def on_loadbalancer_app(
        self,
        load_balancer_name: builtins.str,
        load_balancer_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ElasticloadbalancingV2":
        '''(experimental) Adds a resource of type loadbalancer/app/ to the statement.

        https://docs.aws.amazon.com/elasticloadbalancing/latest/application/introduction.html#application-load-balancer-overview

        :param load_balancer_name: - Identifier for the loadBalancerName.
        :param load_balancer_id: - Identifier for the loadBalancerId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "onLoadbalancerApp", [load_balancer_name, load_balancer_id, account, region, partition]))

    @jsii.member(jsii_name="onLoadbalancerNet")
    def on_loadbalancer_net(
        self,
        load_balancer_name: builtins.str,
        load_balancer_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ElasticloadbalancingV2":
        '''(experimental) Adds a resource of type loadbalancer/net/ to the statement.

        https://docs.aws.amazon.com/elasticloadbalancing/latest/network/introduction.html#network-load-balancer-overview

        :param load_balancer_name: - Identifier for the loadBalancerName.
        :param load_balancer_id: - Identifier for the loadBalancerId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "onLoadbalancerNet", [load_balancer_name, load_balancer_id, account, region, partition]))

    @jsii.member(jsii_name="onTargetgroup")
    def on_targetgroup(
        self,
        target_group_name: builtins.str,
        target_group_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ElasticloadbalancingV2":
        '''(experimental) Adds a resource of type targetgroup to the statement.

        https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-target-groups.html

        :param target_group_name: - Identifier for the targetGroupName.
        :param target_group_id: - Identifier for the targetGroupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "onTargetgroup", [target_group_name, target_group_id, account, region, partition]))

    @jsii.member(jsii_name="toAddListenerCertificates")
    def to_add_listener_certificates(self) -> "ElasticloadbalancingV2":
        '''(experimental) Adds the specified certificates to the specified secure listener.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_AddListenerCertificates.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toAddListenerCertificates", []))

    @jsii.member(jsii_name="toAddTags")
    def to_add_tags(self) -> "ElasticloadbalancingV2":
        '''(experimental) Adds the specified tags to the specified load balancer. Each load balancer can have a maximum of 10 tags.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_AddTags.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toAddTags", []))

    @jsii.member(jsii_name="toCreateListener")
    def to_create_listener(self) -> "ElasticloadbalancingV2":
        '''(experimental) Creates a listener for the specified Application Load Balancer.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_CreateListener.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toCreateListener", []))

    @jsii.member(jsii_name="toCreateLoadBalancer")
    def to_create_load_balancer(self) -> "ElasticloadbalancingV2":
        '''(experimental) Creates a load balancer.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_CreateLoadBalancer.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toCreateLoadBalancer", []))

    @jsii.member(jsii_name="toCreateRule")
    def to_create_rule(self) -> "ElasticloadbalancingV2":
        '''(experimental) Creates a rule for the specified listener.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_CreateRule.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toCreateRule", []))

    @jsii.member(jsii_name="toCreateTargetGroup")
    def to_create_target_group(self) -> "ElasticloadbalancingV2":
        '''(experimental) Creates a target group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_CreateTargetGroup.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toCreateTargetGroup", []))

    @jsii.member(jsii_name="toDeleteListener")
    def to_delete_listener(self) -> "ElasticloadbalancingV2":
        '''(experimental) Deletes the specified listener.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DeleteListener.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toDeleteListener", []))

    @jsii.member(jsii_name="toDeleteLoadBalancer")
    def to_delete_load_balancer(self) -> "ElasticloadbalancingV2":
        '''(experimental) Deletes the specified load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DeleteLoadBalancer.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toDeleteLoadBalancer", []))

    @jsii.member(jsii_name="toDeleteRule")
    def to_delete_rule(self) -> "ElasticloadbalancingV2":
        '''(experimental) Deletes the specified rule.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DeleteRule.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toDeleteRule", []))

    @jsii.member(jsii_name="toDeleteTargetGroup")
    def to_delete_target_group(self) -> "ElasticloadbalancingV2":
        '''(experimental) Deletes the specified target group.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DeleteTargetGroup.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toDeleteTargetGroup", []))

    @jsii.member(jsii_name="toDeregisterTargets")
    def to_deregister_targets(self) -> "ElasticloadbalancingV2":
        '''(experimental) Deregisters the specified targets from the specified target group.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DeregisterTargets.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toDeregisterTargets", []))

    @jsii.member(jsii_name="toDescribeAccountLimits")
    def to_describe_account_limits(self) -> "ElasticloadbalancingV2":
        '''(experimental) Describes the Elastic Load Balancing resource limits for the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DescribeAccountLimits.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toDescribeAccountLimits", []))

    @jsii.member(jsii_name="toDescribeListenerCertificates")
    def to_describe_listener_certificates(self) -> "ElasticloadbalancingV2":
        '''(experimental) Describes the certificates for the specified secure listener.

        Access Level: Read

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DescribeListenerCertificates.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toDescribeListenerCertificates", []))

    @jsii.member(jsii_name="toDescribeListeners")
    def to_describe_listeners(self) -> "ElasticloadbalancingV2":
        '''(experimental) Describes the specified listeners or the listeners for the specified Application Load Balancer.

        Access Level: Read

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DescribeListeners.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toDescribeListeners", []))

    @jsii.member(jsii_name="toDescribeLoadBalancerAttributes")
    def to_describe_load_balancer_attributes(self) -> "ElasticloadbalancingV2":
        '''(experimental) Describes the attributes for the specified load balancer.

        Access Level: Read

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DescribeLoadBalancerAttributes.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toDescribeLoadBalancerAttributes", []))

    @jsii.member(jsii_name="toDescribeLoadBalancers")
    def to_describe_load_balancers(self) -> "ElasticloadbalancingV2":
        '''(experimental) Describes the specified the load balancers.

        If no load balancers are specified, the call describes all of your load balancers

        Access Level: Read

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DescribeLoadBalancers.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toDescribeLoadBalancers", []))

    @jsii.member(jsii_name="toDescribeRules")
    def to_describe_rules(self) -> "ElasticloadbalancingV2":
        '''(experimental) Describes the specified rules or the rules for the specified listener.

        Access Level: Read

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DescribeRules.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toDescribeRules", []))

    @jsii.member(jsii_name="toDescribeSSLPolicies")
    def to_describe_ssl_policies(self) -> "ElasticloadbalancingV2":
        '''(experimental) Describes the specified policies or all policies used for SSL negotiation.

        Access Level: Read

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DescribeSSLPolicies.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toDescribeSSLPolicies", []))

    @jsii.member(jsii_name="toDescribeTags")
    def to_describe_tags(self) -> "ElasticloadbalancingV2":
        '''(experimental) Describes the tags associated with the specified resource.

        Access Level: Read

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DescribeTags.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toDescribeTags", []))

    @jsii.member(jsii_name="toDescribeTargetGroupAttributes")
    def to_describe_target_group_attributes(self) -> "ElasticloadbalancingV2":
        '''(experimental) Describes the attributes for the specified target group.

        Access Level: Read

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DescribeTargetGroupAttributes.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toDescribeTargetGroupAttributes", []))

    @jsii.member(jsii_name="toDescribeTargetGroups")
    def to_describe_target_groups(self) -> "ElasticloadbalancingV2":
        '''(experimental) Describes the specified target groups or all of your target groups.

        Access Level: Read

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DescribeTargetGroups.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toDescribeTargetGroups", []))

    @jsii.member(jsii_name="toDescribeTargetHealth")
    def to_describe_target_health(self) -> "ElasticloadbalancingV2":
        '''(experimental) Describes the health of the specified targets or all of your targets.

        Access Level: Read

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DescribeTargetHealth.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toDescribeTargetHealth", []))

    @jsii.member(jsii_name="toModifyListener")
    def to_modify_listener(self) -> "ElasticloadbalancingV2":
        '''(experimental) Modifies the specified properties of the specified listener.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_ModifyListener.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toModifyListener", []))

    @jsii.member(jsii_name="toModifyLoadBalancerAttributes")
    def to_modify_load_balancer_attributes(self) -> "ElasticloadbalancingV2":
        '''(experimental) Modifies the attributes of the specified load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_ModifyLoadBalancerAttributes.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toModifyLoadBalancerAttributes", []))

    @jsii.member(jsii_name="toModifyRule")
    def to_modify_rule(self) -> "ElasticloadbalancingV2":
        '''(experimental) Modifies the specified rule.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_ModifyRule.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toModifyRule", []))

    @jsii.member(jsii_name="toModifyTargetGroup")
    def to_modify_target_group(self) -> "ElasticloadbalancingV2":
        '''(experimental) Modifies the health checks used when evaluating the health state of the targets in the specified target group.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_ModifyTargetGroup.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toModifyTargetGroup", []))

    @jsii.member(jsii_name="toModifyTargetGroupAttributes")
    def to_modify_target_group_attributes(self) -> "ElasticloadbalancingV2":
        '''(experimental) Modifies the specified attributes of the specified target group.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_ModifyTargetGroupAttributes.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toModifyTargetGroupAttributes", []))

    @jsii.member(jsii_name="toRegisterTargets")
    def to_register_targets(self) -> "ElasticloadbalancingV2":
        '''(experimental) Registers the specified targets with the specified target group.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_RegisterTargets.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toRegisterTargets", []))

    @jsii.member(jsii_name="toRemoveListenerCertificates")
    def to_remove_listener_certificates(self) -> "ElasticloadbalancingV2":
        '''(experimental) Removes the specified certificates of the specified secure listener.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_RemoveListenerCertificates.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toRemoveListenerCertificates", []))

    @jsii.member(jsii_name="toRemoveTags")
    def to_remove_tags(self) -> "ElasticloadbalancingV2":
        '''(experimental) Removes one or more tags from the specified load balancer.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_RemoveTags.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toRemoveTags", []))

    @jsii.member(jsii_name="toSetIpAddressType")
    def to_set_ip_address_type(self) -> "ElasticloadbalancingV2":
        '''(experimental) Not found.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_SetIpAddressType.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toSetIpAddressType", []))

    @jsii.member(jsii_name="toSetRulePriorities")
    def to_set_rule_priorities(self) -> "ElasticloadbalancingV2":
        '''(experimental) Sets the priorities of the specified rules.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_SetRulePriorities.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toSetRulePriorities", []))

    @jsii.member(jsii_name="toSetSecurityGroups")
    def to_set_security_groups(self) -> "ElasticloadbalancingV2":
        '''(experimental) Associates the specified security groups with the specified load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_SetSecurityGroups.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toSetSecurityGroups", []))

    @jsii.member(jsii_name="toSetSubnets")
    def to_set_subnets(self) -> "ElasticloadbalancingV2":
        '''(experimental) Enables the Availability Zone for the specified subnets for the specified load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_SetSubnets.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toSetSubnets", []))

    @jsii.member(jsii_name="toSetWebAcl")
    def to_set_web_acl(self) -> "ElasticloadbalancingV2":
        '''(experimental) Gives WebAcl permission to WAF.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toSetWebAcl", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Elasticmapreduce(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Elasticmapreduce",
):
    '''(experimental) Statement provider for service `elasticmapreduce <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticmapreduce.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `elasticmapreduce <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticmapreduce.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Elasticmapreduce, self, [sid])

    @jsii.member(jsii_name="ifRequestTag")
    def if_request_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticmapreduce":
        '''(experimental) Filters actions based on whether the tag and value pair is provided with the action.

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-plan-access-iam.html#emr-fine-grained-cluster-access

        Applies to actions:

        - .toAddTags()
        - .toCreateEditor()
        - .toRunJobFlow()

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "ifRequestTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifResourceTag")
    def if_resource_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticmapreduce":
        '''(experimental) Filters actions based on the tag and value pair associated with an Amazon EMR resource.

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-plan-access-iam.html#emr-fine-grained-cluster-access

        Applies to resource types:

        - cluster
        - editor

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "ifResourceTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="onCluster")
    def on_cluster(
        self,
        cluster_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticmapreduce":
        '''(experimental) Adds a resource of type cluster to the statement.

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-overview.html

        :param cluster_id: - Identifier for the clusterId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "onCluster", [cluster_id, account, region, partition]))

    @jsii.member(jsii_name="onEditor")
    def on_editor(
        self,
        editor_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticmapreduce":
        '''(experimental) Adds a resource of type editor to the statement.

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-notebooks.html

        :param editor_id: - Identifier for the editorId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "onEditor", [editor_id, account, region, partition]))

    @jsii.member(jsii_name="toAddInstanceFleet")
    def to_add_instance_fleet(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to add an instance fleet to a running cluster.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/APIReference/API_AddInstanceFleet.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toAddInstanceFleet", []))

    @jsii.member(jsii_name="toAddInstanceGroups")
    def to_add_instance_groups(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to add instance groups to a running cluster.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/APIReference/API_AddInstanceGroups.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toAddInstanceGroups", []))

    @jsii.member(jsii_name="toAddJobFlowSteps")
    def to_add_job_flow_steps(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to add new steps to a running cluster.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/APIReference/API_AddJobFlowSteps.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toAddJobFlowSteps", []))

    @jsii.member(jsii_name="toAddTags")
    def to_add_tags(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to add tags to an Amazon EMR resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRequestTag()

        https://docs.aws.amazon.com/emr/latest/APIReference/API_AddTags.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toAddTags", []))

    @jsii.member(jsii_name="toCancelSteps")
    def to_cancel_steps(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to cancel a pending step or steps in a running cluster.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/APIReference/API_CancelSteps.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toCancelSteps", []))

    @jsii.member(jsii_name="toCreateEditor")
    def to_create_editor(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to create an EMR notebook.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRequestTag()

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-notebooks-create.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toCreateEditor", []))

    @jsii.member(jsii_name="toCreateSecurityConfiguration")
    def to_create_security_configuration(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to create a security configuration.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/APIReference/API_CreateSecurityConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toCreateSecurityConfiguration", []))

    @jsii.member(jsii_name="toDeleteEditor")
    def to_delete_editor(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to delete an EMR notebook.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-notebooks.html#emr-managed-notebooks-deleting

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toDeleteEditor", []))

    @jsii.member(jsii_name="toDeleteSecurityConfiguration")
    def to_delete_security_configuration(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to delete a security configuration.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/APIReference/API_DeleteSecurityConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toDeleteSecurityConfiguration", []))

    @jsii.member(jsii_name="toDescribeCluster")
    def to_describe_cluster(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to get details about a cluster, including status, hardware and software configuration, VPC settings, and so on.

        Access Level: Read

        https://docs.aws.amazon.com/emr/latest/APIReference/API_DescribeCluster.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toDescribeCluster", []))

    @jsii.member(jsii_name="toDescribeEditor")
    def to_describe_editor(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to view information about a notebook, including status, user, role, tags, location, and more.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toDescribeEditor", []))

    @jsii.member(jsii_name="toDescribeJobFlows")
    def to_describe_job_flows(self) -> "Elasticmapreduce":
        '''(experimental) This API is deprecated and will eventually be removed.

        We recommend you use ListClusters, DescribeCluster, ListSteps, ListInstanceGroups and ListBootstrapActions instead.

        Access Level: Read

        https://docs.aws.amazon.com/emr/latest/APIReference/API_DescribeJobFlows.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toDescribeJobFlows", []))

    @jsii.member(jsii_name="toDescribeSecurityConfiguration")
    def to_describe_security_configuration(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to get details of a security configuration.

        Access Level: Read

        https://docs.aws.amazon.com/emr/latest/APIReference/API_DescribeSecurityConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toDescribeSecurityConfiguration", []))

    @jsii.member(jsii_name="toDescribeStep")
    def to_describe_step(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to get details about a cluster step.

        Access Level: Read

        https://docs.aws.amazon.com/emr/latest/APIReference/API_DescribeStep.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toDescribeStep", []))

    @jsii.member(jsii_name="toGetBlockPublicAccessConfiguration")
    def to_get_block_public_access_configuration(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to retrieve the EMR block public access configuration for the AWS account in the Region.

        Access Level: Read

        https://docs.aws.amazon.com/emr/latest/APIReference/API_GetBlockPublicAccessConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toGetBlockPublicAccessConfiguration", []))

    @jsii.member(jsii_name="toGetManagedScalingPolicy")
    def to_get_managed_scaling_policy(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to retrieve the managed scaling policy associated with a cluster.

        Access Level: Read

        https://docs.aws.amazon.com/emr/latest/APIReference/API_GetManagedScalingPolicy.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toGetManagedScalingPolicy", []))

    @jsii.member(jsii_name="toListBootstrapActions")
    def to_list_bootstrap_actions(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to get details about the bootstrap actions associated with a cluster.

        Access Level: Read

        https://docs.aws.amazon.com/emr/latest/APIReference/API_ListBootstrapActions.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toListBootstrapActions", []))

    @jsii.member(jsii_name="toListClusters")
    def to_list_clusters(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to get the status of accessible clusters.

        Access Level: List

        https://docs.aws.amazon.com/emr/latest/APIReference/API_ListClusters.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toListClusters", []))

    @jsii.member(jsii_name="toListEditors")
    def to_list_editors(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to list summary information for accessible EMR notebooks.

        Access Level: List

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toListEditors", []))

    @jsii.member(jsii_name="toListInstanceFleets")
    def to_list_instance_fleets(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to get details of instance fleets in a cluster.

        Access Level: Read

        https://docs.aws.amazon.com/emr/latest/APIReference/API_ListInstanceFleets.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toListInstanceFleets", []))

    @jsii.member(jsii_name="toListInstanceGroups")
    def to_list_instance_groups(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to get details of instance groups in a cluster.

        Access Level: Read

        https://docs.aws.amazon.com/emr/latest/APIReference/API_ListInstanceGroups.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toListInstanceGroups", []))

    @jsii.member(jsii_name="toListInstances")
    def to_list_instances(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to get details about the Amazon EC2 instances in a cluster.

        Access Level: Read

        https://docs.aws.amazon.com/emr/latest/APIReference/API_ListInstances.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toListInstances", []))

    @jsii.member(jsii_name="toListSecurityConfigurations")
    def to_list_security_configurations(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to list available security configurations in this account by name, along with creation dates and times.

        Access Level: List

        https://docs.aws.amazon.com/emr/latest/APIReference/API_ListSecurityConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toListSecurityConfigurations", []))

    @jsii.member(jsii_name="toListSteps")
    def to_list_steps(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to list steps associated with a cluster.

        Access Level: Read

        https://docs.aws.amazon.com/emr/latest/APIReference/API_ListSteps.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toListSteps", []))

    @jsii.member(jsii_name="toModifyCluster")
    def to_modify_cluster(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to change cluster settings such as number of steps that can be executed concurrently for a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/APIReference/API_ModifyCluster.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toModifyCluster", []))

    @jsii.member(jsii_name="toModifyInstanceFleet")
    def to_modify_instance_fleet(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to change the target On-Demand and target Spot capacities for a instance fleet.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/APIReference/API_ModifyInstanceFleet.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toModifyInstanceFleet", []))

    @jsii.member(jsii_name="toModifyInstanceGroups")
    def to_modify_instance_groups(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to change the number and configuration of EC2 instances for an instance group.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/APIReference/API_ModifyInstanceGroups.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toModifyInstanceGroups", []))

    @jsii.member(jsii_name="toOpenEditorInConsole")
    def to_open_editor_in_console(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to launch the Jupyter notebook editor for an EMR notebook from within the console.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-notebooks.html#emr-managed-notebooks-editor

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toOpenEditorInConsole", []))

    @jsii.member(jsii_name="toPutAutoScalingPolicy")
    def to_put_auto_scaling_policy(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to create or update an automatic scaling policy for a core instance group or task instance group.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/APIReference/API_PutAutoScalingPolicy.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toPutAutoScalingPolicy", []))

    @jsii.member(jsii_name="toPutBlockPublicAccessConfiguration")
    def to_put_block_public_access_configuration(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to create or update the EMR block public access configuration for the AWS account in the Region.

        Access Level: Permissions management

        https://docs.aws.amazon.com/emr/latest/APIReference/API_PutBlockPublicAccessConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toPutBlockPublicAccessConfiguration", []))

    @jsii.member(jsii_name="toPutManagedScalingPolicy")
    def to_put_managed_scaling_policy(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to create or update the managed scaling policy associated with a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/APIReference/API_PutManagedScalingPolicy.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toPutManagedScalingPolicy", []))

    @jsii.member(jsii_name="toRemoveAutoScalingPolicy")
    def to_remove_auto_scaling_policy(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to remove an automatic scaling policy from an instance group.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/APIReference/API_RemoveAutoScalingPolicy.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toRemoveAutoScalingPolicy", []))

    @jsii.member(jsii_name="toRemoveManagedScalingPolicy")
    def to_remove_managed_scaling_policy(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to remove the managed scaling policy associated with a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/APIReference/API_RemoveManagedScalingPolicy.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toRemoveManagedScalingPolicy", []))

    @jsii.member(jsii_name="toRemoveTags")
    def to_remove_tags(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to remove tags from an Amazon EMR resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/emr/latest/APIReference/API_RemoveTags.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toRemoveTags", []))

    @jsii.member(jsii_name="toRunJobFlow")
    def to_run_job_flow(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to create and launch a cluster (job flow).

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRequestTag()

        https://docs.aws.amazon.com/emr/latest/APIReference/API_RunJobFlow.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toRunJobFlow", []))

    @jsii.member(jsii_name="toSetTerminationProtection")
    def to_set_termination_protection(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to add and remove termination protection for a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/APIReference/API_SetTerminationProtection.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toSetTerminationProtection", []))

    @jsii.member(jsii_name="toStartEditor")
    def to_start_editor(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to start an EMR notebook.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-notebooks-working-with.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toStartEditor", []))

    @jsii.member(jsii_name="toStopEditor")
    def to_stop_editor(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to shut down an EMR notebook.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-notebooks.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toStopEditor", []))

    @jsii.member(jsii_name="toTerminateJobFlows")
    def to_terminate_job_flows(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to terminate a cluster (job flow).

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/APIReference/API_TerminateJobFlows.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toTerminateJobFlows", []))

    @jsii.member(jsii_name="toViewEventsFromAllClustersInConsole")
    def to_view_events_from_all_clusters_in_console(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to use the EMR management console to view events from all clusters.

        Access Level: List

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toViewEventsFromAllClustersInConsole", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Elastictranscoder(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Elastictranscoder",
):
    '''(experimental) Statement provider for service `elastictranscoder <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelastictranscoder.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `elastictranscoder <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelastictranscoder.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Elastictranscoder, self, [sid])

    @jsii.member(jsii_name="onJob")
    def on_job(
        self,
        job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elastictranscoder":
        '''(experimental) Adds a resource of type job to the statement.

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/operations-jobs.html

        :param job_id: - Identifier for the jobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Elastictranscoder", jsii.invoke(self, "onJob", [job_id, account, region, partition]))

    @jsii.member(jsii_name="onPipeline")
    def on_pipeline(
        self,
        pipeline_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elastictranscoder":
        '''(experimental) Adds a resource of type pipeline to the statement.

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/operations-pipelines.html

        :param pipeline_id: - Identifier for the pipelineId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Elastictranscoder", jsii.invoke(self, "onPipeline", [pipeline_id, account, region, partition]))

    @jsii.member(jsii_name="onPreset")
    def on_preset(
        self,
        preset_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elastictranscoder":
        '''(experimental) Adds a resource of type preset to the statement.

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/operations-presets.html

        :param preset_id: - Identifier for the presetId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Elastictranscoder", jsii.invoke(self, "onPreset", [preset_id, account, region, partition]))

    @jsii.member(jsii_name="toCancelJob")
    def to_cancel_job(self) -> "Elastictranscoder":
        '''(experimental) Cancel a job that Elastic Transcoder has not begun to process.

        Access Level: Write

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/cancel-job.html

        :stability: experimental
        '''
        return typing.cast("Elastictranscoder", jsii.invoke(self, "toCancelJob", []))

    @jsii.member(jsii_name="toCreateJob")
    def to_create_job(self) -> "Elastictranscoder":
        '''(experimental) Create a job.

        Access Level: Write

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/create-job.html

        :stability: experimental
        '''
        return typing.cast("Elastictranscoder", jsii.invoke(self, "toCreateJob", []))

    @jsii.member(jsii_name="toCreatePipeline")
    def to_create_pipeline(self) -> "Elastictranscoder":
        '''(experimental) Create a pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/create-pipeline.html

        :stability: experimental
        '''
        return typing.cast("Elastictranscoder", jsii.invoke(self, "toCreatePipeline", []))

    @jsii.member(jsii_name="toCreatePreset")
    def to_create_preset(self) -> "Elastictranscoder":
        '''(experimental) Create a preset.

        Access Level: Write

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/create-preset.html

        :stability: experimental
        '''
        return typing.cast("Elastictranscoder", jsii.invoke(self, "toCreatePreset", []))

    @jsii.member(jsii_name="toDeletePipeline")
    def to_delete_pipeline(self) -> "Elastictranscoder":
        '''(experimental) Delete a pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/delete-pipeline.html

        :stability: experimental
        '''
        return typing.cast("Elastictranscoder", jsii.invoke(self, "toDeletePipeline", []))

    @jsii.member(jsii_name="toDeletePreset")
    def to_delete_preset(self) -> "Elastictranscoder":
        '''(experimental) Delete a preset.

        Access Level: Write

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/delete-preset.html

        :stability: experimental
        '''
        return typing.cast("Elastictranscoder", jsii.invoke(self, "toDeletePreset", []))

    @jsii.member(jsii_name="toListJobsByPipeline")
    def to_list_jobs_by_pipeline(self) -> "Elastictranscoder":
        '''(experimental) Get a list of the jobs that you assigned to a pipeline.

        Access Level: List

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/list-jobs-by-pipeline.html

        :stability: experimental
        '''
        return typing.cast("Elastictranscoder", jsii.invoke(self, "toListJobsByPipeline", []))

    @jsii.member(jsii_name="toListJobsByStatus")
    def to_list_jobs_by_status(self) -> "Elastictranscoder":
        '''(experimental) Get information about all of the jobs associated with the current AWS account that have a specified status.

        Access Level: List

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/list-jobs-by-status.html

        :stability: experimental
        '''
        return typing.cast("Elastictranscoder", jsii.invoke(self, "toListJobsByStatus", []))

    @jsii.member(jsii_name="toListPipelines")
    def to_list_pipelines(self) -> "Elastictranscoder":
        '''(experimental) Get a list of the pipelines associated with the current AWS account.

        Access Level: List

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/list-pipelines.html

        :stability: experimental
        '''
        return typing.cast("Elastictranscoder", jsii.invoke(self, "toListPipelines", []))

    @jsii.member(jsii_name="toListPresets")
    def to_list_presets(self) -> "Elastictranscoder":
        '''(experimental) Get a list of all presets associated with the current AWS account.

        Access Level: List

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/list-presets.html

        :stability: experimental
        '''
        return typing.cast("Elastictranscoder", jsii.invoke(self, "toListPresets", []))

    @jsii.member(jsii_name="toReadJob")
    def to_read_job(self) -> "Elastictranscoder":
        '''(experimental) Get detailed information about a job.

        Access Level: Read

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/get-job.html

        :stability: experimental
        '''
        return typing.cast("Elastictranscoder", jsii.invoke(self, "toReadJob", []))

    @jsii.member(jsii_name="toReadPipeline")
    def to_read_pipeline(self) -> "Elastictranscoder":
        '''(experimental) Get detailed information about a pipeline.

        Access Level: Read

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/get-pipeline.html

        :stability: experimental
        '''
        return typing.cast("Elastictranscoder", jsii.invoke(self, "toReadPipeline", []))

    @jsii.member(jsii_name="toReadPreset")
    def to_read_preset(self) -> "Elastictranscoder":
        '''(experimental) Get detailed information about a preset.

        Access Level: Read

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/get-preset.html

        :stability: experimental
        '''
        return typing.cast("Elastictranscoder", jsii.invoke(self, "toReadPreset", []))

    @jsii.member(jsii_name="toTestRole")
    def to_test_role(self) -> "Elastictranscoder":
        '''(experimental) Test the settings for a pipeline to ensure that Elastic Transcoder can create and process jobs.

        Access Level: Write

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/test-pipeline-role.html

        :stability: experimental
        '''
        return typing.cast("Elastictranscoder", jsii.invoke(self, "toTestRole", []))

    @jsii.member(jsii_name="toUpdatePipeline")
    def to_update_pipeline(self) -> "Elastictranscoder":
        '''(experimental) Update settings for a pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/update-pipeline.html

        :stability: experimental
        '''
        return typing.cast("Elastictranscoder", jsii.invoke(self, "toUpdatePipeline", []))

    @jsii.member(jsii_name="toUpdatePipelineNotifications")
    def to_update_pipeline_notifications(self) -> "Elastictranscoder":
        '''(experimental) Update only Amazon Simple Notification Service (Amazon SNS) notifications for a pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/update-pipeline-notifications.html

        :stability: experimental
        '''
        return typing.cast("Elastictranscoder", jsii.invoke(self, "toUpdatePipelineNotifications", []))

    @jsii.member(jsii_name="toUpdatePipelineStatus")
    def to_update_pipeline_status(self) -> "Elastictranscoder":
        '''(experimental) Pause or reactivate a pipeline, so the pipeline stops or restarts processing jobs, update the status for the pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/update-pipeline-status.html

        :stability: experimental
        '''
        return typing.cast("Elastictranscoder", jsii.invoke(self, "toUpdatePipelineStatus", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class ElementalActivations(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.ElementalActivations",
):
    '''(experimental) Statement provider for service `elemental-activations <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalappliancesandsoftwareactivationservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `elemental-activations <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalappliancesandsoftwareactivationservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(ElementalActivations, self, [sid])

    @jsii.member(jsii_name="onActivation")
    def on_activation(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ElementalActivations":
        '''(experimental) Adds a resource of type activation to the statement.

        https://docs.aws.amazon.com/elemental-appliances-software/

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("ElementalActivations", jsii.invoke(self, "onActivation", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toCompleteAccountRegistration")
    def to_complete_account_registration(self) -> "ElementalActivations":
        '''(experimental) Grants permission to complete the process of registering customer account for AWS Elemental Appliances and Software Purchases.

        Access Level: Read

        https://docs.aws.amazon.com/elemental-appliances-software/

        :stability: experimental
        '''
        return typing.cast("ElementalActivations", jsii.invoke(self, "toCompleteAccountRegistration", []))

    @jsii.member(jsii_name="toCompleteFileUpload")
    def to_complete_file_upload(self) -> "ElementalActivations":
        '''(experimental) Grants permission to complete the process of uploading a Software file for AWS Elemental Appliances and Software Purchases.

        Access Level: Read

        https://docs.aws.amazon.com/elemental-appliances-software/

        :stability: experimental
        '''
        return typing.cast("ElementalActivations", jsii.invoke(self, "toCompleteFileUpload", []))

    @jsii.member(jsii_name="toDownloadSoftware")
    def to_download_software(self) -> "ElementalActivations":
        '''(experimental) Grants permission to download the Software files for AWS Elemental Appliances and Software Purchases.

        Access Level: Read

        https://docs.aws.amazon.com/elemental-appliances-software/

        :stability: experimental
        '''
        return typing.cast("ElementalActivations", jsii.invoke(self, "toDownloadSoftware", []))

    @jsii.member(jsii_name="toGenerateLicenses")
    def to_generate_licenses(self) -> "ElementalActivations":
        '''(experimental) Grants permission to generate Software Licenses for AWS Elemental Appliances and Software Purchases.

        Access Level: Read

        https://docs.aws.amazon.com/elemental-appliances-software/

        :stability: experimental
        '''
        return typing.cast("ElementalActivations", jsii.invoke(self, "toGenerateLicenses", []))

    @jsii.member(jsii_name="toGetActivation")
    def to_get_activation(self) -> "ElementalActivations":
        '''(experimental) Grants permission to describe an activation.

        Access Level: Read

        https://docs.aws.amazon.com/elemental-appliances-software/

        :stability: experimental
        '''
        return typing.cast("ElementalActivations", jsii.invoke(self, "toGetActivation", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "ElementalActivations":
        '''(experimental) Grants permission to list tags for an AWS Elemental Activations resource.

        Access Level: Read

        https://docs.aws.amazon.com/elemental-appliances-software/

        :stability: experimental
        '''
        return typing.cast("ElementalActivations", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toStartAccountRegistration")
    def to_start_account_registration(self) -> "ElementalActivations":
        '''(experimental) Grants permission to start the process of registering customer account for AWS Elemental Appliances and Software Purchases.

        Access Level: Read

        https://docs.aws.amazon.com/elemental-appliances-software/

        :stability: experimental
        '''
        return typing.cast("ElementalActivations", jsii.invoke(self, "toStartAccountRegistration", []))

    @jsii.member(jsii_name="toStartFileUpload")
    def to_start_file_upload(self) -> "ElementalActivations":
        '''(experimental) Grants permission to start the process of uploading a Software file for AWS Elemental Appliances and Software Purchases.

        Access Level: Read

        https://docs.aws.amazon.com/elemental-appliances-software/

        :stability: experimental
        '''
        return typing.cast("ElementalActivations", jsii.invoke(self, "toStartFileUpload", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "ElementalActivations":
        '''(experimental) Grants permission to add a tag for an AWS Elemental Activations resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/elemental-appliances-software/

        :stability: experimental
        '''
        return typing.cast("ElementalActivations", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "ElementalActivations":
        '''(experimental) Grants permission to remove a tag from an AWS Elemental Activations resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elemental-appliances-software/

        :stability: experimental
        '''
        return typing.cast("ElementalActivations", jsii.invoke(self, "toUntagResource", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class ElementalAppliancesSoftware(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.ElementalAppliancesSoftware",
):
    '''(experimental) Statement provider for service `elemental-appliances-software <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalappliancesandsoftware.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `elemental-appliances-software <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalappliancesandsoftware.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(ElementalAppliancesSoftware, self, [sid])

    @jsii.member(jsii_name="onQuote")
    def on_quote(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ElementalAppliancesSoftware":
        '''(experimental) Adds a resource of type quote to the statement.

        https://docs.aws.amazon.com/elemental-appliances-software

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("ElementalAppliancesSoftware", jsii.invoke(self, "onQuote", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateQuote")
    def to_create_quote(self) -> "ElementalAppliancesSoftware":
        '''(experimental) Create a quote.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elemental-appliances-software

        :stability: experimental
        '''
        return typing.cast("ElementalAppliancesSoftware", jsii.invoke(self, "toCreateQuote", []))

    @jsii.member(jsii_name="toGetQuote")
    def to_get_quote(self) -> "ElementalAppliancesSoftware":
        '''(experimental) Describe a quote.

        Access Level: Read

        https://docs.aws.amazon.com/elemental-appliances-software

        :stability: experimental
        '''
        return typing.cast("ElementalAppliancesSoftware", jsii.invoke(self, "toGetQuote", []))

    @jsii.member(jsii_name="toListQuotes")
    def to_list_quotes(self) -> "ElementalAppliancesSoftware":
        '''(experimental) List the quotes in the user account.

        Access Level: List

        https://docs.aws.amazon.com/elemental-appliances-software

        :stability: experimental
        '''
        return typing.cast("ElementalAppliancesSoftware", jsii.invoke(self, "toListQuotes", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "ElementalAppliancesSoftware":
        '''(experimental) This action lists tags for an AWS Elemental Appliances and Software resource.

        Access Level: Read

        https://docs.aws.amazon.com/elemental-appliances-software

        :stability: experimental
        '''
        return typing.cast("ElementalAppliancesSoftware", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "ElementalAppliancesSoftware":
        '''(experimental) This action tags an AWS Elemental Appliances and Software resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/elemental-appliances-software

        :stability: experimental
        '''
        return typing.cast("ElementalAppliancesSoftware", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "ElementalAppliancesSoftware":
        '''(experimental) This action removes a tag from an AWS Elemental Appliances and Software resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elemental-appliances-software

        :stability: experimental
        '''
        return typing.cast("ElementalAppliancesSoftware", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateQuote")
    def to_update_quote(self) -> "ElementalAppliancesSoftware":
        '''(experimental) Modify a quote.

        Access Level: Write

        https://docs.aws.amazon.com/elemental-appliances-software

        :stability: experimental
        '''
        return typing.cast("ElementalAppliancesSoftware", jsii.invoke(self, "toUpdateQuote", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class ElementalSupportCases(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.ElementalSupportCases",
):
    '''(experimental) Statement provider for service `elemental-support-cases <https://docs.aws.amazon.com/service-authorization/latest/reference/list_elementalsupportcases.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `elemental-support-cases <https://docs.aws.amazon.com/service-authorization/latest/reference/list_elementalsupportcases.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(ElementalSupportCases, self, [sid])

    @jsii.member(jsii_name="toCheckCasePermission")
    def to_check_case_permission(self) -> "ElementalSupportCases":
        '''(experimental) Verify whether the caller has the permissions to perform support case operations.

        Access Level: Write

        https://docs.aws.amazon.com/elemental-appliances-software

        :stability: experimental
        '''
        return typing.cast("ElementalSupportCases", jsii.invoke(self, "toCheckCasePermission", []))

    @jsii.member(jsii_name="toCreateCase")
    def to_create_case(self) -> "ElementalSupportCases":
        '''(experimental) Grant the permission to create a support case.

        Access Level: Write

        https://docs.aws.amazon.com/elemental-appliances-software

        :stability: experimental
        '''
        return typing.cast("ElementalSupportCases", jsii.invoke(self, "toCreateCase", []))

    @jsii.member(jsii_name="toGetCase")
    def to_get_case(self) -> "ElementalSupportCases":
        '''(experimental) Grant the permission to describe a support case in your account.

        Access Level: Read

        https://docs.aws.amazon.com/elemental-appliances-software

        :stability: experimental
        '''
        return typing.cast("ElementalSupportCases", jsii.invoke(self, "toGetCase", []))

    @jsii.member(jsii_name="toGetCases")
    def to_get_cases(self) -> "ElementalSupportCases":
        '''(experimental) Grant the permission to list the support cases in your account.

        Access Level: Read

        https://docs.aws.amazon.com/elemental-appliances-software

        :stability: experimental
        '''
        return typing.cast("ElementalSupportCases", jsii.invoke(self, "toGetCases", []))

    @jsii.member(jsii_name="toUpdateCase")
    def to_update_case(self) -> "ElementalSupportCases":
        '''(experimental) Grant the permission to update a support case.

        Access Level: Write

        https://docs.aws.amazon.com/elemental-appliances-software

        :stability: experimental
        '''
        return typing.cast("ElementalSupportCases", jsii.invoke(self, "toUpdateCase", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class ElementalSupportContent(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.ElementalSupportContent",
):
    '''(experimental) Statement provider for service `elemental-support-content <https://docs.aws.amazon.com/service-authorization/latest/reference/list_elementalsupportcontent.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `elemental-support-content <https://docs.aws.amazon.com/service-authorization/latest/reference/list_elementalsupportcontent.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(ElementalSupportContent, self, [sid])

    @jsii.member(jsii_name="toQuery")
    def to_query(self) -> "ElementalSupportContent":
        '''(experimental) Grant the permission to search support content.

        Access Level: Read

        https://docs.aws.amazon.com/elemental-appliances-software

        :stability: experimental
        '''
        return typing.cast("ElementalSupportContent", jsii.invoke(self, "toQuery", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class EmrContainers(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.EmrContainers",
):
    '''(experimental) Statement provider for service `emr-containers <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonemroneksemrcontainers.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `emr-containers <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonemroneksemrcontainers.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(EmrContainers, self, [sid])

    @jsii.member(jsii_name="ifExecutionRoleArn")
    def if_execution_role_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "EmrContainers":
        '''(experimental) Filters actions based on whether the execution role arn is provided with the action.

        https://docs.aws.amazon.com/emr/latest/EMR-on-EKS-DevelopmentGuide/iam-execution-role.html

        Applies to actions:

        - .toStartJobRun()

        Applies to resource types:

        - jobRun

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("EmrContainers", jsii.invoke(self, "ifExecutionRoleArn", [value, operator]))

    @jsii.member(jsii_name="onJobRun")
    def on_job_run(
        self,
        virtual_cluster_id: builtins.str,
        job_run_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "EmrContainers":
        '''(experimental) Adds a resource of type jobRun to the statement.

        https://docs.aws.amazon.com/emr/latest/EMR-on-EKS-DevelopmentGuide/job-runs.html

        :param virtual_cluster_id: - Identifier for the virtualClusterId.
        :param job_run_id: - Identifier for the jobRunId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifExecutionRoleArn()

        :stability: experimental
        '''
        return typing.cast("EmrContainers", jsii.invoke(self, "onJobRun", [virtual_cluster_id, job_run_id, account, region, partition]))

    @jsii.member(jsii_name="onVirtualCluster")
    def on_virtual_cluster(
        self,
        virtual_cluster_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "EmrContainers":
        '''(experimental) Adds a resource of type virtualCluster to the statement.

        https://docs.aws.amazon.com/emr/latest/EMR-on-EKS-DevelopmentGuide/virtual-cluster.html

        :param virtual_cluster_id: - Identifier for the virtualClusterId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("EmrContainers", jsii.invoke(self, "onVirtualCluster", [virtual_cluster_id, account, region, partition]))

    @jsii.member(jsii_name="toCancelJobRun")
    def to_cancel_job_run(self) -> "EmrContainers":
        '''(experimental) Grants permission to cancel a job run.

        Access Level: Write

        https://docs.aws.amazon.com/emr-on-eks/latest/APIReference/API_CancelJobRun.html

        :stability: experimental
        '''
        return typing.cast("EmrContainers", jsii.invoke(self, "toCancelJobRun", []))

    @jsii.member(jsii_name="toCreateVirtualCluster")
    def to_create_virtual_cluster(self) -> "EmrContainers":
        '''(experimental) Grants permission to create a virtual cluster.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/emr-on-eks/latest/APIReference/API_CreateVirtualCluster.html

        :stability: experimental
        '''
        return typing.cast("EmrContainers", jsii.invoke(self, "toCreateVirtualCluster", []))

    @jsii.member(jsii_name="toDeleteVirtualCluster")
    def to_delete_virtual_cluster(self) -> "EmrContainers":
        '''(experimental) Grants permission to delete a virtual cluster.

        Access Level: Write

        https://docs.aws.amazon.com/emr-on-eks/latest/APIReference/API_DeleteVirtualCluster.html

        :stability: experimental
        '''
        return typing.cast("EmrContainers", jsii.invoke(self, "toDeleteVirtualCluster", []))

    @jsii.member(jsii_name="toDescribeJobRun")
    def to_describe_job_run(self) -> "EmrContainers":
        '''(experimental) Grants permission to describe a job run.

        Access Level: Read

        https://docs.aws.amazon.com/emr-on-eks/latest/APIReference/API_DescribeJobRun.html

        :stability: experimental
        '''
        return typing.cast("EmrContainers", jsii.invoke(self, "toDescribeJobRun", []))

    @jsii.member(jsii_name="toDescribeVirtualCluster")
    def to_describe_virtual_cluster(self) -> "EmrContainers":
        '''(experimental) Grants permission to describe a virtual cluster.

        Access Level: Read

        https://docs.aws.amazon.com/emr-on-eks/latest/APIReference/API_DescribeVirtualCluster.html

        :stability: experimental
        '''
        return typing.cast("EmrContainers", jsii.invoke(self, "toDescribeVirtualCluster", []))

    @jsii.member(jsii_name="toListJobRuns")
    def to_list_job_runs(self) -> "EmrContainers":
        '''(experimental) Grants permission to list job runs associated with a virtual cluster.

        Access Level: List

        https://docs.aws.amazon.com/emr-on-eks/latest/APIReference/API_ListJobRuns.html

        :stability: experimental
        '''
        return typing.cast("EmrContainers", jsii.invoke(self, "toListJobRuns", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "EmrContainers":
        '''(experimental) Grants permission to list tags for the specified resource.

        Access Level: List

        https://docs.aws.amazon.com/emr-on-eks/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("EmrContainers", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListVirtualClusters")
    def to_list_virtual_clusters(self) -> "EmrContainers":
        '''(experimental) Grants permission to list virtual clusters.

        Access Level: List

        https://docs.aws.amazon.com/emr-on-eks/latest/APIReference/API_ListVirtualClusters.html

        :stability: experimental
        '''
        return typing.cast("EmrContainers", jsii.invoke(self, "toListVirtualClusters", []))

    @jsii.member(jsii_name="toStartJobRun")
    def to_start_job_run(self) -> "EmrContainers":
        '''(experimental) Grants permission to start a job run.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifExecutionRoleArn()

        https://docs.aws.amazon.com/emr-on-eks/latest/APIReference/API_StartJobRun.html

        :stability: experimental
        '''
        return typing.cast("EmrContainers", jsii.invoke(self, "toStartJobRun", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "EmrContainers":
        '''(experimental) Grants permission to tag the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/emr-on-eks/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("EmrContainers", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "EmrContainers":
        '''(experimental) Grants permission to untag the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/emr-on-eks/latest/APIReference/API_UnTagResource.html

        :stability: experimental
        '''
        return typing.cast("EmrContainers", jsii.invoke(self, "toUntagResource", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Es(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Es"):
    '''(experimental) Statement provider for service `es <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticsearchservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `es <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticsearchservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Es, self, [sid])

    @jsii.member(jsii_name="onDomain")
    def on_domain(
        self,
        domain_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Es":
        '''(experimental) Adds a resource of type domain to the statement.

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-ac.html

        :param domain_name: - Identifier for the domainName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "onDomain", [domain_name, account, region, partition]))

    @jsii.member(jsii_name="toAcceptInboundCrossClusterSearchConnection")
    def to_accept_inbound_cross_cluster_search_connection(self) -> "Es":
        '''(experimental) Allows the destination domain owner to accept an inbound cross-cluster search connection request.

        Access Level: Write

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-configuration-api.html#es-configuration-api-actions-acceptinboundcrossclustersearchconnection

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toAcceptInboundCrossClusterSearchConnection", []))

    @jsii.member(jsii_name="toAddTags")
    def to_add_tags(self) -> "Es":
        '''(experimental) Grants permission to attach resource tags to an Amazon ES domain.

        Access Level: Tagging

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-configuration-api.html#es-configuration-api-actions-addtags

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toAddTags", []))

    @jsii.member(jsii_name="toCreateElasticsearchDomain")
    def to_create_elasticsearch_domain(self) -> "Es":
        '''(experimental) Grants permission to create an Amazon ES domain.

        Access Level: Write

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-configuration-api.html#es-configuration-api-actions-createelasticsearchdomain

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toCreateElasticsearchDomain", []))

    @jsii.member(jsii_name="toCreateElasticsearchServiceRole")
    def to_create_elasticsearch_service_role(self) -> "Es":
        '''(experimental) Grants permission to create the service-linked role required for Amazon ES domains that use VPC access.

        Access Level: Write

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-configuration-api.html#es-configuration-api-actions-createelasticsearchservicerole

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toCreateElasticsearchServiceRole", []))

    @jsii.member(jsii_name="toCreateOutboundCrossClusterSearchConnection")
    def to_create_outbound_cross_cluster_search_connection(self) -> "Es":
        '''(experimental) Creates a new cross-cluster search connection from a source domain to a destination domain.

        Access Level: Write

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-configuration-api.html#es-configuration-api-actions-createoutboundcrossclustersearchconnection

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toCreateOutboundCrossClusterSearchConnection", []))

    @jsii.member(jsii_name="toDeleteElasticsearchDomain")
    def to_delete_elasticsearch_domain(self) -> "Es":
        '''(experimental) Grants permission to delete an Amazon ES domain and all of its data.

        Access Level: Write

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-configuration-api.html#es-configuration-api-actions-deleteelasticsearchdomain

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDeleteElasticsearchDomain", []))

    @jsii.member(jsii_name="toDeleteElasticsearchServiceRole")
    def to_delete_elasticsearch_service_role(self) -> "Es":
        '''(experimental) Grants permission to delete the service-linked role required for Amazon ES domains that use VPC access.

        Access Level: Write

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-configuration-api.html#es-configuration-api-actions-deleteelasticsearchservicerole

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDeleteElasticsearchServiceRole", []))

    @jsii.member(jsii_name="toDeleteInboundCrossClusterSearchConnection")
    def to_delete_inbound_cross_cluster_search_connection(self) -> "Es":
        '''(experimental) Allows the destination domain owner to delete an existing inbound cross-cluster search connection.

        Access Level: Write

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-configuration-api.html#es-configuration-api-actions-deleteinboundcrossclustersearchconnection

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDeleteInboundCrossClusterSearchConnection", []))

    @jsii.member(jsii_name="toDeleteOutboundCrossClusterSearchConnection")
    def to_delete_outbound_cross_cluster_search_connection(self) -> "Es":
        '''(experimental) Allows the source domain owner to delete an existing outbound cross-cluster search connection.

        Access Level: Write

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-configuration-api.html#es-configuration-api-actions-deleteoutboundcrossclustersearchconnection

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDeleteOutboundCrossClusterSearchConnection", []))

    @jsii.member(jsii_name="toDescribeElasticsearchDomain")
    def to_describe_elasticsearch_domain(self) -> "Es":
        '''(experimental) Grants permission to view a description of the domain configuration for the specified Amazon ES domain, including the domain ID, domain service endpoint, and domain ARN.

        Access Level: Read

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-configuration-api.html#es-configuration-api-actions-describeelasticsearchdomain

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDescribeElasticsearchDomain", []))

    @jsii.member(jsii_name="toDescribeElasticsearchDomainConfig")
    def to_describe_elasticsearch_domain_config(self) -> "Es":
        '''(experimental) Grants permission to view a description of the configuration options and status of an Amazon ES domain.

        Access Level: Read

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-configuration-api.html#es-configuration-api-actions-describeelasticsearchdomainconfig

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDescribeElasticsearchDomainConfig", []))

    @jsii.member(jsii_name="toDescribeElasticsearchDomains")
    def to_describe_elasticsearch_domains(self) -> "Es":
        '''(experimental) Grants permission to view a description of the domain configuration for up to five specified Amazon ES domains.

        Access Level: List

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-configuration-api.html#es-configuration-api-actions-describeelasticsearchdomain

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDescribeElasticsearchDomains", []))

    @jsii.member(jsii_name="toDescribeElasticsearchInstanceTypeLimits")
    def to_describe_elasticsearch_instance_type_limits(self) -> "Es":
        '''(experimental) Grants permission to view the instance count, storage, and master node limits for a given Elasticsearch version and instance type.

        Access Level: List

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-configuration-api.html#es-configuration-api-actions-describeinstancetypelimits

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDescribeElasticsearchInstanceTypeLimits", []))

    @jsii.member(jsii_name="toDescribeInboundCrossClusterSearchConnections")
    def to_describe_inbound_cross_cluster_search_connections(self) -> "Es":
        '''(experimental) Lists all the inbound cross-cluster search connections for a destination domain.

        Access Level: List

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-configuration-api.html#es-configuration-api-actions-describeinboundcrossclustersearchconnections

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDescribeInboundCrossClusterSearchConnections", []))

    @jsii.member(jsii_name="toDescribeOutboundCrossClusterSearchConnections")
    def to_describe_outbound_cross_cluster_search_connections(self) -> "Es":
        '''(experimental) Lists all the outbound cross-cluster search connections for a source domain.

        Access Level: List

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-configuration-api.html#es-configuration-api-actions-describeoutboundcrossclustersearchconnections

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDescribeOutboundCrossClusterSearchConnections", []))

    @jsii.member(jsii_name="toDescribeReservedElasticsearchInstanceOfferings")
    def to_describe_reserved_elasticsearch_instance_offerings(self) -> "Es":
        '''(experimental) Grants permission to fetch reserved instance offerings for ES.

        Access Level: List

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-configuration-api.html#es-configuration-api-actions-describereservedelasticsearchinstanceofferings

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDescribeReservedElasticsearchInstanceOfferings", []))

    @jsii.member(jsii_name="toDescribeReservedElasticsearchInstances")
    def to_describe_reserved_elasticsearch_instances(self) -> "Es":
        '''(experimental) Grants permission to fetch ES reserved instances already purchased by customer.

        Access Level: List

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-configuration-api.html#es-configuration-api-actions-describereservedelasticsearchinstances

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDescribeReservedElasticsearchInstances", []))

    @jsii.member(jsii_name="toESCrossClusterGet")
    def to_es_cross_cluster_get(self) -> "Es":
        '''(experimental) Grants permission to send cross-cluster requests to a destination domain.

        Access Level: Read

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-ac.html#es-ac-reference

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toESCrossClusterGet", []))

    @jsii.member(jsii_name="toESHttpDelete")
    def to_es_http_delete(self) -> "Es":
        '''(experimental) Grants permission to send HTTP DELETE requests to the Elasticsearch APIs.

        Access Level: Write

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-ac.html#es-ac-reference

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toESHttpDelete", []))

    @jsii.member(jsii_name="toESHttpGet")
    def to_es_http_get(self) -> "Es":
        '''(experimental) Grants permission to send HTTP GET requests to the Elasticsearch APIs.

        Access Level: Read

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-ac.html#es-ac-reference

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toESHttpGet", []))

    @jsii.member(jsii_name="toESHttpHead")
    def to_es_http_head(self) -> "Es":
        '''(experimental) Grants permission to send HTTP HEAD requests to the Elasticsearch APIs.

        Access Level: Read

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-ac.html#es-ac-reference

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toESHttpHead", []))

    @jsii.member(jsii_name="toESHttpPatch")
    def to_es_http_patch(self) -> "Es":
        '''(experimental) Grants permission to send HTTP PATCH requests to the Elasticsearch APIs.

        Access Level: Write

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-ac.html#es-ac-reference

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toESHttpPatch", []))

    @jsii.member(jsii_name="toESHttpPost")
    def to_es_http_post(self) -> "Es":
        '''(experimental) Grants permission to send HTTP POST requests to the Elasticsearch APIs.

        Access Level: Write

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-ac.html#es-ac-reference

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toESHttpPost", []))

    @jsii.member(jsii_name="toESHttpPut")
    def to_es_http_put(self) -> "Es":
        '''(experimental) Grants permission to send HTTP PUT requests to the Elasticsearch APIs.

        Access Level: Write

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-ac.html#es-ac-reference

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toESHttpPut", []))

    @jsii.member(jsii_name="toGetCompatibleElasticsearchVersions")
    def to_get_compatible_elasticsearch_versions(self) -> "Es":
        '''(experimental) Grants permission to fetch list of compatible elastic search versions to which Amazon ES domain can be upgraded.

        Access Level: List

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-configuration-api.html#es-configuration-api-actions-getcompatibleelasticsearchversions

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toGetCompatibleElasticsearchVersions", []))

    @jsii.member(jsii_name="toGetUpgradeHistory")
    def to_get_upgrade_history(self) -> "Es":
        '''(experimental) Grants permission to fetch upgrade history for given ES domain.

        Access Level: Read

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-configuration-api.html#es-configuration-api-actions-getupgradehistory

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toGetUpgradeHistory", []))

    @jsii.member(jsii_name="toGetUpgradeStatus")
    def to_get_upgrade_status(self) -> "Es":
        '''(experimental) Grants permission to fetch upgrade status for given ES domain.

        Access Level: Read

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-configuration-api.html#es-configuration-api-actions-getupgradestatus

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toGetUpgradeStatus", []))

    @jsii.member(jsii_name="toListDomainNames")
    def to_list_domain_names(self) -> "Es":
        '''(experimental) Grants permission to display the names of all Amazon ES domains that the current user owns.

        Access Level: List

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-configuration-api.html#es-configuration-api-actions-listdomainnames

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toListDomainNames", []))

    @jsii.member(jsii_name="toListElasticsearchInstanceTypeDetails")
    def to_list_elasticsearch_instance_type_details(self) -> "Es":
        '''(experimental) Grants permission to list all instance types and available features for a given Elasticsearch version.

        Access Level: List

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-configuration-api.html#es-configuration-api-actions-listelasticsearchinstancetypedetails

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toListElasticsearchInstanceTypeDetails", []))

    @jsii.member(jsii_name="toListElasticsearchInstanceTypes")
    def to_list_elasticsearch_instance_types(self) -> "Es":
        '''(experimental) Grants permission to list all Elasticsearch instance types that are supported for a given Elasticsearch version.

        Access Level: List

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-configuration-api.html#es-configuration-api-actions-listelasticsearchinstancetypes

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toListElasticsearchInstanceTypes", []))

    @jsii.member(jsii_name="toListElasticsearchVersions")
    def to_list_elasticsearch_versions(self) -> "Es":
        '''(experimental) Grants permission to list all supported Elasticsearch versions on Amazon ES.

        Access Level: List

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-configuration-api.html#es-configuration-api-actions-listelasticsearchversions

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toListElasticsearchVersions", []))

    @jsii.member(jsii_name="toListTags")
    def to_list_tags(self) -> "Es":
        '''(experimental) Grants permission to display all of the tags for an Amazon ES domain.

        Access Level: Read

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-configuration-api.html#es-configuration-api-actions-listtags

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toListTags", []))

    @jsii.member(jsii_name="toPurchaseReservedElasticsearchInstanceOffering")
    def to_purchase_reserved_elasticsearch_instance_offering(self) -> "Es":
        '''(experimental) Grants permission to purchase ES reserved instances.

        Access Level: Write

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-configuration-api.html#es-configuration-api-actions-purchasereservedelasticsearchinstance

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toPurchaseReservedElasticsearchInstanceOffering", []))

    @jsii.member(jsii_name="toRejectInboundCrossClusterSearchConnection")
    def to_reject_inbound_cross_cluster_search_connection(self) -> "Es":
        '''(experimental) Allows the destination domain owner to reject an inbound cross-cluster search connection request.

        Access Level: Write

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-configuration-api.html#es-configuration-api-actions-rejectinboundcrossclustersearchconnection

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toRejectInboundCrossClusterSearchConnection", []))

    @jsii.member(jsii_name="toRemoveTags")
    def to_remove_tags(self) -> "Es":
        '''(experimental) Grants permission to remove tags from Amazon ES domains.

        Access Level: Tagging

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-configuration-api.html#es-configuration-api-actions-listtags

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toRemoveTags", []))

    @jsii.member(jsii_name="toUpdateElasticsearchDomainConfig")
    def to_update_elasticsearch_domain_config(self) -> "Es":
        '''(experimental) Grants permission to modify the configuration of an Amazon ES domain, such as the instance type or number of instances.

        Access Level: Write

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-configuration-api.html#es-configuration-api-actions-updateelasticsearchdomainconfig

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toUpdateElasticsearchDomainConfig", []))

    @jsii.member(jsii_name="toUpgradeElasticsearchDomain")
    def to_upgrade_elasticsearch_domain(self) -> "Es":
        '''(experimental) Grants permission to initiate upgrade of elastic search domain to given version.

        Access Level: Write

        https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-configuration-api.html#es-configuration-api-actions-upgradeelasticsearchdomain

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toUpgradeElasticsearchDomain", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Events(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Events"):
    '''(experimental) Statement provider for service `events <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoneventbridge.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `events <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoneventbridge.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Events, self, [sid])

    @jsii.member(jsii_name="ifCreatorAccount")
    def if_creator_account(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Events":
        '''(experimental) Filters access to rule actions based on the account the rule was created in.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/policy-keys-eventbridge.html#events-creator-account

        Applies to actions:

        - .toDeleteRule()
        - .toDescribeRule()
        - .toDisableRule()
        - .toEnableRule()
        - .toListTagsForResource()
        - .toListTargetsByRule()
        - .toPutRule()
        - .toPutTargets()
        - .toRemoveTargets()
        - .toTagResource()
        - .toUntagResource()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "ifCreatorAccount", [value, operator]))

    @jsii.member(jsii_name="ifDetailEventTypeCode")
    def if_detail_event_type_code(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Events":
        '''(experimental) Filters access to PutRule actions based on the literal string for the detail.eventTypeCode field of the event.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/policy-keys-eventbridge.html#limit-rule-by-type-code

        Applies to actions:

        - .toPutRule()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "ifDetailEventTypeCode", [value, operator]))

    @jsii.member(jsii_name="ifDetailService")
    def if_detail_service(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Events":
        '''(experimental) Filters access to PutRule actions based on the literal string for the detail.service field of the event.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/policy-keys-eventbridge.html#limit-rule-by-service

        Applies to actions:

        - .toPutRule()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "ifDetailService", [value, operator]))

    @jsii.member(jsii_name="ifDetailType")
    def if_detail_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Events":
        '''(experimental) Filters access to PutEvents and PutRule actions based on the literal string of the detail-type of the event.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/policy-keys-eventbridge.html#events-pattern-detail-type

        Applies to actions:

        - .toPutEvents()
        - .toPutRule()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "ifDetailType", [value, operator]))

    @jsii.member(jsii_name="ifDetailUserIdentityPrincipalId")
    def if_detail_user_identity_principal_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Events":
        '''(experimental) Filters access to PutRule actions based on the literal string for the detail.useridentity.principalid field of the event.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/policy-keys-eventbridge.html#consume-specific-events

        Applies to actions:

        - .toPutRule()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "ifDetailUserIdentityPrincipalId", [value, operator]))

    @jsii.member(jsii_name="ifEventBusInvocation")
    def if_event_bus_invocation(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Events":
        '''(experimental) Filters access to PutEvents actions based on whether the event was generated via API or cross-account bus invocation.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/policy-keys-eventbridge.html#events-bus-invocation

        Applies to actions:

        - .toPutEvents()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "ifEventBusInvocation", [value, operator]))

    @jsii.member(jsii_name="ifManagedBy")
    def if_managed_by(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Events":
        '''(experimental) Used internally by AWS services.

        If a rule is created by an AWS service on your behalf, the value is the principal name of the service that created the rule

        https://docs.aws.amazon.com/eventbridge/latest/userguide/policy-keys-eventbridge.html

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "ifManagedBy", [value, operator]))

    @jsii.member(jsii_name="ifSource")
    def if_source(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Events":
        '''(experimental) Filters access to PutEvents and PutRule actions based on the AWS service or AWS partner event source that generated the event.

        Matches the literal string of the source field of the event

        https://docs.aws.amazon.com/eventbridge/latest/userguide/policy-keys-eventbridge.html#events-limit-access-control

        Applies to actions:

        - .toPutEvents()
        - .toPutRule()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "ifSource", [value, operator]))

    @jsii.member(jsii_name="ifTargetArn")
    def if_target_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Events":
        '''(experimental) Filters access to PutTargets actions based on the ARN of a target that can be put to a rule.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/policy-keys-eventbridge.html#limiting-access-to-targets

        Applies to actions:

        - .toPutTargets()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "ifTargetArn", [value, operator]))

    @jsii.member(jsii_name="onApiDestination")
    def on_api_destination(
        self,
        api_destination_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Events":
        '''(experimental) Adds a resource of type api-destination to the statement.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/iam-access-control-identity-based-eventbridge.html#eventbridge-arn-format

        :param api_destination_name: - Identifier for the apiDestinationName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "onApiDestination", [api_destination_name, account, region, partition]))

    @jsii.member(jsii_name="onArchive")
    def on_archive(
        self,
        archive_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Events":
        '''(experimental) Adds a resource of type archive to the statement.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/iam-access-control-identity-based-eventbridge.html#eventbridge-arn-format

        :param archive_name: - Identifier for the archiveName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "onArchive", [archive_name, account, region, partition]))

    @jsii.member(jsii_name="onConnection")
    def on_connection(
        self,
        connection_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Events":
        '''(experimental) Adds a resource of type connection to the statement.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/iam-access-control-identity-based-eventbridge.html#eventbridge-arn-format

        :param connection_name: - Identifier for the connectionName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "onConnection", [connection_name, account, region, partition]))

    @jsii.member(jsii_name="onEventBus")
    def on_event_bus(
        self,
        event_bus_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Events":
        '''(experimental) Adds a resource of type event-bus to the statement.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/iam-access-control-identity-based-eventbridge.html#eventbridge-arn-format

        :param event_bus_name: - Identifier for the eventBusName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "onEventBus", [event_bus_name, account, region, partition]))

    @jsii.member(jsii_name="onEventSource")
    def on_event_source(
        self,
        event_source_name: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Events":
        '''(experimental) Adds a resource of type event-source to the statement.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/iam-access-control-identity-based-eventbridge.html#eventbridge-arn-format

        :param event_source_name: - Identifier for the eventSourceName.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "onEventSource", [event_source_name, region, partition]))

    @jsii.member(jsii_name="onReplay")
    def on_replay(
        self,
        replay_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Events":
        '''(experimental) Adds a resource of type replay to the statement.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/iam-access-control-identity-based-eventbridge.html#eventbridge-arn-format

        :param replay_name: - Identifier for the replayName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "onReplay", [replay_name, account, region, partition]))

    @jsii.member(jsii_name="onRule")
    def on_rule(
        self,
        rule_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Events":
        '''(experimental) Adds a resource of type rule to the statement.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/iam-access-control-identity-based-eventbridge.html#eventbridge-arn-format

        :param rule_name: - Identifier for the ruleName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "onRule", [rule_name, account, region, partition]))

    @jsii.member(jsii_name="toActivateEventSource")
    def to_activate_event_source(self) -> "Events":
        '''(experimental) Grants permission to activate partner event sources.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_ActivateEventSource.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toActivateEventSource", []))

    @jsii.member(jsii_name="toCancelReplay")
    def to_cancel_replay(self) -> "Events":
        '''(experimental) Grants permission to cancel a replay.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_CancelReplay.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toCancelReplay", []))

    @jsii.member(jsii_name="toCreateApiDestination")
    def to_create_api_destination(self) -> "Events":
        '''(experimental) Grants permission to create a new api destination.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_CreateApiDestination.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toCreateApiDestination", []))

    @jsii.member(jsii_name="toCreateArchive")
    def to_create_archive(self) -> "Events":
        '''(experimental) Grants permission to create a new archive.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_CreateArchive.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toCreateArchive", []))

    @jsii.member(jsii_name="toCreateConnection")
    def to_create_connection(self) -> "Events":
        '''(experimental) Grants permission to create a new connection.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_CreateConnection.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toCreateConnection", []))

    @jsii.member(jsii_name="toCreateEventBus")
    def to_create_event_bus(self) -> "Events":
        '''(experimental) Grants permission to create event buses.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_CreateEventBus.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toCreateEventBus", []))

    @jsii.member(jsii_name="toCreatePartnerEventSource")
    def to_create_partner_event_source(self) -> "Events":
        '''(experimental) Grants permission to create partner event sources.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_CreatePartnerEventSource.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toCreatePartnerEventSource", []))

    @jsii.member(jsii_name="toDeactivateEventSource")
    def to_deactivate_event_source(self) -> "Events":
        '''(experimental) Grants permission to deactivate event sources.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DeactivateEventSource.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toDeactivateEventSource", []))

    @jsii.member(jsii_name="toDeauthorizeConnection")
    def to_deauthorize_connection(self) -> "Events":
        '''(experimental) Grants permission to deauthorize a connection, deleting its stored authorization secrets.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DeauthorizeConnection.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toDeauthorizeConnection", []))

    @jsii.member(jsii_name="toDeleteApiDestination")
    def to_delete_api_destination(self) -> "Events":
        '''(experimental) Grants permission to delete an api destination.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DeleteApiDestination.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toDeleteApiDestination", []))

    @jsii.member(jsii_name="toDeleteArchive")
    def to_delete_archive(self) -> "Events":
        '''(experimental) Grants permission to delete an archive.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DeleteArchive.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toDeleteArchive", []))

    @jsii.member(jsii_name="toDeleteConnection")
    def to_delete_connection(self) -> "Events":
        '''(experimental) Grants permission to delete a connection.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DeleteConnection.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toDeleteConnection", []))

    @jsii.member(jsii_name="toDeleteEventBus")
    def to_delete_event_bus(self) -> "Events":
        '''(experimental) Grants permission to delete event buses.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DeletePartnerEventSource

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toDeleteEventBus", []))

    @jsii.member(jsii_name="toDeletePartnerEventSource")
    def to_delete_partner_event_source(self) -> "Events":
        '''(experimental) Grants permission to delete partner event sources.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DeletePartnerEventSource

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toDeletePartnerEventSource", []))

    @jsii.member(jsii_name="toDeleteRule")
    def to_delete_rule(self) -> "Events":
        '''(experimental) Grants permission to delete rules.

        Access Level: Write

        Possible conditions:

        - .ifCreatorAccount()

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DeleteRule.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toDeleteRule", []))

    @jsii.member(jsii_name="toDescribeApiDestination")
    def to_describe_api_destination(self) -> "Events":
        '''(experimental) Grants permission to retrieve details about an api destination.

        Access Level: Read

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DescribeApiDestination.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toDescribeApiDestination", []))

    @jsii.member(jsii_name="toDescribeArchive")
    def to_describe_archive(self) -> "Events":
        '''(experimental) Grants permission to retrieve details about an archive.

        Access Level: Read

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DescribeArchive.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toDescribeArchive", []))

    @jsii.member(jsii_name="toDescribeConnection")
    def to_describe_connection(self) -> "Events":
        '''(experimental) Grants permission to retrieve details about a conection.

        Access Level: Read

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DescribeConnection.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toDescribeConnection", []))

    @jsii.member(jsii_name="toDescribeEventBus")
    def to_describe_event_bus(self) -> "Events":
        '''(experimental) Grants permission to retrieve details about event buses.

        Access Level: Read

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DescribeEventBus.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toDescribeEventBus", []))

    @jsii.member(jsii_name="toDescribeEventSource")
    def to_describe_event_source(self) -> "Events":
        '''(experimental) Grants permission to retrieve details about event sources.

        Access Level: Read

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DescribeEventSource.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toDescribeEventSource", []))

    @jsii.member(jsii_name="toDescribePartnerEventSource")
    def to_describe_partner_event_source(self) -> "Events":
        '''(experimental) Grants permission to retrieve details about partner event sources.

        Access Level: Read

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DescribePartnerEventSource.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toDescribePartnerEventSource", []))

    @jsii.member(jsii_name="toDescribeReplay")
    def to_describe_replay(self) -> "Events":
        '''(experimental) Grants permission to retrieve the details of a replay.

        Access Level: Read

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DescribeReplay.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toDescribeReplay", []))

    @jsii.member(jsii_name="toDescribeRule")
    def to_describe_rule(self) -> "Events":
        '''(experimental) Grants permission to retrieve details about rules.

        Access Level: Read

        Possible conditions:

        - .ifCreatorAccount()

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DescribeRule.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toDescribeRule", []))

    @jsii.member(jsii_name="toDisableRule")
    def to_disable_rule(self) -> "Events":
        '''(experimental) Grants permission to disable rules.

        Access Level: Write

        Possible conditions:

        - .ifCreatorAccount()

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DisableRule.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toDisableRule", []))

    @jsii.member(jsii_name="toEnableRule")
    def to_enable_rule(self) -> "Events":
        '''(experimental) Grants permissions to enable rules.

        Access Level: Write

        Possible conditions:

        - .ifCreatorAccount()

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_EnableRule.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toEnableRule", []))

    @jsii.member(jsii_name="toInvokeApiDestination")
    def to_invoke_api_destination(self) -> "Events":
        '''(experimental) Grants permission to invoke an api destination.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/userguide/iam-identity-based-access-control-eventbridge.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toInvokeApiDestination", []))

    @jsii.member(jsii_name="toListApiDestinations")
    def to_list_api_destinations(self) -> "Events":
        '''(experimental) Grants permission to retrieve a list of api destinations.

        Access Level: List

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_ListApiDestinations.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toListApiDestinations", []))

    @jsii.member(jsii_name="toListArchives")
    def to_list_archives(self) -> "Events":
        '''(experimental) Grants permission to retrieve a list of archives.

        Access Level: List

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_ListArchives.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toListArchives", []))

    @jsii.member(jsii_name="toListConnections")
    def to_list_connections(self) -> "Events":
        '''(experimental) Grants permission to retrieve a list of connections.

        Access Level: List

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_ListConnections.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toListConnections", []))

    @jsii.member(jsii_name="toListEventBuses")
    def to_list_event_buses(self) -> "Events":
        '''(experimental) Grants permission to to retrieve a list of the event buses in your account.

        Access Level: List

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_ListEventBuses.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toListEventBuses", []))

    @jsii.member(jsii_name="toListEventSources")
    def to_list_event_sources(self) -> "Events":
        '''(experimental) Grants permission to to retrieve a list of event sources shared with this account.

        Access Level: List

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_ListEventSources.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toListEventSources", []))

    @jsii.member(jsii_name="toListPartnerEventSourceAccounts")
    def to_list_partner_event_source_accounts(self) -> "Events":
        '''(experimental) Grants permission to retrieve a list of AWS account IDs associated with an event source.

        Access Level: List

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_ListPartnerEventSourceAccounts.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toListPartnerEventSourceAccounts", []))

    @jsii.member(jsii_name="toListPartnerEventSources")
    def to_list_partner_event_sources(self) -> "Events":
        '''(experimental) Grants permission to retrieve a list partner event sources.

        Access Level: List

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_ListPartnerEventSources.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toListPartnerEventSources", []))

    @jsii.member(jsii_name="toListReplays")
    def to_list_replays(self) -> "Events":
        '''(experimental) Grants permission to retrieve a list of replays.

        Access Level: List

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_ListReplays.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toListReplays", []))

    @jsii.member(jsii_name="toListRuleNamesByTarget")
    def to_list_rule_names_by_target(self) -> "Events":
        '''(experimental) Grants permission to retrieve a list of the names of the rules associated with a target.

        Access Level: List

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_ListRuleNamesByTarget.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toListRuleNamesByTarget", []))

    @jsii.member(jsii_name="toListRules")
    def to_list_rules(self) -> "Events":
        '''(experimental) Grants permission to retrieve a list of the Amazon EventBridge rules in the account.

        Access Level: List

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_ListRules.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toListRules", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Events":
        '''(experimental) Grants permission to retrieve a list of tags associated with an Amazon EventBridge resource.

        Access Level: List

        Possible conditions:

        - .ifCreatorAccount()

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTargetsByRule")
    def to_list_targets_by_rule(self) -> "Events":
        '''(experimental) Grants permission to retrieve a list of targets defined for a rule.

        Access Level: List

        Possible conditions:

        - .ifCreatorAccount()

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_ListTargetsByRule.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toListTargetsByRule", []))

    @jsii.member(jsii_name="toPutEvents")
    def to_put_events(self) -> "Events":
        '''(experimental) Grants permission to send custom events to Amazon EventBridge.

        Access Level: Write

        Possible conditions:

        - .ifDetailType()
        - .ifSource()
        - .ifEventBusInvocation()
        - .ifAwsSourceArn()
        - .ifAwsSourceAccount()

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_PutEvents.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toPutEvents", []))

    @jsii.member(jsii_name="toPutPartnerEvents")
    def to_put_partner_events(self) -> "Events":
        '''(experimental) Grants permission to sends custom events to Amazon EventBridge.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_PutPartnerEvents.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toPutPartnerEvents", []))

    @jsii.member(jsii_name="toPutPermission")
    def to_put_permission(self) -> "Events":
        '''(experimental) Grants permission to use the PutPermission action to grants permission to another AWS account to put events to your default event bus.

        Access Level: Permissions management

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_PutPermission.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toPutPermission", []))

    @jsii.member(jsii_name="toPutRule")
    def to_put_rule(self) -> "Events":
        '''(experimental) Grants permission to create or updates rules.

        Access Level: Tagging

        Possible conditions:

        - .ifDetailUserIdentityPrincipalId()
        - .ifDetailType()
        - .ifSource()
        - .ifDetailService()
        - .ifDetailEventTypeCode()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifCreatorAccount()

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_PutRule.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toPutRule", []))

    @jsii.member(jsii_name="toPutTargets")
    def to_put_targets(self) -> "Events":
        '''(experimental) Grants permission to add targets to a rule.

        Access Level: Write

        Possible conditions:

        - .ifTargetArn()
        - .ifCreatorAccount()

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_PutTargets.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toPutTargets", []))

    @jsii.member(jsii_name="toRemovePermission")
    def to_remove_permission(self) -> "Events":
        '''(experimental) Grants permission to revoke the permission of another AWS account to put events to your default event bus.

        Access Level: Permissions management

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_RemovePermission.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toRemovePermission", []))

    @jsii.member(jsii_name="toRemoveTargets")
    def to_remove_targets(self) -> "Events":
        '''(experimental) Grants permission to removes targets from a rule.

        Access Level: Write

        Possible conditions:

        - .ifCreatorAccount()

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_RemoveTargets.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toRemoveTargets", []))

    @jsii.member(jsii_name="toStartReplay")
    def to_start_replay(self) -> "Events":
        '''(experimental) Grants permission to start a replay of an archive.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_StartReplay.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toStartReplay", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Events":
        '''(experimental) Grants permission to add a tag to an Amazon EventBridge resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifCreatorAccount()

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTestEventPattern")
    def to_test_event_pattern(self) -> "Events":
        '''(experimental) Grants permissions to test whether an event pattern matches the provided event.

        Access Level: Read

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_TestEventPattern.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toTestEventPattern", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Events":
        '''(experimental) Grants permission to remove a tag from an Amazon EventBridge resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifCreatorAccount()

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateApiDestination")
    def to_update_api_destination(self) -> "Events":
        '''(experimental) Grants permission to update an api destination.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_UpdateApiDestination.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toUpdateApiDestination", []))

    @jsii.member(jsii_name="toUpdateArchive")
    def to_update_archive(self) -> "Events":
        '''(experimental) Grants permission to update an archive.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_UpdateArchive.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toUpdateArchive", []))

    @jsii.member(jsii_name="toUpdateConnection")
    def to_update_connection(self) -> "Events":
        '''(experimental) Grants permission to update a connection.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_UpdateConnection.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toUpdateConnection", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class ExecuteApi(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.ExecuteApi",
):
    '''(experimental) Statement provider for service `execute-api <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonapigateway.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `execute-api <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonapigateway.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(ExecuteApi, self, [sid])

    @jsii.member(jsii_name="onExecuteApiGeneral")
    def on_execute_api_general(
        self,
        api_id: builtins.str,
        stage: builtins.str,
        method: builtins.str,
        api_specific_resource_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ExecuteApi":
        '''(experimental) Adds a resource of type execute-api-general to the statement.

        :param api_id: - Identifier for the apiId.
        :param stage: - Identifier for the stage.
        :param method: - Identifier for the method.
        :param api_specific_resource_path: - Identifier for the apiSpecificResourcePath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("ExecuteApi", jsii.invoke(self, "onExecuteApiGeneral", [api_id, stage, method, api_specific_resource_path, account, region, partition]))

    @jsii.member(jsii_name="toInvalidateCache")
    def to_invalidate_cache(self) -> "ExecuteApi":
        '''(experimental) Used to invalidate API cache upon a client request.

        Access Level: Write

        https://docs.aws.amazon.com/apigateway/api-reference/api-gateway-caching.html

        :stability: experimental
        '''
        return typing.cast("ExecuteApi", jsii.invoke(self, "toInvalidateCache", []))

    @jsii.member(jsii_name="toInvoke")
    def to_invoke(self) -> "ExecuteApi":
        '''(experimental) Used to invoke an API upon a client request.

        Access Level: Write

        https://docs.aws.amazon.com/apigateway/api-reference/how-to-call-api.html

        :stability: experimental
        '''
        return typing.cast("ExecuteApi", jsii.invoke(self, "toInvoke", []))

    @jsii.member(jsii_name="toManageConnections")
    def to_manage_connections(self) -> "ExecuteApi":
        '''(experimental) ManageConnections controls access to the @connections API.

        Access Level: Write

        https://docs.aws.amazon.com/apigateway/api-reference/apigateway-websocket-control-access-iam.html

        :stability: experimental
        '''
        return typing.cast("ExecuteApi", jsii.invoke(self, "toManageConnections", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Firehose(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Firehose",
):
    '''(experimental) Statement provider for service `firehose <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonkinesisfirehose.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `firehose <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonkinesisfirehose.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Firehose, self, [sid])

    @jsii.member(jsii_name="onDeliverystream")
    def on_deliverystream(
        self,
        delivery_stream_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Firehose":
        '''(experimental) Adds a resource of type deliverystream to the statement.

        https://docs.aws.amazon.com/firehose/latest/dev/basic-create.html

        :param delivery_stream_name: - Identifier for the deliveryStreamName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Firehose", jsii.invoke(self, "onDeliverystream", [delivery_stream_name, account, region, partition]))

    @jsii.member(jsii_name="toCreateDeliveryStream")
    def to_create_delivery_stream(self) -> "Firehose":
        '''(experimental) Grants permissions to create a delivery stream.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/firehose/latest/APIReference/API_CreateDeliveryStream.html

        :stability: experimental
        '''
        return typing.cast("Firehose", jsii.invoke(self, "toCreateDeliveryStream", []))

    @jsii.member(jsii_name="toDeleteDeliveryStream")
    def to_delete_delivery_stream(self) -> "Firehose":
        '''(experimental) Grants permission to delete a delivery stream and its data.

        Access Level: Write

        https://docs.aws.amazon.com/firehose/latest/APIReference/API_DeleteDeliveryStream.html

        :stability: experimental
        '''
        return typing.cast("Firehose", jsii.invoke(self, "toDeleteDeliveryStream", []))

    @jsii.member(jsii_name="toDescribeDeliveryStream")
    def to_describe_delivery_stream(self) -> "Firehose":
        '''(experimental) Grants permission to describe the specified delivery stream and gets the status.

        Access Level: Read

        https://docs.aws.amazon.com/firehose/latest/APIReference/API_DescribeDeliveryStream.html

        :stability: experimental
        '''
        return typing.cast("Firehose", jsii.invoke(self, "toDescribeDeliveryStream", []))

    @jsii.member(jsii_name="toListDeliveryStreams")
    def to_list_delivery_streams(self) -> "Firehose":
        '''(experimental) Grants permissions to list your delivery streams.

        Access Level: List

        https://docs.aws.amazon.com/firehose/latest/APIReference/API_ListDeliveryStreams.html

        :stability: experimental
        '''
        return typing.cast("Firehose", jsii.invoke(self, "toListDeliveryStreams", []))

    @jsii.member(jsii_name="toListTagsForDeliveryStream")
    def to_list_tags_for_delivery_stream(self) -> "Firehose":
        '''(experimental) Grants permissions to list the tags for the specified delivery stream.

        Access Level: List

        https://docs.aws.amazon.com/firehose/latest/APIReference/API_ListTagsForDeliveryStream.html

        :stability: experimental
        '''
        return typing.cast("Firehose", jsii.invoke(self, "toListTagsForDeliveryStream", []))

    @jsii.member(jsii_name="toPutRecord")
    def to_put_record(self) -> "Firehose":
        '''(experimental) Grants permissions to write a single data record into an Amazon Kinesis Firehose delivery stream.

        Access Level: Write

        https://docs.aws.amazon.com/firehose/latest/APIReference/API_PutRecord.html

        :stability: experimental
        '''
        return typing.cast("Firehose", jsii.invoke(self, "toPutRecord", []))

    @jsii.member(jsii_name="toPutRecordBatch")
    def to_put_record_batch(self) -> "Firehose":
        '''(experimental) Grants permissions to write multiple data records into a delivery stream in a single call, which can achieve higher throughput per producer than when writing single records.

        Access Level: Write

        https://docs.aws.amazon.com/firehose/latest/APIReference/API_PutRecordBatch.html

        :stability: experimental
        '''
        return typing.cast("Firehose", jsii.invoke(self, "toPutRecordBatch", []))

    @jsii.member(jsii_name="toStartDeliveryStreamEncryption")
    def to_start_delivery_stream_encryption(self) -> "Firehose":
        '''(experimental) Grants permissions to enable server-side encryption (SSE) for the delivery stream.

        Access Level: Write

        https://docs.aws.amazon.com/firehose/latest/APIReference/API_StartDeliveryStreamEncryption.html

        :stability: experimental
        '''
        return typing.cast("Firehose", jsii.invoke(self, "toStartDeliveryStreamEncryption", []))

    @jsii.member(jsii_name="toStopDeliveryStreamEncryption")
    def to_stop_delivery_stream_encryption(self) -> "Firehose":
        '''(experimental) Grants permissions to disable the specified destination of the specified delivery stream.

        Access Level: Write

        https://docs.aws.amazon.com/firehose/latest/APIReference/API_StopDeliveryStreamEncryption.html

        :stability: experimental
        '''
        return typing.cast("Firehose", jsii.invoke(self, "toStopDeliveryStreamEncryption", []))

    @jsii.member(jsii_name="toTagDeliveryStream")
    def to_tag_delivery_stream(self) -> "Firehose":
        '''(experimental) Grants permissions to add or update tags for the specified delivery stream.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/firehose/latest/APIReference/API_TagDeliveryStream.html

        :stability: experimental
        '''
        return typing.cast("Firehose", jsii.invoke(self, "toTagDeliveryStream", []))

    @jsii.member(jsii_name="toUntagDeliveryStream")
    def to_untag_delivery_stream(self) -> "Firehose":
        '''(experimental) Grants permissions to remove tags from the specified delivery stream.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/firehose/latest/APIReference/API_UntagDeliveryStream.html

        :stability: experimental
        '''
        return typing.cast("Firehose", jsii.invoke(self, "toUntagDeliveryStream", []))

    @jsii.member(jsii_name="toUpdateDestination")
    def to_update_destination(self) -> "Firehose":
        '''(experimental) Grants permissions to update the specified destination of the specified delivery stream.

        Access Level: Write

        https://docs.aws.amazon.com/firehose/latest/APIReference/API_UpdateDestination.html

        :stability: experimental
        '''
        return typing.cast("Firehose", jsii.invoke(self, "toUpdateDestination", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Fis(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Fis"):
    '''(experimental) Statement provider for service `fis <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsfaultinjectionsimulator.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `fis <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsfaultinjectionsimulator.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Fis, self, [sid])

    @jsii.member(jsii_name="ifOperations")
    def if_operations(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Fis":
        '''(experimental) Filters access by the list of operations on the AWS service that is being affected by the AWS FIS action.

        https://docs.aws.amazon.com/fis/latest/userguide/security_iam_service-with-iam.html

        Applies to actions:

        - .toInjectApiInternalError()
        - .toInjectApiThrottleError()
        - .toInjectApiUnavailableError()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "ifOperations", [value, operator]))

    @jsii.member(jsii_name="ifPercentage")
    def if_percentage(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Fis":
        '''(experimental) Filters access by the percentage of calls being affected by the AWS FIS action.

        https://docs.aws.amazon.com/fis/latest/userguide/security_iam_service-with-iam.html

        Applies to actions:

        - .toInjectApiInternalError()
        - .toInjectApiThrottleError()
        - .toInjectApiUnavailableError()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "ifPercentage", [value, operator]))

    @jsii.member(jsii_name="ifService")
    def if_service(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Fis":
        '''(experimental) Filters access by the AWS service that is being affected by the AWS FIS action.

        https://docs.aws.amazon.com/fis/latest/userguide/security_iam_service-with-iam.html

        Applies to actions:

        - .toInjectApiInternalError()
        - .toInjectApiThrottleError()
        - .toInjectApiUnavailableError()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "ifService", [value, operator]))

    @jsii.member(jsii_name="ifTargets")
    def if_targets(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Fis":
        '''(experimental) Filters access by the list of resource ARNs being targeted by the AWS FIS action.

        https://docs.aws.amazon.com/fis/latest/userguide/security_iam_service-with-iam.html

        Applies to actions:

        - .toInjectApiInternalError()
        - .toInjectApiThrottleError()
        - .toInjectApiUnavailableError()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "ifTargets", [value, operator]))

    @jsii.member(jsii_name="onAction")
    def on_action(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Fis":
        '''(experimental) Adds a resource of type action to the statement.

        https://docs.aws.amazon.com/fis/latest/userguide/actions.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "onAction", [id, account, region, partition]))

    @jsii.member(jsii_name="onExperiment")
    def on_experiment(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Fis":
        '''(experimental) Adds a resource of type experiment to the statement.

        https://docs.aws.amazon.com/fis/latest/userguide/experiments.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "onExperiment", [id, account, region, partition]))

    @jsii.member(jsii_name="onExperimentTemplate")
    def on_experiment_template(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Fis":
        '''(experimental) Adds a resource of type experiment-template to the statement.

        https://docs.aws.amazon.com/fis/latest/userguide/working-with-templates.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "onExperimentTemplate", [id, account, region, partition]))

    @jsii.member(jsii_name="toCreateExperimentTemplate")
    def to_create_experiment_template(self) -> "Fis":
        '''(experimental) Grants permission to create an AWS FIS experiment template.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/fis/latest/APIReference/API_CreateExperimentTemplate.html

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "toCreateExperimentTemplate", []))

    @jsii.member(jsii_name="toDeleteExperimentTemplate")
    def to_delete_experiment_template(self) -> "Fis":
        '''(experimental) Grants permission to delete the AWS FIS experiment template.

        Access Level: Write

        https://docs.aws.amazon.com/fis/latest/APIReference/API_DeleteExperimentTemplate.html

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "toDeleteExperimentTemplate", []))

    @jsii.member(jsii_name="toGetAction")
    def to_get_action(self) -> "Fis":
        '''(experimental) Grants permission to retrieve an AWS FIS action.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/fis/latest/APIReference/API_GetAction.html

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "toGetAction", []))

    @jsii.member(jsii_name="toGetExperiment")
    def to_get_experiment(self) -> "Fis":
        '''(experimental) Grants permission to retrieve an AWS FIS experiment.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/fis/latest/APIReference/API_GetExperiment.html

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "toGetExperiment", []))

    @jsii.member(jsii_name="toGetExperimentTemplate")
    def to_get_experiment_template(self) -> "Fis":
        '''(experimental) Grants permission to retrieve an AWS FIS Experiment Template.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/fis/latest/APIReference/API_GetExperimentTemplate.html

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "toGetExperimentTemplate", []))

    @jsii.member(jsii_name="toInjectApiInternalError")
    def to_inject_api_internal_error(self) -> "Fis":
        '''(experimental) Grants permission to inject an API internal error on the provided AWS service from an FIS Experiment.

        Access Level: Write

        Possible conditions:

        - .ifService()
        - .ifOperations()
        - .ifPercentage()
        - .ifTargets()

        https://docs.aws.amazon.com/fis/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "toInjectApiInternalError", []))

    @jsii.member(jsii_name="toInjectApiThrottleError")
    def to_inject_api_throttle_error(self) -> "Fis":
        '''(experimental) Grants permission to inject an API throttle error on the provided AWS service from an FIS Experiment.

        Access Level: Write

        Possible conditions:

        - .ifService()
        - .ifOperations()
        - .ifPercentage()
        - .ifTargets()

        https://docs.aws.amazon.com/fis/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "toInjectApiThrottleError", []))

    @jsii.member(jsii_name="toInjectApiUnavailableError")
    def to_inject_api_unavailable_error(self) -> "Fis":
        '''(experimental) Grants permission to inject an API unavailable error on the provided AWS service from an FIS Experiment.

        Access Level: Write

        Possible conditions:

        - .ifService()
        - .ifOperations()
        - .ifPercentage()
        - .ifTargets()

        https://docs.aws.amazon.com/fis/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "toInjectApiUnavailableError", []))

    @jsii.member(jsii_name="toListActions")
    def to_list_actions(self) -> "Fis":
        '''(experimental) Grants permission to list all available AWS FIS actions.

        Access Level: List

        https://docs.aws.amazon.com/fis/latest/APIReference/API_ListActions.html

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "toListActions", []))

    @jsii.member(jsii_name="toListExperiments")
    def to_list_experiments(self) -> "Fis":
        '''(experimental) Grants permission to list all available AWS FIS experiments.

        Access Level: List

        https://docs.aws.amazon.com/fis/latest/APIReference/API_ListExperiments.html

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "toListExperiments", []))

    @jsii.member(jsii_name="toListExperimentTemplates")
    def to_list_experiment_templates(self) -> "Fis":
        '''(experimental) Grants permission to list all available AWS FIS experiment templates.

        Access Level: List

        https://docs.aws.amazon.com/fis/latest/APIReference/API_ListExperimentTemplates.html

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "toListExperimentTemplates", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Fis":
        '''(experimental) Grants permission to list the tags for an AWS FIS resource.

        Access Level: Read

        https://docs.aws.amazon.com/fis/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toStartExperiment")
    def to_start_experiment(self) -> "Fis":
        '''(experimental) Grants permission to run an AWS FIS experiment.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/fis/latest/APIReference/API_StartExperiment.html

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "toStartExperiment", []))

    @jsii.member(jsii_name="toStopExperiment")
    def to_stop_experiment(self) -> "Fis":
        '''(experimental) Grants permission to stop an AWS FIS experiment.

        Access Level: Write

        https://docs.aws.amazon.com/fis/latest/APIReference/API_StopExperiment.html

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "toStopExperiment", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Fis":
        '''(experimental) Grants permission to tag AWS FIS resources.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/fis/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Fis":
        '''(experimental) Grants permission to untag AWS FIS resources.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/fis/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateExperimentTemplate")
    def to_update_experiment_template(self) -> "Fis":
        '''(experimental) Grants permission to update the specified AWS FIS experiment template.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/fis/latest/APIReference/API_UpdateExperimentTemplate.html

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "toUpdateExperimentTemplate", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Fms(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Fms"):
    '''(experimental) Statement provider for service `fms <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsfirewallmanager.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `fms <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsfirewallmanager.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Fms, self, [sid])

    @jsii.member(jsii_name="onApplicationsList")
    def on_applications_list(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Fms":
        '''(experimental) Adds a resource of type applications-list to the statement.

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_AppsListData.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "onApplicationsList", [id, account, region, partition]))

    @jsii.member(jsii_name="onPolicy")
    def on_policy(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Fms":
        '''(experimental) Adds a resource of type policy to the statement.

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_Policy.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "onPolicy", [id, account, region, partition]))

    @jsii.member(jsii_name="onProtocolsList")
    def on_protocols_list(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Fms":
        '''(experimental) Adds a resource of type protocols-list to the statement.

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_ProtocolsListData.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "onProtocolsList", [id, account, region, partition]))

    @jsii.member(jsii_name="toAssociateAdminAccount")
    def to_associate_admin_account(self) -> "Fms":
        '''(experimental) Grants permission to set the AWS Firewall Manager administrator account and enables the service in all organization accounts.

        Access Level: Write

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_AssociateAdminAccount.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toAssociateAdminAccount", []))

    @jsii.member(jsii_name="toDeleteAppsList")
    def to_delete_apps_list(self) -> "Fms":
        '''(experimental) Grants permission to permanently deletes an AWS Firewall Manager applications list.

        Access Level: Write

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_DeleteAppsList.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toDeleteAppsList", []))

    @jsii.member(jsii_name="toDeleteNotificationChannel")
    def to_delete_notification_channel(self) -> "Fms":
        '''(experimental) Grants permission to delete an AWS Firewall Manager association with the IAM role and the Amazon Simple Notification Service (SNS) topic that is used to notify the FM administrator about major FM events and errors across the organization.

        Access Level: Write

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_DeleteNotificationChannel.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toDeleteNotificationChannel", []))

    @jsii.member(jsii_name="toDeletePolicy")
    def to_delete_policy(self) -> "Fms":
        '''(experimental) Grants permission to permanently delete an AWS Firewall Manager policy.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_DeletePolicy.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toDeletePolicy", []))

    @jsii.member(jsii_name="toDeleteProtocolsList")
    def to_delete_protocols_list(self) -> "Fms":
        '''(experimental) Grants permission to permanently deletes an AWS Firewall Manager protocols list.

        Access Level: Write

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_DeleteProtocolsList.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toDeleteProtocolsList", []))

    @jsii.member(jsii_name="toDisassociateAdminAccount")
    def to_disassociate_admin_account(self) -> "Fms":
        '''(experimental) Grants permission to disassociate the account that has been set as the AWS Firewall Manager administrator account and and disables the service in all organization accounts.

        Access Level: Write

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_DisassociateAdminAccount.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toDisassociateAdminAccount", []))

    @jsii.member(jsii_name="toGetAdminAccount")
    def to_get_admin_account(self) -> "Fms":
        '''(experimental) Grants permission to retrieve the AWS Organizations master account that is associated with AWS Firewall Manager as the AWS Firewall Manager administrator.

        Access Level: Read

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_GetAdminAccount.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toGetAdminAccount", []))

    @jsii.member(jsii_name="toGetAppsList")
    def to_get_apps_list(self) -> "Fms":
        '''(experimental) Grants permission to return information about the specified AWS Firewall Manager applications list.

        Access Level: Read

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_GetAppsList.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toGetAppsList", []))

    @jsii.member(jsii_name="toGetComplianceDetail")
    def to_get_compliance_detail(self) -> "Fms":
        '''(experimental) Grants permission to retrieve detailed compliance information about the specified member account.

        Details include resources that are in and out of compliance with the specified policy

        Access Level: Read

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_GetComplianceDetail.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toGetComplianceDetail", []))

    @jsii.member(jsii_name="toGetNotificationChannel")
    def to_get_notification_channel(self) -> "Fms":
        '''(experimental) Grants permission to retrieve information about the Amazon Simple Notification Service (SNS) topic that is used to record AWS Firewall Manager SNS logs.

        Access Level: Read

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_GetNotificationChannel.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toGetNotificationChannel", []))

    @jsii.member(jsii_name="toGetPolicy")
    def to_get_policy(self) -> "Fms":
        '''(experimental) Grants permission to retrieve information about the specified AWS Firewall Manager policy.

        Access Level: Read

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_GetPolicy.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toGetPolicy", []))

    @jsii.member(jsii_name="toGetProtectionStatus")
    def to_get_protection_status(self) -> "Fms":
        '''(experimental) Grants permission to retrieve policy-level attack summary information in the event of a potential DDoS attack.

        Access Level: Read

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_GetProtectionStatus.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toGetProtectionStatus", []))

    @jsii.member(jsii_name="toGetProtocolsList")
    def to_get_protocols_list(self) -> "Fms":
        '''(experimental) Grants permission to return information about the specified AWS Firewall Manager protocols list.

        Access Level: Read

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_GetProtocolsList.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toGetProtocolsList", []))

    @jsii.member(jsii_name="toGetViolationDetails")
    def to_get_violation_details(self) -> "Fms":
        '''(experimental) Grants permission to retrieve violations for a resource based on the specified AWS Firewall Manager policy and AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_GetViolationDetails.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toGetViolationDetails", []))

    @jsii.member(jsii_name="toListAppsLists")
    def to_list_apps_lists(self) -> "Fms":
        '''(experimental) Grants permission to return an array of AppsListDataSummary objects.

        Access Level: List

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_ListAppsLists.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toListAppsLists", []))

    @jsii.member(jsii_name="toListComplianceStatus")
    def to_list_compliance_status(self) -> "Fms":
        '''(experimental) Grants permission to retrieve an array of PolicyComplianceStatus objects in the response.

        Use PolicyComplianceStatus to get a summary of which member accounts are protected by the specified policy

        Access Level: List

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_ListComplianceStatus.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toListComplianceStatus", []))

    @jsii.member(jsii_name="toListMemberAccounts")
    def to_list_member_accounts(self) -> "Fms":
        '''(experimental) Grants permission to retrieve an array of member account ids if the caller is FMS admin account.

        Access Level: List

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_ListMemberAccounts.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toListMemberAccounts", []))

    @jsii.member(jsii_name="toListPolicies")
    def to_list_policies(self) -> "Fms":
        '''(experimental) Grants permission to retrieve an array of PolicySummary objects in the response.

        Access Level: List

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_ListPolicies.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toListPolicies", []))

    @jsii.member(jsii_name="toListProtocolsLists")
    def to_list_protocols_lists(self) -> "Fms":
        '''(experimental) Grants permission to return an array of ProtocolsListDataSummary objects.

        Access Level: List

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_ListProtocolsLists.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toListProtocolsLists", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Fms":
        '''(experimental) Grants permission to list Tags for a given resource.

        Access Level: Read

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutAppsList")
    def to_put_apps_list(self) -> "Fms":
        '''(experimental) Grants permission to create an AWS Firewall Manager applications list.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_PutAppsList.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toPutAppsList", []))

    @jsii.member(jsii_name="toPutNotificationChannel")
    def to_put_notification_channel(self) -> "Fms":
        '''(experimental) Grants permission to designate the IAM role and Amazon Simple Notification Service (SNS) topic that AWS Firewall Manager (FM) could use to notify the FM administrator about major FM events and errors across the organization.

        Access Level: Write

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_PutNotificationChannel.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toPutNotificationChannel", []))

    @jsii.member(jsii_name="toPutPolicy")
    def to_put_policy(self) -> "Fms":
        '''(experimental) Grants permission to create an AWS Firewall Manager policy.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_PutPolicy.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toPutPolicy", []))

    @jsii.member(jsii_name="toPutProtocolsList")
    def to_put_protocols_list(self) -> "Fms":
        '''(experimental) Grants permission to creates an AWS Firewall Manager protocols list.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_PutProtocolsList.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toPutProtocolsList", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Fms":
        '''(experimental) Grants permission to add a Tag to a given resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Fms":
        '''(experimental) Grants permission to remove a Tag from a given resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toUntagResource", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Forecast(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Forecast",
):
    '''(experimental) Statement provider for service `forecast <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonforecast.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `forecast <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonforecast.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Forecast, self, [sid])

    @jsii.member(jsii_name="onAlgorithm")
    def on_algorithm(
        self,
        resource_id: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Forecast":
        '''(experimental) Adds a resource of type algorithm to the statement.

        https://docs.aws.amazon.com/forecast/latest/dg/aws-forecast-choosing-recipes.html

        :param resource_id: - Identifier for the resourceId.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "onAlgorithm", [resource_id, partition]))

    @jsii.member(jsii_name="onDataset")
    def on_dataset(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Forecast":
        '''(experimental) Adds a resource of type dataset to the statement.

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreateDataset.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "onDataset", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onDatasetGroup")
    def on_dataset_group(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Forecast":
        '''(experimental) Adds a resource of type datasetGroup to the statement.

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreateDatasetGroup.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "onDatasetGroup", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onDatasetImportJob")
    def on_dataset_import_job(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Forecast":
        '''(experimental) Adds a resource of type datasetImportJob to the statement.

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreateDatasetImportJob.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "onDatasetImportJob", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onForecast")
    def on_forecast(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Forecast":
        '''(experimental) Adds a resource of type forecast to the statement.

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreateForecast.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "onForecast", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onForecastExport")
    def on_forecast_export(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Forecast":
        '''(experimental) Adds a resource of type forecastExport to the statement.

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreateForecastExportJob.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "onForecastExport", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onPredictor")
    def on_predictor(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Forecast":
        '''(experimental) Adds a resource of type predictor to the statement.

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreatePredictor.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "onPredictor", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onPredictorBacktestExportJob")
    def on_predictor_backtest_export_job(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Forecast":
        '''(experimental) Adds a resource of type predictorBacktestExportJob to the statement.

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreatePredictorBacktestExportJob.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "onPredictorBacktestExportJob", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateDataset")
    def to_create_dataset(self) -> "Forecast":
        '''(experimental) Grants permission to create a dataset.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreateDataset.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toCreateDataset", []))

    @jsii.member(jsii_name="toCreateDatasetGroup")
    def to_create_dataset_group(self) -> "Forecast":
        '''(experimental) Grants permission to create a dataset group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreateDatasetGroup.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toCreateDatasetGroup", []))

    @jsii.member(jsii_name="toCreateDatasetImportJob")
    def to_create_dataset_import_job(self) -> "Forecast":
        '''(experimental) Grants permission to create a dataset import job.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreateDatasetImportJob.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toCreateDatasetImportJob", []))

    @jsii.member(jsii_name="toCreateForecast")
    def to_create_forecast(self) -> "Forecast":
        '''(experimental) Grants permission to create a forecast.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreateForecast.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toCreateForecast", []))

    @jsii.member(jsii_name="toCreateForecastExportJob")
    def to_create_forecast_export_job(self) -> "Forecast":
        '''(experimental) Grants permission to create a forecast export job using a forecast resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreateForecastExportJob.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toCreateForecastExportJob", []))

    @jsii.member(jsii_name="toCreatePredictor")
    def to_create_predictor(self) -> "Forecast":
        '''(experimental) Grants permission to create a predictor.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreatePredictor.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toCreatePredictor", []))

    @jsii.member(jsii_name="toCreatePredictorBacktestExportJob")
    def to_create_predictor_backtest_export_job(self) -> "Forecast":
        '''(experimental) Grants permission to create a predictor backtest export job using a predictor.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreatePredictorBacktestExportJob.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toCreatePredictorBacktestExportJob", []))

    @jsii.member(jsii_name="toDeleteDataset")
    def to_delete_dataset(self) -> "Forecast":
        '''(experimental) Grants permission to delete a dataset.

        Access Level: Write

        https://docs.aws.amazon.com/forecast/latest/dg/API_DeleteDataset.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDeleteDataset", []))

    @jsii.member(jsii_name="toDeleteDatasetGroup")
    def to_delete_dataset_group(self) -> "Forecast":
        '''(experimental) Grants permission to delete a dataset group.

        Access Level: Write

        https://docs.aws.amazon.com/forecast/latest/dg/API_DeleteDatasetGroup.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDeleteDatasetGroup", []))

    @jsii.member(jsii_name="toDeleteDatasetImportJob")
    def to_delete_dataset_import_job(self) -> "Forecast":
        '''(experimental) Grants permission to delete a dataset import job.

        Access Level: Write

        https://docs.aws.amazon.com/forecast/latest/dg/API_DeleteDatasetImportJob.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDeleteDatasetImportJob", []))

    @jsii.member(jsii_name="toDeleteForecast")
    def to_delete_forecast(self) -> "Forecast":
        '''(experimental) Grants permission to delete a forecast.

        Access Level: Write

        https://docs.aws.amazon.com/forecast/latest/dg/API_DeleteForecast.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDeleteForecast", []))

    @jsii.member(jsii_name="toDeleteForecastExportJob")
    def to_delete_forecast_export_job(self) -> "Forecast":
        '''(experimental) Grants permission to delete a forecast export job.

        Access Level: Write

        https://docs.aws.amazon.com/forecast/latest/dg/API_DeleteForecastExportJob.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDeleteForecastExportJob", []))

    @jsii.member(jsii_name="toDeletePredictor")
    def to_delete_predictor(self) -> "Forecast":
        '''(experimental) Grants permission to delete a predictor.

        Access Level: Write

        https://docs.aws.amazon.com/forecast/latest/dg/API_DeletePredictor.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDeletePredictor", []))

    @jsii.member(jsii_name="toDeletePredictorBacktestExportJob")
    def to_delete_predictor_backtest_export_job(self) -> "Forecast":
        '''(experimental) Grants permission to delete a predictor backtest export job.

        Access Level: Write

        https://docs.aws.amazon.com/forecast/latest/dg/API_DeletePredictorBacktestExportJob.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDeletePredictorBacktestExportJob", []))

    @jsii.member(jsii_name="toDescribeDataset")
    def to_describe_dataset(self) -> "Forecast":
        '''(experimental) Grants permission to describe a dataset.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_DescribeDataset.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDescribeDataset", []))

    @jsii.member(jsii_name="toDescribeDatasetGroup")
    def to_describe_dataset_group(self) -> "Forecast":
        '''(experimental) Grants permission to describe a dataset group.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_DescribeDatasetGroup.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDescribeDatasetGroup", []))

    @jsii.member(jsii_name="toDescribeDatasetImportJob")
    def to_describe_dataset_import_job(self) -> "Forecast":
        '''(experimental) Grants permission to describe a dataset import job.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_DescribeDatasetImportJob.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDescribeDatasetImportJob", []))

    @jsii.member(jsii_name="toDescribeForecast")
    def to_describe_forecast(self) -> "Forecast":
        '''(experimental) Grants permission to describe a forecast.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_DescribeForecast.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDescribeForecast", []))

    @jsii.member(jsii_name="toDescribeForecastExportJob")
    def to_describe_forecast_export_job(self) -> "Forecast":
        '''(experimental) Grants permission to describe a forecast export job.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_DescribeForecastExportJob.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDescribeForecastExportJob", []))

    @jsii.member(jsii_name="toDescribePredictor")
    def to_describe_predictor(self) -> "Forecast":
        '''(experimental) Grants permission to describe a predictor.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_DescribePredictor.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDescribePredictor", []))

    @jsii.member(jsii_name="toDescribePredictorBacktestExportJob")
    def to_describe_predictor_backtest_export_job(self) -> "Forecast":
        '''(experimental) Grants permission to describe a predictor backtest export job.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_DescribePredictorBacktestExportJob.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDescribePredictorBacktestExportJob", []))

    @jsii.member(jsii_name="toGetAccuracyMetrics")
    def to_get_accuracy_metrics(self) -> "Forecast":
        '''(experimental) Grants permission to get the Accuracy Metrics for a predictor.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_GetAccuracyMetrics.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toGetAccuracyMetrics", []))

    @jsii.member(jsii_name="toListDatasetGroups")
    def to_list_dataset_groups(self) -> "Forecast":
        '''(experimental) Grants permission to list all the dataset groups.

        Access Level: List

        https://docs.aws.amazon.com/forecast/latest/dg/API_ListDatasetGroups.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toListDatasetGroups", []))

    @jsii.member(jsii_name="toListDatasetImportJobs")
    def to_list_dataset_import_jobs(self) -> "Forecast":
        '''(experimental) Grants permission to list all the dataset import jobs.

        Access Level: List

        https://docs.aws.amazon.com/forecast/latest/dg/API_ListDatasetImportJobs.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toListDatasetImportJobs", []))

    @jsii.member(jsii_name="toListDatasets")
    def to_list_datasets(self) -> "Forecast":
        '''(experimental) Grants permission to list all the datasets.

        Access Level: List

        https://docs.aws.amazon.com/forecast/latest/dg/API_ListDatasets.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toListDatasets", []))

    @jsii.member(jsii_name="toListForecastExportJobs")
    def to_list_forecast_export_jobs(self) -> "Forecast":
        '''(experimental) Grants permission to list all the forecast export jobs.

        Access Level: List

        https://docs.aws.amazon.com/forecast/latest/dg/API_ListForecastExportJobs.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toListForecastExportJobs", []))

    @jsii.member(jsii_name="toListForecasts")
    def to_list_forecasts(self) -> "Forecast":
        '''(experimental) Grants permission to list all the forecasts.

        Access Level: List

        https://docs.aws.amazon.com/forecast/latest/dg/API_ListForecasts.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toListForecasts", []))

    @jsii.member(jsii_name="toListPredictorBacktestExportJobs")
    def to_list_predictor_backtest_export_jobs(self) -> "Forecast":
        '''(experimental) Grants permission to list all the predictor backtest export jobs.

        Access Level: List

        https://docs.aws.amazon.com/forecast/latest/dg/API_ListPredictorBacktestExportJobs.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toListPredictorBacktestExportJobs", []))

    @jsii.member(jsii_name="toListPredictors")
    def to_list_predictors(self) -> "Forecast":
        '''(experimental) Grants permission to list all the predictors.

        Access Level: List

        https://docs.aws.amazon.com/forecast/latest/dg/API_ListPredictors.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toListPredictors", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Forecast":
        '''(experimental) Grants permission to list the tags for an Amazon Forecast resource.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toQueryForecast")
    def to_query_forecast(self) -> "Forecast":
        '''(experimental) Grants permission to retrieve a forecast for a single item.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_forecastquery_QueryForecast.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toQueryForecast", []))

    @jsii.member(jsii_name="toStopResource")
    def to_stop_resource(self) -> "Forecast":
        '''(experimental) Grants permission to stop Amazon Forecast resource jobs.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/forecast/latest/dg/API_StopResource.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toStopResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Forecast":
        '''(experimental) Grants permission to associate the specified tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/forecast/latest/dg/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Forecast":
        '''(experimental) Grants permission to delete the specified tags for a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/forecast/latest/dg/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateDatasetGroup")
    def to_update_dataset_group(self) -> "Forecast":
        '''(experimental) Grants permission to update a dataset group.

        Access Level: Write

        https://docs.aws.amazon.com/forecast/latest/dg/API_UpdateDatasetGroup.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toUpdateDatasetGroup", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Frauddetector(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Frauddetector",
):
    '''(experimental) Statement provider for service `frauddetector <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfrauddetector.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `frauddetector <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfrauddetector.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Frauddetector, self, [sid])

    @jsii.member(jsii_name="onBatchPrediction")
    def on_batch_prediction(
        self,
        resource_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Frauddetector":
        '''(experimental) Adds a resource of type batch-prediction to the statement.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfrauddetector.html#amazonfrauddetector-resources-for-iam-policies

        :param resource_path: - Identifier for the resourcePath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "onBatchPrediction", [resource_path, account, region, partition]))

    @jsii.member(jsii_name="onDetector")
    def on_detector(
        self,
        resource_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Frauddetector":
        '''(experimental) Adds a resource of type detector to the statement.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfrauddetector.html#amazonfrauddetector-resources-for-iam-policies

        :param resource_path: - Identifier for the resourcePath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "onDetector", [resource_path, account, region, partition]))

    @jsii.member(jsii_name="onDetectorVersion")
    def on_detector_version(
        self,
        resource_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Frauddetector":
        '''(experimental) Adds a resource of type detector-version to the statement.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfrauddetector.html#amazonfrauddetector-resources-for-iam-policies

        :param resource_path: - Identifier for the resourcePath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "onDetectorVersion", [resource_path, account, region, partition]))

    @jsii.member(jsii_name="onEntityType")
    def on_entity_type(
        self,
        resource_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Frauddetector":
        '''(experimental) Adds a resource of type entity-type to the statement.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfrauddetector.html#amazonfrauddetector-resources-for-iam-policies

        :param resource_path: - Identifier for the resourcePath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "onEntityType", [resource_path, account, region, partition]))

    @jsii.member(jsii_name="onEventType")
    def on_event_type(
        self,
        resource_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Frauddetector":
        '''(experimental) Adds a resource of type event-type to the statement.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfrauddetector.html#amazonfrauddetector-resources-for-iam-policies

        :param resource_path: - Identifier for the resourcePath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "onEventType", [resource_path, account, region, partition]))

    @jsii.member(jsii_name="onExternalModel")
    def on_external_model(
        self,
        resource_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Frauddetector":
        '''(experimental) Adds a resource of type external-model to the statement.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfrauddetector.html#amazonfrauddetector-resources-for-iam-policies

        :param resource_path: - Identifier for the resourcePath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "onExternalModel", [resource_path, account, region, partition]))

    @jsii.member(jsii_name="onLabel")
    def on_label(
        self,
        resource_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Frauddetector":
        '''(experimental) Adds a resource of type label to the statement.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfrauddetector.html#amazonfrauddetector-resources-for-iam-policies

        :param resource_path: - Identifier for the resourcePath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "onLabel", [resource_path, account, region, partition]))

    @jsii.member(jsii_name="onModel")
    def on_model(
        self,
        resource_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Frauddetector":
        '''(experimental) Adds a resource of type model to the statement.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfrauddetector.html#amazonfrauddetector-resources-for-iam-policies

        :param resource_path: - Identifier for the resourcePath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "onModel", [resource_path, account, region, partition]))

    @jsii.member(jsii_name="onModelVersion")
    def on_model_version(
        self,
        resource_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Frauddetector":
        '''(experimental) Adds a resource of type model-version to the statement.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfrauddetector.html#amazonfrauddetector-resources-for-iam-policies

        :param resource_path: - Identifier for the resourcePath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "onModelVersion", [resource_path, account, region, partition]))

    @jsii.member(jsii_name="onOutcome")
    def on_outcome(
        self,
        resource_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Frauddetector":
        '''(experimental) Adds a resource of type outcome to the statement.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfrauddetector.html#amazonfrauddetector-resources-for-iam-policies

        :param resource_path: - Identifier for the resourcePath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "onOutcome", [resource_path, account, region, partition]))

    @jsii.member(jsii_name="onRule")
    def on_rule(
        self,
        resource_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Frauddetector":
        '''(experimental) Adds a resource of type rule to the statement.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfrauddetector.html#amazonfrauddetector-resources-for-iam-policies

        :param resource_path: - Identifier for the resourcePath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "onRule", [resource_path, account, region, partition]))

    @jsii.member(jsii_name="onVariable")
    def on_variable(
        self,
        resource_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Frauddetector":
        '''(experimental) Adds a resource of type variable to the statement.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfrauddetector.html#amazonfrauddetector-resources-for-iam-policies

        :param resource_path: - Identifier for the resourcePath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "onVariable", [resource_path, account, region, partition]))

    @jsii.member(jsii_name="toBatchCreateVariable")
    def to_batch_create_variable(self) -> "Frauddetector":
        '''(experimental) Grants permission to create a batch of variables.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_BatchCreateVariable

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toBatchCreateVariable", []))

    @jsii.member(jsii_name="toBatchGetVariable")
    def to_batch_get_variable(self) -> "Frauddetector":
        '''(experimental) Grants permission to get a batch of variables.

        Access Level: List

        https://docs.aws.amazon.com/frauddetector/latest/api/API_BatchGetVariable

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toBatchGetVariable", []))

    @jsii.member(jsii_name="toCancelBatchPredictionJob")
    def to_cancel_batch_prediction_job(self) -> "Frauddetector":
        '''(experimental) Grants permission to cancel the specified batch prediction job.

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_CancelBatchPredictionJob

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toCancelBatchPredictionJob", []))

    @jsii.member(jsii_name="toCreateBatchPredictionJob")
    def to_create_batch_prediction_job(self) -> "Frauddetector":
        '''(experimental) Grants permission to create a batch prediction job.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_CreateBatchPredictionJob

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toCreateBatchPredictionJob", []))

    @jsii.member(jsii_name="toCreateDetectorVersion")
    def to_create_detector_version(self) -> "Frauddetector":
        '''(experimental) Grants permission to create a detector version. The detector version starts in a DRAFT status.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_CreateDetectorVersion

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toCreateDetectorVersion", []))

    @jsii.member(jsii_name="toCreateModel")
    def to_create_model(self) -> "Frauddetector":
        '''(experimental) Grants permission to create a model using the specified model type.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_CreateModel

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toCreateModel", []))

    @jsii.member(jsii_name="toCreateModelVersion")
    def to_create_model_version(self) -> "Frauddetector":
        '''(experimental) Grants permission to create a version of the model using the specified model type and model id.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_CreateModelVersion

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toCreateModelVersion", []))

    @jsii.member(jsii_name="toCreateRule")
    def to_create_rule(self) -> "Frauddetector":
        '''(experimental) Grants permission to create a rule for use with the specified detector.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_CreateRule.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toCreateRule", []))

    @jsii.member(jsii_name="toCreateVariable")
    def to_create_variable(self) -> "Frauddetector":
        '''(experimental) Grants permission to create a variable.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_CreateVariable.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toCreateVariable", []))

    @jsii.member(jsii_name="toDeleteBatchPredictionJob")
    def to_delete_batch_prediction_job(self) -> "Frauddetector":
        '''(experimental) Grants permission to delete a batch prediction job.

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_DeleteBatchPredictionJob

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toDeleteBatchPredictionJob", []))

    @jsii.member(jsii_name="toDeleteDetector")
    def to_delete_detector(self) -> "Frauddetector":
        '''(experimental) Grants permission to delete the detector.

        Before deleting a detector, you must first delete all detector versions and rule versions associated with the detector

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_DeleteDetector

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toDeleteDetector", []))

    @jsii.member(jsii_name="toDeleteDetectorVersion")
    def to_delete_detector_version(self) -> "Frauddetector":
        '''(experimental) Grants permission to delete the detector version. You cannot delete detector versions that are in ACTIVE status.

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_DeleteDetectorVersion

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toDeleteDetectorVersion", []))

    @jsii.member(jsii_name="toDeleteEntityType")
    def to_delete_entity_type(self) -> "Frauddetector":
        '''(experimental) Grants permission to delete an entity type.

        You cannot delete an entity type that is included in an event type

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_DeleteEntityType

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toDeleteEntityType", []))

    @jsii.member(jsii_name="toDeleteEvent")
    def to_delete_event(self) -> "Frauddetector":
        '''(experimental) Grants permission to deletes the specified event.

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_DeleteEvent

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toDeleteEvent", []))

    @jsii.member(jsii_name="toDeleteEventType")
    def to_delete_event_type(self) -> "Frauddetector":
        '''(experimental) Grants permission to delete an event type.

        You cannot delete an event type that is used in a detector or a model

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_DeleteEventType

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toDeleteEventType", []))

    @jsii.member(jsii_name="toDeleteExternalModel")
    def to_delete_external_model(self) -> "Frauddetector":
        '''(experimental) Grants permission to remove a SageMaker model from Amazon Fraud Detector.

        You can remove an Amazon SageMaker model if it is not associated with a detector version

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_DeleteExternalModel

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toDeleteExternalModel", []))

    @jsii.member(jsii_name="toDeleteLabel")
    def to_delete_label(self) -> "Frauddetector":
        '''(experimental) Grants permission to delete a label.

        You cannot delete labels that are included in an event type in Amazon Fraud Detector. You cannot delete a label assigned to an event ID. You must first delete the relevant event ID

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_DeleteLabel

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toDeleteLabel", []))

    @jsii.member(jsii_name="toDeleteModel")
    def to_delete_model(self) -> "Frauddetector":
        '''(experimental) Grants permission to delete a model.

        You can delete models and model versions in Amazon Fraud Detector, provided that they are not associated with a detector version

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_DeleteModel

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toDeleteModel", []))

    @jsii.member(jsii_name="toDeleteModelVersion")
    def to_delete_model_version(self) -> "Frauddetector":
        '''(experimental) Grants permission to delete a model version.

        You can delete models and model versions in Amazon Fraud Detector, provided that they are not associated with a detector version

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_DeleteModelVersion

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toDeleteModelVersion", []))

    @jsii.member(jsii_name="toDeleteOutcome")
    def to_delete_outcome(self) -> "Frauddetector":
        '''(experimental) Grants permission to delete an outcome. You cannot delete an outcome that is used in a rule version.

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_DeleteOutcome

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toDeleteOutcome", []))

    @jsii.member(jsii_name="toDeleteRule")
    def to_delete_rule(self) -> "Frauddetector":
        '''(experimental) Grants permission to delete the rule.

        You cannot delete a rule if it is used by an ACTIVE or INACTIVE detector version

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_DeleteRule

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toDeleteRule", []))

    @jsii.member(jsii_name="toDeleteVariable")
    def to_delete_variable(self) -> "Frauddetector":
        '''(experimental) Grants permission to delete a variable.

        You cannot delete variables that are included in an event type in Amazon Fraud Detector

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_DeleteVariable

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toDeleteVariable", []))

    @jsii.member(jsii_name="toDescribeDetector")
    def to_describe_detector(self) -> "Frauddetector":
        '''(experimental) Grants permission to get all versions for a specified detector.

        Access Level: Read

        https://docs.aws.amazon.com/frauddetector/latest/api/API_DescribeDetector

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toDescribeDetector", []))

    @jsii.member(jsii_name="toDescribeModelVersions")
    def to_describe_model_versions(self) -> "Frauddetector":
        '''(experimental) Grants permission to get all of the model versions for the specified model type or for the specified model type and model ID.

        You can also get details for a single, specified model version

        Access Level: Read

        https://docs.aws.amazon.com/frauddetector/latest/api/API_DescribeModelVersions

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toDescribeModelVersions", []))

    @jsii.member(jsii_name="toGetBatchPredictionJobs")
    def to_get_batch_prediction_jobs(self) -> "Frauddetector":
        '''(experimental) Grants permission to get all batch prediction jobs or a specific job if you specify a job ID.

        This is a paginated API. If you provide a null maxResults, this action retrieves a maximum of 50 records per page. If you provide a maxResults, the value must be between 1 and 50. To get the next page results, provide the pagination token from the GetBatchPredictionJobsResponse as part of your request. A null pagination token fetches the records from the beginning

        Access Level: List

        https://docs.aws.amazon.com/frauddetector/latest/api/API_GetBatchPredictionJobs

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toGetBatchPredictionJobs", []))

    @jsii.member(jsii_name="toGetDetectors")
    def to_get_detectors(self) -> "Frauddetector":
        '''(experimental) Grants permission to get all detectors or a single detector if a detectorId is specified.

        This is a paginated API. If you provide a null maxResults, this action retrieves a maximum of 10 records per page. If you provide a maxResults, the value must be between 5 and 10. To get the next page results, provide the pagination token from the GetDetectorsResponse as part of your request. A null pagination token fetches the records from the beginning

        Access Level: List

        https://docs.aws.amazon.com/frauddetector/latest/api/API_GetDetectors

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toGetDetectors", []))

    @jsii.member(jsii_name="toGetDetectorVersion")
    def to_get_detector_version(self) -> "Frauddetector":
        '''(experimental) Grants permission to get a particular detector version.

        Access Level: List

        https://docs.aws.amazon.com/frauddetector/latest/api/API_GetDetectorVersion

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toGetDetectorVersion", []))

    @jsii.member(jsii_name="toGetEntityTypes")
    def to_get_entity_types(self) -> "Frauddetector":
        '''(experimental) Grants permission to get all entity types or a specific entity type if a name is specified.

        This is a paginated API. If you provide a null maxResults, this action retrieves a maximum of 10 records per page. If you provide a maxResults, the value must be between 5 and 10. To get the next page results, provide the pagination token from the GetEntityTypesResponse as part of your request. A null pagination token fetches the records from the beginning

        Access Level: List

        https://docs.aws.amazon.com/frauddetector/latest/api/API_GetEntityTypes

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toGetEntityTypes", []))

    @jsii.member(jsii_name="toGetEventPrediction")
    def to_get_event_prediction(self) -> "Frauddetector":
        '''(experimental) Grants permission to evaluate an event against a detector version.

        If a version ID is not provided, the detector’s (ACTIVE) version is used

        Access Level: Read

        https://docs.aws.amazon.com/frauddetector/latest/api/API_GetEventPrediction

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toGetEventPrediction", []))

    @jsii.member(jsii_name="toGetEventTypes")
    def to_get_event_types(self) -> "Frauddetector":
        '''(experimental) Grants permission to get all event types or a specific event type if name is provided.

        This is a paginated API. If you provide a null maxResults, this action retrieves a maximum of 10 records per page. If you provide a maxResults, the value must be between 5 and 10. To get the next page results, provide the pagination token from the GetEventTypesResponse as part of your request. A null pagination token fetches the records from the beginning

        Access Level: List

        https://docs.aws.amazon.com/frauddetector/latest/api/API_GetEventTypes

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toGetEventTypes", []))

    @jsii.member(jsii_name="toGetExternalModels")
    def to_get_external_models(self) -> "Frauddetector":
        '''(experimental) Grants permission to get the details for one or more Amazon SageMaker models that have been imported into the service.

        This is a paginated API. If you provide a null maxResults, this actions retrieves a maximum of 10 records per page. If you provide a maxResults, the value must be between 5 and 10. To get the next page results, provide the pagination token from the GetExternalModelsResult as part of your request. A null pagination token fetches the records from the beginning

        Access Level: List

        https://docs.aws.amazon.com/frauddetector/latest/api/API_GetExternalModels

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toGetExternalModels", []))

    @jsii.member(jsii_name="toGetKMSEncryptionKey")
    def to_get_kms_encryption_key(self) -> "Frauddetector":
        '''(experimental) Grants permission to get the encryption key if a Key Management Service (KMS) customer master key (CMK) has been specified to be used to encrypt content in Amazon Fraud Detector.

        Access Level: Read

        https://docs.aws.amazon.com/frauddetector/latest/api/API_GetKMSEncryptionKey

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toGetKMSEncryptionKey", []))

    @jsii.member(jsii_name="toGetLabels")
    def to_get_labels(self) -> "Frauddetector":
        '''(experimental) Grants permission to get all labels or a specific label if name is provided.

        This is a paginated API. If you provide a null maxResults, this action retrieves a maximum of 50 records per page. If you provide a maxResults, the value must be between 10 and 50. To get the next page results, provide the pagination token from the GetGetLabelsResponse as part of your request. A null pagination token fetches the records from the beginning

        Access Level: List

        https://docs.aws.amazon.com/frauddetector/latest/api/API_GetLabels

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toGetLabels", []))

    @jsii.member(jsii_name="toGetModels")
    def to_get_models(self) -> "Frauddetector":
        '''(experimental) Grants permission to get one or more models.

        Gets all models for the AWS account if no model type and no model id provided. Gets all models for the AWS account and model type, if the model type is specified but model id is not provided. Gets a specific model if (model type, model id) tuple is specified

        Access Level: List

        https://docs.aws.amazon.com/frauddetector/latest/api/API_GetModels

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toGetModels", []))

    @jsii.member(jsii_name="toGetModelVersion")
    def to_get_model_version(self) -> "Frauddetector":
        '''(experimental) Grants permission to get the details of the specified model version.

        Access Level: List

        https://docs.aws.amazon.com/frauddetector/latest/api/API_GetModelVersion

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toGetModelVersion", []))

    @jsii.member(jsii_name="toGetOutcomes")
    def to_get_outcomes(self) -> "Frauddetector":
        '''(experimental) Grants permission to get one or more outcomes.

        This is a paginated API. If you provide a null maxResults, this actions retrieves a maximum of 100 records per page. If you provide a maxResults, the value must be between 50 and 100. To get the next page results, provide the pagination token from the GetOutcomesResult as part of your request. A null pagination token fetches the records from the beginning

        Access Level: List

        https://docs.aws.amazon.com/frauddetector/latest/api/API_GetOutcomes

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toGetOutcomes", []))

    @jsii.member(jsii_name="toGetRules")
    def to_get_rules(self) -> "Frauddetector":
        '''(experimental) Grants permission to get all rules for a detector (paginated) if ruleId and ruleVersion are not specified.

        Gets all rules for the detector and the ruleId if present (paginated). Gets a specific rule if both the ruleId and the ruleVersion are specified

        Access Level: List

        https://docs.aws.amazon.com/frauddetector/latest/api/API_GetRules.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toGetRules", []))

    @jsii.member(jsii_name="toGetVariables")
    def to_get_variables(self) -> "Frauddetector":
        '''(experimental) Grants permission to get all of the variables or the specific variable.

        This is a paginated API. Providing null maxSizePerPage results in retrieving maximum of 100 records per page. If you provide maxSizePerPage the value must be between 50 and 100. To get the next page result, a provide a pagination token from GetVariablesResult as part of your request. Null pagination token fetches the records from the beginning

        Access Level: List

        https://docs.aws.amazon.com/frauddetector/latest/api/API_GetVariables

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toGetVariables", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Frauddetector":
        '''(experimental) Grants permission to list all tags associated with the resource.

        This is a paginated API. To get the next page results, provide the pagination token from the response as part of your request. A null pagination token fetches the records from the beginning

        Access Level: List

        https://docs.aws.amazon.com/frauddetector/latest/api/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutDetector")
    def to_put_detector(self) -> "Frauddetector":
        '''(experimental) Grants permission to create or update a detector.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_PutDetector.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toPutDetector", []))

    @jsii.member(jsii_name="toPutEntityType")
    def to_put_entity_type(self) -> "Frauddetector":
        '''(experimental) Grants permission to create or update an entity type.

        An entity represents who is performing the event. As part of a fraud prediction, you pass the entity ID to indicate the specific entity who performed the event. An entity type classifies the entity. Example classifications include customer, merchant, or account

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_PutEntityType.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toPutEntityType", []))

    @jsii.member(jsii_name="toPutEventType")
    def to_put_event_type(self) -> "Frauddetector":
        '''(experimental) Grants permission to create or update an event type.

        An event is a business activity that is evaluated for fraud risk. With Amazon Fraud Detector, you generate fraud predictions for events. An event type defines the structure for an event sent to Amazon Fraud Detector. This includes the variables sent as part of the event, the entity performing the event (such as a customer), and the labels that classify the event. Example event types include online payment transactions, account registrations, and authentications

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_PutEventType.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toPutEventType", []))

    @jsii.member(jsii_name="toPutExternalModel")
    def to_put_external_model(self) -> "Frauddetector":
        '''(experimental) Grants permission to create or update an Amazon SageMaker model endpoint.

        You can also use this action to update the configuration of the model endpoint, including the IAM role and/or the mapped variables

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_PutExternalModel.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toPutExternalModel", []))

    @jsii.member(jsii_name="toPutKMSEncryptionKey")
    def to_put_kms_encryption_key(self) -> "Frauddetector":
        '''(experimental) Grants permission to specify the Key Management Service (KMS) customer master key (CMK) to be used to encrypt content in Amazon Fraud Detector.

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_PutKMSEncryptionKey.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toPutKMSEncryptionKey", []))

    @jsii.member(jsii_name="toPutLabel")
    def to_put_label(self) -> "Frauddetector":
        '''(experimental) Grants permission to create or update label.

        A label classifies an event as fraudulent or legitimate. Labels are associated with event types and used to train supervised machine learning models in Amazon Fraud Detector

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_PutLabel.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toPutLabel", []))

    @jsii.member(jsii_name="toPutOutcome")
    def to_put_outcome(self) -> "Frauddetector":
        '''(experimental) Grants permission to create or update an outcome.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_PutOutcome.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toPutOutcome", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Frauddetector":
        '''(experimental) Grants permission to assign tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Frauddetector":
        '''(experimental) Grants permission to remove tags from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateDetectorVersion")
    def to_update_detector_version(self) -> "Frauddetector":
        '''(experimental) Grants permission to update a detector version.

        The detector version attributes that you can update include models, external model endpoints, rules, rule execution mode, and description. You can only update a DRAFT detector version

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_UpdateDetectorVersion

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toUpdateDetectorVersion", []))

    @jsii.member(jsii_name="toUpdateDetectorVersionMetadata")
    def to_update_detector_version_metadata(self) -> "Frauddetector":
        '''(experimental) Grants permission to update the detector version's description.

        You can update the metadata for any detector version (DRAFT, ACTIVE, or INACTIVE)

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_UpdateDetectorVersionMetadata

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toUpdateDetectorVersionMetadata", []))

    @jsii.member(jsii_name="toUpdateDetectorVersionStatus")
    def to_update_detector_version_status(self) -> "Frauddetector":
        '''(experimental) Grants permission to update the detector version’s status.

        You can perform the following promotions or demotions using UpdateDetectorVersionStatus: DRAFT to ACTIVE, ACTIVE to INACTIVE, and INACTIVE to ACTIVE

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_UpdateDetectorVersionStatus

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toUpdateDetectorVersionStatus", []))

    @jsii.member(jsii_name="toUpdateModel")
    def to_update_model(self) -> "Frauddetector":
        '''(experimental) Grants permission to update a model. You can update the description attribute using this action.

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_UpdateModel

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toUpdateModel", []))

    @jsii.member(jsii_name="toUpdateModelVersion")
    def to_update_model_version(self) -> "Frauddetector":
        '''(experimental) Grants permission to update a model version.

        Updating a model version retrains an existing model version using updated training data and produces a new minor version of the model. You can update the training data set location and data access role attributes using this action. This action creates and trains a new minor version of the model, for example version 1.01, 1.02, 1.03

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_UpdateModelVersion

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toUpdateModelVersion", []))

    @jsii.member(jsii_name="toUpdateModelVersionStatus")
    def to_update_model_version_status(self) -> "Frauddetector":
        '''(experimental) Grants permission to update the status of a model version.

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_UpdateModelVersionStatus

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toUpdateModelVersionStatus", []))

    @jsii.member(jsii_name="toUpdateRuleMetadata")
    def to_update_rule_metadata(self) -> "Frauddetector":
        '''(experimental) Grants permission to update a rule's metadata. The description attribute can be updated.

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_UpdateRuleMetadata.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toUpdateRuleMetadata", []))

    @jsii.member(jsii_name="toUpdateRuleVersion")
    def to_update_rule_version(self) -> "Frauddetector":
        '''(experimental) Grants permission to update a rule version resulting in a new rule version.

        Updates a rule version resulting in a new rule version (version 1, 2, 3 ...)

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_UpdateRuleVersion.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toUpdateRuleVersion", []))

    @jsii.member(jsii_name="toUpdateVariable")
    def to_update_variable(self) -> "Frauddetector":
        '''(experimental) Grants permission to update a variable.

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_UpdateVariable.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toUpdateVariable", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Freertos(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Freertos",
):
    '''(experimental) Statement provider for service `freertos <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfreertos.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `freertos <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfreertos.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Freertos, self, [sid])

    @jsii.member(jsii_name="onConfiguration")
    def on_configuration(
        self,
        configuration_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Freertos":
        '''(experimental) Adds a resource of type configuration to the statement.

        https://docs.aws.amazon.com/freertos/latest/userguide/freertos-ocw.html

        :param configuration_name: - Identifier for the configurationName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Freertos", jsii.invoke(self, "onConfiguration", [configuration_name, account, region, partition]))

    @jsii.member(jsii_name="toCreateSoftwareConfiguration")
    def to_create_software_configuration(self) -> "Freertos":
        '''(experimental) Creates a software configuration.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/freertos/latest/userguide/freertos-ocw.html

        :stability: experimental
        '''
        return typing.cast("Freertos", jsii.invoke(self, "toCreateSoftwareConfiguration", []))

    @jsii.member(jsii_name="toDeleteSoftwareConfiguration")
    def to_delete_software_configuration(self) -> "Freertos":
        '''(experimental) Deletes the software configuration.

        Access Level: Write

        https://docs.aws.amazon.com/freertos/latest/userguide/freertos-ocw.html

        :stability: experimental
        '''
        return typing.cast("Freertos", jsii.invoke(self, "toDeleteSoftwareConfiguration", []))

    @jsii.member(jsii_name="toDescribeHardwarePlatform")
    def to_describe_hardware_platform(self) -> "Freertos":
        '''(experimental) Describes the hardware platform.

        Access Level: Read

        https://docs.aws.amazon.com/freertos/latest/userguide/freertos-ocw.html

        :stability: experimental
        '''
        return typing.cast("Freertos", jsii.invoke(self, "toDescribeHardwarePlatform", []))

    @jsii.member(jsii_name="toDescribeSoftwareConfiguration")
    def to_describe_software_configuration(self) -> "Freertos":
        '''(experimental) Describes the software configuration.

        Access Level: Read

        https://docs.aws.amazon.com/freertos/latest/userguide/freertos-ocw.html

        :stability: experimental
        '''
        return typing.cast("Freertos", jsii.invoke(self, "toDescribeSoftwareConfiguration", []))

    @jsii.member(jsii_name="toGetSoftwareURL")
    def to_get_software_url(self) -> "Freertos":
        '''(experimental) Get the URL for Amazon FreeRTOS software download.

        Access Level: Read

        https://docs.aws.amazon.com/freertos/latest/userguide/freertos-ocw.html

        :stability: experimental
        '''
        return typing.cast("Freertos", jsii.invoke(self, "toGetSoftwareURL", []))

    @jsii.member(jsii_name="toGetSoftwareURLForConfiguration")
    def to_get_software_url_for_configuration(self) -> "Freertos":
        '''(experimental) Get the URL for Amazon FreeRTOS software download based on the configuration.

        Access Level: Read

        https://docs.aws.amazon.com/freertos/latest/userguide/freertos-ocw.html

        :stability: experimental
        '''
        return typing.cast("Freertos", jsii.invoke(self, "toGetSoftwareURLForConfiguration", []))

    @jsii.member(jsii_name="toListFreeRTOSVersions")
    def to_list_free_rtos_versions(self) -> "Freertos":
        '''(experimental) Lists versions of AmazonFreeRTOS.

        Access Level: List

        https://docs.aws.amazon.com/freertos/latest/userguide/freertos-ocw.html

        :stability: experimental
        '''
        return typing.cast("Freertos", jsii.invoke(self, "toListFreeRTOSVersions", []))

    @jsii.member(jsii_name="toListHardwarePlatforms")
    def to_list_hardware_platforms(self) -> "Freertos":
        '''(experimental) Lists the hardware platforms.

        Access Level: List

        https://docs.aws.amazon.com/freertos/latest/userguide/freertos-ocw.html

        :stability: experimental
        '''
        return typing.cast("Freertos", jsii.invoke(self, "toListHardwarePlatforms", []))

    @jsii.member(jsii_name="toListHardwareVendors")
    def to_list_hardware_vendors(self) -> "Freertos":
        '''(experimental) Lists the hardware vendors.

        Access Level: List

        https://docs.aws.amazon.com/freertos/latest/userguide/freertos-ocw.html

        :stability: experimental
        '''
        return typing.cast("Freertos", jsii.invoke(self, "toListHardwareVendors", []))

    @jsii.member(jsii_name="toListSoftwareConfigurations")
    def to_list_software_configurations(self) -> "Freertos":
        '''(experimental) Lists the software configurations.

        Access Level: List

        https://docs.aws.amazon.com/freertos/latest/userguide/freertos-ocw.html

        :stability: experimental
        '''
        return typing.cast("Freertos", jsii.invoke(self, "toListSoftwareConfigurations", []))

    @jsii.member(jsii_name="toUpdateSoftwareConfiguration")
    def to_update_software_configuration(self) -> "Freertos":
        '''(experimental) Updates the software configuration.

        Access Level: Write

        https://docs.aws.amazon.com/freertos/latest/userguide/freertos-ocw.html

        :stability: experimental
        '''
        return typing.cast("Freertos", jsii.invoke(self, "toUpdateSoftwareConfiguration", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Fsx(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Fsx"):
    '''(experimental) Statement provider for service `fsx <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfsx.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `fsx <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfsx.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Fsx, self, [sid])

    @jsii.member(jsii_name="onBackup")
    def on_backup(
        self,
        backup_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Fsx":
        '''(experimental) Adds a resource of type backup to the statement.

        https://docs.aws.amazon.com/fsx/latest/WindowsGuide/access-control-overview.html#access-control-resources

        :param backup_id: - Identifier for the backupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "onBackup", [backup_id, account, region, partition]))

    @jsii.member(jsii_name="onFileSystem")
    def on_file_system(
        self,
        file_system_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Fsx":
        '''(experimental) Adds a resource of type file-system to the statement.

        https://docs.aws.amazon.com/fsx/latest/WindowsGuide/access-control-overview.html#access-control-resources

        :param file_system_id: - Identifier for the fileSystemId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "onFileSystem", [file_system_id, account, region, partition]))

    @jsii.member(jsii_name="onTask")
    def on_task(
        self,
        task_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Fsx":
        '''(experimental) Adds a resource of type task to the statement.

        https://docs.aws.amazon.com/fsx/latest/LustreGuide/access-control-overview.html#access-control-resources

        :param task_id: - Identifier for the taskId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "onTask", [task_id, account, region, partition]))

    @jsii.member(jsii_name="toAssociateFileGateway")
    def to_associate_file_gateway(self) -> "Fsx":
        '''(experimental) Grants permission to associate a File Gateway instance with an Amazon FSx for Windows File Server file system.

        Access Level: Write

        https://docs.aws.amazon.com/filegateway/latest/filefsxw/what-is-file-fsxw.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toAssociateFileGateway", []))

    @jsii.member(jsii_name="toAssociateFileSystemAliases")
    def to_associate_file_system_aliases(self) -> "Fsx":
        '''(experimental) Grants permission to associate DNS aliases with an Amazon FSx for Windows File Server file system.

        Access Level: Write

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_AssociateFileSystemAliases.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toAssociateFileSystemAliases", []))

    @jsii.member(jsii_name="toCancelDataRepositoryTask")
    def to_cancel_data_repository_task(self) -> "Fsx":
        '''(experimental) Grants permission to cancel a data repository task.

        Access Level: Write

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_CancelDataRepositoryTask.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toCancelDataRepositoryTask", []))

    @jsii.member(jsii_name="toCreateBackup")
    def to_create_backup(self) -> "Fsx":
        '''(experimental) Grants permission to create a new backup of an Amazon FSx file system.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_CreateBackup.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toCreateBackup", []))

    @jsii.member(jsii_name="toCreateDataRepositoryTask")
    def to_create_data_repository_task(self) -> "Fsx":
        '''(experimental) Grants permission to create a new data respository task for an Amazon FSx for Lustre file system.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_CreateDataRepositoryTask.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toCreateDataRepositoryTask", []))

    @jsii.member(jsii_name="toCreateFileSystem")
    def to_create_file_system(self) -> "Fsx":
        '''(experimental) Grants permission to create a new, empty, Amazon FSx file system.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_CreateFileSystem.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toCreateFileSystem", []))

    @jsii.member(jsii_name="toCreateFileSystemFromBackup")
    def to_create_file_system_from_backup(self) -> "Fsx":
        '''(experimental) Grants permission to create a new Amazon FSx file system from an existing backup.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_CreateFileSystemFromBackup.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toCreateFileSystemFromBackup", []))

    @jsii.member(jsii_name="toDeleteBackup")
    def to_delete_backup(self) -> "Fsx":
        '''(experimental) Grants permission to delete a backup, deleting its contents.

        After deletion, the backup no longer exists, and its data is no longer available.

        Access Level: Write

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_DeleteBackup.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toDeleteBackup", []))

    @jsii.member(jsii_name="toDeleteFileSystem")
    def to_delete_file_system(self) -> "Fsx":
        '''(experimental) Grants permission to delete a file system, deleting its contents and any existing automatic backups of the file system.

        Access Level: Write

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_DeleteFileSystem.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toDeleteFileSystem", []))

    @jsii.member(jsii_name="toDescribeAssociatedFileGateways")
    def to_describe_associated_file_gateways(self) -> "Fsx":
        '''(experimental) Grants permission to describe the File Gateway instances associated with an Amazon FSx for Windows File Server file system.

        Access Level: Write

        https://docs.aws.amazon.com/filegateway/latest/filefsxw/what-is-file-fsxw.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toDescribeAssociatedFileGateways", []))

    @jsii.member(jsii_name="toDescribeBackups")
    def to_describe_backups(self) -> "Fsx":
        '''(experimental) Grants permission to return the descriptions of all backups owned by your AWS account in the AWS Region of the endpoint that you're calling.

        Access Level: Read

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_DescribeBackups.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toDescribeBackups", []))

    @jsii.member(jsii_name="toDescribeDataRepositoryTasks")
    def to_describe_data_repository_tasks(self) -> "Fsx":
        '''(experimental) Grants permission to return the descriptions of all data repository task owned by your AWS account in the AWS Region of the endpoint that you're calling.

        Access Level: Read

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_DescribeDataRepositoryTasks.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toDescribeDataRepositoryTasks", []))

    @jsii.member(jsii_name="toDescribeFileSystemAliases")
    def to_describe_file_system_aliases(self) -> "Fsx":
        '''(experimental) Grants permission to return the description of all DNS aliases owned by your Amazon FSx for Windows File Server file system.

        Access Level: Read

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_DescribeFileSystemAliases.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toDescribeFileSystemAliases", []))

    @jsii.member(jsii_name="toDescribeFileSystems")
    def to_describe_file_systems(self) -> "Fsx":
        '''(experimental) Grants permission to return the descriptions of all file systems owned by your AWS account in the AWS Region of the endpoint that you're calling.

        Access Level: Read

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_DescribeFileSystems.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toDescribeFileSystems", []))

    @jsii.member(jsii_name="toDisassociateFileGateway")
    def to_disassociate_file_gateway(self) -> "Fsx":
        '''(experimental) Grants permission to disassociate a File Gateway instance from an Amazon FSx for Windows File Server file system.

        Access Level: Write

        https://docs.aws.amazon.com/filegateway/latest/filefsxw/what-is-file-fsxw.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toDisassociateFileGateway", []))

    @jsii.member(jsii_name="toDisassociateFileSystemAliases")
    def to_disassociate_file_system_aliases(self) -> "Fsx":
        '''(experimental) Grants permission to disassociate file system aliases with an Amazon FSx for Windows File Server file system.

        Access Level: Write

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_DisassociateFileSystemAliases.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toDisassociateFileSystemAliases", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Fsx":
        '''(experimental) Grants permission to list tags for an Amazon FSx resource.

        Access Level: Read

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Fsx":
        '''(experimental) Grants permission to tag an Amazon FSx resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Fsx":
        '''(experimental) Grants permission to remove a tag from an Amazon FSx resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateFileSystem")
    def to_update_file_system(self) -> "Fsx":
        '''(experimental) Grants permission to update file system configuration.

        Access Level: Write

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_UpdateFileSystem.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toUpdateFileSystem", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Gamelift(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Gamelift",
):
    '''(experimental) Statement provider for service `gamelift <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazongamelift.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `gamelift <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazongamelift.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Gamelift, self, [sid])

    @jsii.member(jsii_name="onAlias")
    def on_alias(
        self,
        alias_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Gamelift":
        '''(experimental) Adds a resource of type alias to the statement.

        https://docs.aws.amazon.com/gamelift/latest/developerguide/API_Alias.html

        :param alias_id: - Identifier for the aliasId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "onAlias", [alias_id, region, partition]))

    @jsii.member(jsii_name="onBuild")
    def on_build(
        self,
        build_id: builtins.str,
        account_id: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Gamelift":
        '''(experimental) Adds a resource of type build to the statement.

        https://docs.aws.amazon.com/gamelift/latest/developerguide/API_Build.html

        :param build_id: - Identifier for the buildId.
        :param account_id: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "onBuild", [build_id, account_id, region, partition]))

    @jsii.member(jsii_name="onFleet")
    def on_fleet(
        self,
        fleet_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Gamelift":
        '''(experimental) Adds a resource of type fleet to the statement.

        https://docs.aws.amazon.com/gamelift/latest/developerguide/API_FleetAttributes.html

        :param fleet_id: - Identifier for the fleetId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "onFleet", [fleet_id, account, region, partition]))

    @jsii.member(jsii_name="onGameServerGroup")
    def on_game_server_group(
        self,
        game_server_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Gamelift":
        '''(experimental) Adds a resource of type gameServerGroup to the statement.

        https://docs.aws.amazon.com/gamelift/latest/developerguide/API_GameServerGroup.html

        :param game_server_group_name: - Identifier for the gameServerGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "onGameServerGroup", [game_server_group_name, account, region, partition]))

    @jsii.member(jsii_name="onGameSessionQueue")
    def on_game_session_queue(
        self,
        game_session_queue_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Gamelift":
        '''(experimental) Adds a resource of type gameSessionQueue to the statement.

        https://docs.aws.amazon.com/gamelift/latest/developerguide/API_GameSessionQueue.html

        :param game_session_queue_name: - Identifier for the gameSessionQueueName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "onGameSessionQueue", [game_session_queue_name, account, region, partition]))

    @jsii.member(jsii_name="onMatchmakingConfiguration")
    def on_matchmaking_configuration(
        self,
        matchmaking_configuration_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Gamelift":
        '''(experimental) Adds a resource of type matchmakingConfiguration to the statement.

        https://docs.aws.amazon.com/gamelift/latest/developerguide/API_MatchmakingConfiguration.html

        :param matchmaking_configuration_name: - Identifier for the matchmakingConfigurationName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "onMatchmakingConfiguration", [matchmaking_configuration_name, account, region, partition]))

    @jsii.member(jsii_name="onMatchmakingRuleSet")
    def on_matchmaking_rule_set(
        self,
        matchmaking_rule_set_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Gamelift":
        '''(experimental) Adds a resource of type matchmakingRuleSet to the statement.

        https://docs.aws.amazon.com/gamelift/latest/developerguide/API_MatchmakingRuleSet.html

        :param matchmaking_rule_set_name: - Identifier for the matchmakingRuleSetName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "onMatchmakingRuleSet", [matchmaking_rule_set_name, account, region, partition]))

    @jsii.member(jsii_name="onScript")
    def on_script(
        self,
        script_id: builtins.str,
        account_id: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Gamelift":
        '''(experimental) Adds a resource of type script to the statement.

        https://docs.aws.amazon.com/gamelift/latest/developerguide/API_Script.html

        :param script_id: - Identifier for the scriptId.
        :param account_id: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "onScript", [script_id, account_id, region, partition]))

    @jsii.member(jsii_name="toAcceptMatch")
    def to_accept_match(self) -> "Gamelift":
        '''(experimental) Grants permission to register player acceptance or rejection of a proposed FlexMatch match.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_AcceptMatch.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toAcceptMatch", []))

    @jsii.member(jsii_name="toClaimGameServer")
    def to_claim_game_server(self) -> "Gamelift":
        '''(experimental) Grants permission to locate and reserve a game server to host a new game session.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_ClaimGameServer.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toClaimGameServer", []))

    @jsii.member(jsii_name="toCreateAlias")
    def to_create_alias(self) -> "Gamelift":
        '''(experimental) Grants permission to define a new alias for a fleet.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_CreateAlias.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toCreateAlias", []))

    @jsii.member(jsii_name="toCreateBuild")
    def to_create_build(self) -> "Gamelift":
        '''(experimental) Grants permission to create a new game build using files stored in an Amazon S3 bucket.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_CreateBuild.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toCreateBuild", []))

    @jsii.member(jsii_name="toCreateFleet")
    def to_create_fleet(self) -> "Gamelift":
        '''(experimental) Grants permission to create a new fleet of computing resources to run your game servers.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_CreateFleet.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toCreateFleet", []))

    @jsii.member(jsii_name="toCreateFleetLocations")
    def to_create_fleet_locations(self) -> "Gamelift":
        '''(experimental) Grants permission to specify additional locations for a fleet.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_CreateFleetLocations.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toCreateFleetLocations", []))

    @jsii.member(jsii_name="toCreateGameServerGroup")
    def to_create_game_server_group(self) -> "Gamelift":
        '''(experimental) Grants permission to create a new game server group, set up a corresponding Auto Scaling group, and launche instances to host game servers.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_CreateGameServerGroup.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toCreateGameServerGroup", []))

    @jsii.member(jsii_name="toCreateGameSession")
    def to_create_game_session(self) -> "Gamelift":
        '''(experimental) Grants permission to start a new game session on a specified fleet.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_CreateGameSession.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toCreateGameSession", []))

    @jsii.member(jsii_name="toCreateGameSessionQueue")
    def to_create_game_session_queue(self) -> "Gamelift":
        '''(experimental) Grants permission to set up a new queue for processing game session placement requests.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_CreateGameSessionQueue.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toCreateGameSessionQueue", []))

    @jsii.member(jsii_name="toCreateMatchmakingConfiguration")
    def to_create_matchmaking_configuration(self) -> "Gamelift":
        '''(experimental) Grants permission to create a new FlexMatch matchmaker.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_CreateMatchmakingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toCreateMatchmakingConfiguration", []))

    @jsii.member(jsii_name="toCreateMatchmakingRuleSet")
    def to_create_matchmaking_rule_set(self) -> "Gamelift":
        '''(experimental) Grants permission to create a new matchmaking rule set for FlexMatch.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_CreateMatchmakingRuleSet.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toCreateMatchmakingRuleSet", []))

    @jsii.member(jsii_name="toCreatePlayerSession")
    def to_create_player_session(self) -> "Gamelift":
        '''(experimental) Grants permission to reserve an available game session slot for a player.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_CreatePlayerSession.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toCreatePlayerSession", []))

    @jsii.member(jsii_name="toCreatePlayerSessions")
    def to_create_player_sessions(self) -> "Gamelift":
        '''(experimental) Grants permission to reserve available game session slots for multiple players.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_CreatePlayerSessions.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toCreatePlayerSessions", []))

    @jsii.member(jsii_name="toCreateScript")
    def to_create_script(self) -> "Gamelift":
        '''(experimental) Grants permission to create a new Realtime Servers script.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_CreateScript.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toCreateScript", []))

    @jsii.member(jsii_name="toCreateVpcPeeringAuthorization")
    def to_create_vpc_peering_authorization(self) -> "Gamelift":
        '''(experimental) Grants permission to allow GameLift to create or delete a peering connection between a GameLift fleet VPC and a VPC on another AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_CreateVpcPeeringAuthorization.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toCreateVpcPeeringAuthorization", []))

    @jsii.member(jsii_name="toCreateVpcPeeringConnection")
    def to_create_vpc_peering_connection(self) -> "Gamelift":
        '''(experimental) Grants permission to establish a peering connection between your GameLift fleet VPC and a VPC on another account.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_CreateVpcPeeringConnection.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toCreateVpcPeeringConnection", []))

    @jsii.member(jsii_name="toDeleteAlias")
    def to_delete_alias(self) -> "Gamelift":
        '''(experimental) Grants permission to delete an alias.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DeleteAlias.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDeleteAlias", []))

    @jsii.member(jsii_name="toDeleteBuild")
    def to_delete_build(self) -> "Gamelift":
        '''(experimental) Grants permission to delete a game build.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DeleteBuild.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDeleteBuild", []))

    @jsii.member(jsii_name="toDeleteFleet")
    def to_delete_fleet(self) -> "Gamelift":
        '''(experimental) Grants permission to delete an empty fleet.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DeleteFleet.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDeleteFleet", []))

    @jsii.member(jsii_name="toDeleteFleetLocations")
    def to_delete_fleet_locations(self) -> "Gamelift":
        '''(experimental) Grants permission to delete locations for a fleet.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DeleteFleetLocations.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDeleteFleetLocations", []))

    @jsii.member(jsii_name="toDeleteGameServerGroup")
    def to_delete_game_server_group(self) -> "Gamelift":
        '''(experimental) Grants permission to permanently delete a game server group and terminate FleetIQ activity for the corresponding Auto Scaling group.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DeleteGameServerGroup.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDeleteGameServerGroup", []))

    @jsii.member(jsii_name="toDeleteGameSessionQueue")
    def to_delete_game_session_queue(self) -> "Gamelift":
        '''(experimental) Grants permission to delete an existing game session queue.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DeleteGameSessionQueue.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDeleteGameSessionQueue", []))

    @jsii.member(jsii_name="toDeleteMatchmakingConfiguration")
    def to_delete_matchmaking_configuration(self) -> "Gamelift":
        '''(experimental) Grants permission to delete an existing FlexMatch matchmaker.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DeleteMatchmakingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDeleteMatchmakingConfiguration", []))

    @jsii.member(jsii_name="toDeleteMatchmakingRuleSet")
    def to_delete_matchmaking_rule_set(self) -> "Gamelift":
        '''(experimental) Grants permission to delete an existing FlexMatch matchmaking rule set.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DeleteMatchmakingRuleSet.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDeleteMatchmakingRuleSet", []))

    @jsii.member(jsii_name="toDeleteScalingPolicy")
    def to_delete_scaling_policy(self) -> "Gamelift":
        '''(experimental) Grants permission to delete a set of auto-scaling rules.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DeleteScalingPolicy.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDeleteScalingPolicy", []))

    @jsii.member(jsii_name="toDeleteScript")
    def to_delete_script(self) -> "Gamelift":
        '''(experimental) Grants permission to delete a Realtime Servers script.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DeleteScript.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDeleteScript", []))

    @jsii.member(jsii_name="toDeleteVpcPeeringAuthorization")
    def to_delete_vpc_peering_authorization(self) -> "Gamelift":
        '''(experimental) Grants permission to cancel a VPC peering authorization.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DeleteVpcPeeringAuthorization.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDeleteVpcPeeringAuthorization", []))

    @jsii.member(jsii_name="toDeleteVpcPeeringConnection")
    def to_delete_vpc_peering_connection(self) -> "Gamelift":
        '''(experimental) Grants permission to remove a peering connection between VPCs.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DeleteVpcPeeringConnection.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDeleteVpcPeeringConnection", []))

    @jsii.member(jsii_name="toDeregisterGameServer")
    def to_deregister_game_server(self) -> "Gamelift":
        '''(experimental) Grants permission to remove a game server from a game server group.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DeregisterGameServer.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDeregisterGameServer", []))

    @jsii.member(jsii_name="toDescribeAlias")
    def to_describe_alias(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve properties for an alias.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeAlias.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeAlias", []))

    @jsii.member(jsii_name="toDescribeBuild")
    def to_describe_build(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve properties for a game build.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeBuild.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeBuild", []))

    @jsii.member(jsii_name="toDescribeEC2InstanceLimits")
    def to_describe_ec2_instance_limits(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve the maximum allowed and current usage for EC2 instance types.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeEC2InstanceLimits.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeEC2InstanceLimits", []))

    @jsii.member(jsii_name="toDescribeFleetAttributes")
    def to_describe_fleet_attributes(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve general properties, including status, for fleets.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeFleetAttributes.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeFleetAttributes", []))

    @jsii.member(jsii_name="toDescribeFleetCapacity")
    def to_describe_fleet_capacity(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve the current capacity setting for fleets.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeFleetCapacity.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeFleetCapacity", []))

    @jsii.member(jsii_name="toDescribeFleetEvents")
    def to_describe_fleet_events(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve entries from a fleet's event log.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeFleetEvents.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeFleetEvents", []))

    @jsii.member(jsii_name="toDescribeFleetLocationAttributes")
    def to_describe_fleet_location_attributes(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve general properties, including statuses, for a fleet's locations.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeFleetLocationAttributes.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeFleetLocationAttributes", []))

    @jsii.member(jsii_name="toDescribeFleetLocationCapacity")
    def to_describe_fleet_location_capacity(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve the current capacity setting for a fleet's location.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeFleetLocationCapacity.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeFleetLocationCapacity", []))

    @jsii.member(jsii_name="toDescribeFleetLocationUtilization")
    def to_describe_fleet_location_utilization(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve utilization statistics for fleet's location.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeFleetLocationUtilization.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeFleetLocationUtilization", []))

    @jsii.member(jsii_name="toDescribeFleetPortSettings")
    def to_describe_fleet_port_settings(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve the inbound connection permissions for a fleet.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeFleetPortSettings.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeFleetPortSettings", []))

    @jsii.member(jsii_name="toDescribeFleetUtilization")
    def to_describe_fleet_utilization(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve utilization statistics for fleets.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeFleetUtilization.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeFleetUtilization", []))

    @jsii.member(jsii_name="toDescribeGameServer")
    def to_describe_game_server(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve properties for a game server.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeGameServer.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeGameServer", []))

    @jsii.member(jsii_name="toDescribeGameServerGroup")
    def to_describe_game_server_group(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve properties for a game server group.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeGameServerGroup.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeGameServerGroup", []))

    @jsii.member(jsii_name="toDescribeGameServerInstances")
    def to_describe_game_server_instances(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve the status of EC2 instances in a game server group.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeGameServerInstances.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeGameServerInstances", []))

    @jsii.member(jsii_name="toDescribeGameSessionDetails")
    def to_describe_game_session_details(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve properties for game sessions in a fleet, including the protection policy.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeGameSessionDetails.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeGameSessionDetails", []))

    @jsii.member(jsii_name="toDescribeGameSessionPlacement")
    def to_describe_game_session_placement(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve details of a game session placement request.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeGameSessionPlacement.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeGameSessionPlacement", []))

    @jsii.member(jsii_name="toDescribeGameSessionQueues")
    def to_describe_game_session_queues(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve properties for game session queues.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeGameSessionQueues.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeGameSessionQueues", []))

    @jsii.member(jsii_name="toDescribeGameSessions")
    def to_describe_game_sessions(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve properties for game sessions in a fleet.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeGameSessions.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeGameSessions", []))

    @jsii.member(jsii_name="toDescribeInstances")
    def to_describe_instances(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve information about instances in a fleet.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeInstances.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeInstances", []))

    @jsii.member(jsii_name="toDescribeMatchmaking")
    def to_describe_matchmaking(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve details of matchmaking tickets.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeMatchmaking.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeMatchmaking", []))

    @jsii.member(jsii_name="toDescribeMatchmakingConfigurations")
    def to_describe_matchmaking_configurations(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve properties for FlexMatch matchmakers.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeMatchmakingConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeMatchmakingConfigurations", []))

    @jsii.member(jsii_name="toDescribeMatchmakingRuleSets")
    def to_describe_matchmaking_rule_sets(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve properties for FlexMatch matchmaking rule sets.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeMatchmakingRuleSets.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeMatchmakingRuleSets", []))

    @jsii.member(jsii_name="toDescribePlayerSessions")
    def to_describe_player_sessions(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve properties for player sessions in a game session.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribePlayerSessions.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribePlayerSessions", []))

    @jsii.member(jsii_name="toDescribeRuntimeConfiguration")
    def to_describe_runtime_configuration(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve the current runtime configuration for a fleet.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeRuntimeConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeRuntimeConfiguration", []))

    @jsii.member(jsii_name="toDescribeScalingPolicies")
    def to_describe_scaling_policies(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve all scaling policies that are applied to a fleet.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeScalingPolicies.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeScalingPolicies", []))

    @jsii.member(jsii_name="toDescribeScript")
    def to_describe_script(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve properties for a Realtime Servers script.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeScript.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeScript", []))

    @jsii.member(jsii_name="toDescribeVpcPeeringAuthorizations")
    def to_describe_vpc_peering_authorizations(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve valid VPC peering authorizations.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeVpcPeeringAuthorizations.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeVpcPeeringAuthorizations", []))

    @jsii.member(jsii_name="toDescribeVpcPeeringConnections")
    def to_describe_vpc_peering_connections(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve details on active or pending VPC peering connections.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeVpcPeeringConnections.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeVpcPeeringConnections", []))

    @jsii.member(jsii_name="toGetGameSessionLogUrl")
    def to_get_game_session_log_url(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve the location of stored logs for a game session.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_GetGameSessionLogUrl.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toGetGameSessionLogUrl", []))

    @jsii.member(jsii_name="toGetInstanceAccess")
    def to_get_instance_access(self) -> "Gamelift":
        '''(experimental) Grants permission to request remote access to a specified fleet instance.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_GetInstanceAccess.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toGetInstanceAccess", []))

    @jsii.member(jsii_name="toListAliases")
    def to_list_aliases(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve all aliases that are defined in the current region.

        Access Level: List

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_ListAliases.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toListAliases", []))

    @jsii.member(jsii_name="toListBuilds")
    def to_list_builds(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve all game build in the current region.

        Access Level: List

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_ListBuilds.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toListBuilds", []))

    @jsii.member(jsii_name="toListFleets")
    def to_list_fleets(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve a list of fleet IDs for all fleets in the current region.

        Access Level: List

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_ListFleets.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toListFleets", []))

    @jsii.member(jsii_name="toListGameServerGroups")
    def to_list_game_server_groups(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve all game server groups that are defined in the current region.

        Access Level: List

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_ListGameServerGroups.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toListGameServerGroups", []))

    @jsii.member(jsii_name="toListGameServers")
    def to_list_game_servers(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve all game servers that are currently running in a game server group.

        Access Level: List

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_ListGameServers.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toListGameServers", []))

    @jsii.member(jsii_name="toListScripts")
    def to_list_scripts(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve properties for all Realtime Servers scripts in the current region.

        Access Level: List

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_ListScripts.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toListScripts", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve tags for GameLift resources.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutScalingPolicy")
    def to_put_scaling_policy(self) -> "Gamelift":
        '''(experimental) Grants permission to create or update a fleet auto-scaling policy.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_PutScalingPolicy.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toPutScalingPolicy", []))

    @jsii.member(jsii_name="toRegisterGameServer")
    def to_register_game_server(self) -> "Gamelift":
        '''(experimental) Grants permission to notify GameLift FleetIQ when a new game server is ready to host gameplay.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_RegisterGameServer.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toRegisterGameServer", []))

    @jsii.member(jsii_name="toRequestUploadCredentials")
    def to_request_upload_credentials(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve fresh upload credentials to use when uploading a new game build.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_RequestUploadCredentials.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toRequestUploadCredentials", []))

    @jsii.member(jsii_name="toResolveAlias")
    def to_resolve_alias(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve the fleet ID associated with an alias.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_ResolveAlias.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toResolveAlias", []))

    @jsii.member(jsii_name="toResumeGameServerGroup")
    def to_resume_game_server_group(self) -> "Gamelift":
        '''(experimental) Grants permission to reinstate suspended FleetIQ activity for a game server group.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_ResumeGameServerGroup.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toResumeGameServerGroup", []))

    @jsii.member(jsii_name="toSearchGameSessions")
    def to_search_game_sessions(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve game sessions that match a set of search criteria.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_SearchGameSessions.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toSearchGameSessions", []))

    @jsii.member(jsii_name="toStartFleetActions")
    def to_start_fleet_actions(self) -> "Gamelift":
        '''(experimental) Grants permission to resume auto-scaling activity on a fleet after it was suspended with StopFleetActions().

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_StartFleetActions.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toStartFleetActions", []))

    @jsii.member(jsii_name="toStartGameSessionPlacement")
    def to_start_game_session_placement(self) -> "Gamelift":
        '''(experimental) Grants permission to send a game session placement request to a game session queue.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_StartGameSessionPlacement.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toStartGameSessionPlacement", []))

    @jsii.member(jsii_name="toStartMatchBackfill")
    def to_start_match_backfill(self) -> "Gamelift":
        '''(experimental) Grants permission to request FlexMatch matchmaking to fill available player slots in an existing game session.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_StartMatchBackfill.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toStartMatchBackfill", []))

    @jsii.member(jsii_name="toStartMatchmaking")
    def to_start_matchmaking(self) -> "Gamelift":
        '''(experimental) Grants permission to request FlexMatch matchmaking for one or a group of players and initiate game session placement.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_StartMatchmaking.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toStartMatchmaking", []))

    @jsii.member(jsii_name="toStopFleetActions")
    def to_stop_fleet_actions(self) -> "Gamelift":
        '''(experimental) Grants permission to suspend auto-scaling activity on a fleet.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_StopFleetActions.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toStopFleetActions", []))

    @jsii.member(jsii_name="toStopGameSessionPlacement")
    def to_stop_game_session_placement(self) -> "Gamelift":
        '''(experimental) Grants permission to cancel a game session placement request that is in progress.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_StopGameSessionPlacement.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toStopGameSessionPlacement", []))

    @jsii.member(jsii_name="toStopMatchmaking")
    def to_stop_matchmaking(self) -> "Gamelift":
        '''(experimental) Grants permission to cancel a matchmaking or match backfill request that is in progress.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_StopMatchmaking.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toStopMatchmaking", []))

    @jsii.member(jsii_name="toSuspendGameServerGroup")
    def to_suspend_game_server_group(self) -> "Gamelift":
        '''(experimental) Grants permission to temporarily stop FleetIQ activity for a game server group.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_SuspendGameServerGroup.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toSuspendGameServerGroup", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Gamelift":
        '''(experimental) Grants permission to tag GameLift resources.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Gamelift":
        '''(experimental) Grants permission to untag GameLift resources.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAlias")
    def to_update_alias(self) -> "Gamelift":
        '''(experimental) Grants permission to update the properties of an existing alias.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_UpdateAlias.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toUpdateAlias", []))

    @jsii.member(jsii_name="toUpdateBuild")
    def to_update_build(self) -> "Gamelift":
        '''(experimental) Grants permission to update an existing build's metadata.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_UpdateBuild.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toUpdateBuild", []))

    @jsii.member(jsii_name="toUpdateFleetAttributes")
    def to_update_fleet_attributes(self) -> "Gamelift":
        '''(experimental) Grants permission to update the general properties of an existing fleet.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_UpdateFleetAttributes.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toUpdateFleetAttributes", []))

    @jsii.member(jsii_name="toUpdateFleetCapacity")
    def to_update_fleet_capacity(self) -> "Gamelift":
        '''(experimental) Grants permission to adjust a fleet's capacity settings.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_UpdateFleetCapacity.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toUpdateFleetCapacity", []))

    @jsii.member(jsii_name="toUpdateFleetPortSettings")
    def to_update_fleet_port_settings(self) -> "Gamelift":
        '''(experimental) Grants permission to adjust a fleet's port settings.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_UpdateFleetPortSettings.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toUpdateFleetPortSettings", []))

    @jsii.member(jsii_name="toUpdateGameServer")
    def to_update_game_server(self) -> "Gamelift":
        '''(experimental) Grants permission to change game server properties, health status, or utilization status.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_UpdateGameServer.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toUpdateGameServer", []))

    @jsii.member(jsii_name="toUpdateGameServerGroup")
    def to_update_game_server_group(self) -> "Gamelift":
        '''(experimental) Grants permission to update properties for game server group, including allowed instance types.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_UpdateGameServerGroup.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toUpdateGameServerGroup", []))

    @jsii.member(jsii_name="toUpdateGameSession")
    def to_update_game_session(self) -> "Gamelift":
        '''(experimental) Grants permission to update the properties of an existing game session.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_UpdateGameSession.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toUpdateGameSession", []))

    @jsii.member(jsii_name="toUpdateGameSessionQueue")
    def to_update_game_session_queue(self) -> "Gamelift":
        '''(experimental) Grants permission to update properties of an existing game session queue.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_UpdateGameSessionQueue.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toUpdateGameSessionQueue", []))

    @jsii.member(jsii_name="toUpdateMatchmakingConfiguration")
    def to_update_matchmaking_configuration(self) -> "Gamelift":
        '''(experimental) Grants permission to update properties of an existing FlexMatch matchmaking configuration.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_UpdateMatchmakingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toUpdateMatchmakingConfiguration", []))

    @jsii.member(jsii_name="toUpdateRuntimeConfiguration")
    def to_update_runtime_configuration(self) -> "Gamelift":
        '''(experimental) Grants permission to update how server processes are configured on instances in an existing fleet.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_UpdateRuntimeConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toUpdateRuntimeConfiguration", []))

    @jsii.member(jsii_name="toUpdateScript")
    def to_update_script(self) -> "Gamelift":
        '''(experimental) Grants permission to update the metadata and content of an existing Realtime Servers script.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_UpdateScript.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toUpdateScript", []))

    @jsii.member(jsii_name="toValidateMatchmakingRuleSet")
    def to_validate_matchmaking_rule_set(self) -> "Gamelift":
        '''(experimental) Grants permission to validate the syntax of a FlexMatch matchmaking rule set.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_ValidateMatchmakingRuleSet.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toValidateMatchmakingRuleSet", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Geo(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Geo"):
    '''(experimental) Statement provider for service `geo <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonlocation.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `geo <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonlocation.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Geo, self, [sid])

    @jsii.member(jsii_name="onGeofenceCollection")
    def on_geofence_collection(
        self,
        geofence_collection_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Geo":
        '''(experimental) Adds a resource of type geofence-collection to the statement.

        https://docs.aws.amazon.com/location/latest/developerguide/overview.html#geofence-overview

        :param geofence_collection_name: - Identifier for the geofenceCollectionName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "onGeofenceCollection", [geofence_collection_name, account, region, partition]))

    @jsii.member(jsii_name="onMap")
    def on_map(
        self,
        map_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Geo":
        '''(experimental) Adds a resource of type map to the statement.

        https://docs.aws.amazon.com/location/latest/developerguide/overview.html#map-overview

        :param map_name: - Identifier for the mapName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "onMap", [map_name, account, region, partition]))

    @jsii.member(jsii_name="onPlaceIndex")
    def on_place_index(
        self,
        index_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Geo":
        '''(experimental) Adds a resource of type place-index to the statement.

        https://docs.aws.amazon.com/location/latest/developerguide/overview.html#places-overview

        :param index_name: - Identifier for the indexName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "onPlaceIndex", [index_name, account, region, partition]))

    @jsii.member(jsii_name="onTracker")
    def on_tracker(
        self,
        tracker_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Geo":
        '''(experimental) Adds a resource of type tracker to the statement.

        https://docs.aws.amazon.com/location/latest/developerguide/overview.html#tracking-overview

        :param tracker_name: - Identifier for the trackerName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "onTracker", [tracker_name, account, region, partition]))

    @jsii.member(jsii_name="toAssociateTrackerConsumer")
    def to_associate_tracker_consumer(self) -> "Geo":
        '''(experimental) Grants permission to create an association between a geofence-collection and a tracker resource.

        Access Level: Write

        https://docs.aws.amazon.com/location/latest/developerguide/API_AssociateTrackerConsumer.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toAssociateTrackerConsumer", []))

    @jsii.member(jsii_name="toBatchDeleteGeofence")
    def to_batch_delete_geofence(self) -> "Geo":
        '''(experimental) Grants permission to delete a batch of geofences from a geofence collection.

        Access Level: Write

        https://docs.aws.amazon.com/location/latest/developerguide/API_BatchDeleteGeofence.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toBatchDeleteGeofence", []))

    @jsii.member(jsii_name="toBatchEvaluateGeofences")
    def to_batch_evaluate_geofences(self) -> "Geo":
        '''(experimental) Grants permission to evaluate device positions against the position of geofences in a given geofence collection.

        Access Level: Write

        https://docs.aws.amazon.com/location/latest/developerguide/API_BatchEvaluateGeofences.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toBatchEvaluateGeofences", []))

    @jsii.member(jsii_name="toBatchGetDevicePosition")
    def to_batch_get_device_position(self) -> "Geo":
        '''(experimental) Grants permission to send a batch request to retrieve device positions.

        Access Level: Read

        https://docs.aws.amazon.com/location/latest/developerguide/API_BatchGetDevicePosition.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toBatchGetDevicePosition", []))

    @jsii.member(jsii_name="toBatchPutGeofence")
    def to_batch_put_geofence(self) -> "Geo":
        '''(experimental) Grants permission to send a batch request for adding geofences into a given geofence collection.

        Access Level: Write

        https://docs.aws.amazon.com/location/latest/developerguide/API_BatchPutGeofence.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toBatchPutGeofence", []))

    @jsii.member(jsii_name="toBatchUpdateDevicePosition")
    def to_batch_update_device_position(self) -> "Geo":
        '''(experimental) Grants permission to upload a position update for one or more devices to a tracker resource.

        Access Level: Write

        https://docs.aws.amazon.com/location/latest/developerguide/API_BatchUpdateDevicePosition.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toBatchUpdateDevicePosition", []))

    @jsii.member(jsii_name="toCreateGeofenceCollection")
    def to_create_geofence_collection(self) -> "Geo":
        '''(experimental) Grants permission to create a geofence-collection.

        Access Level: Write

        https://docs.aws.amazon.com/location/latest/developerguide/API_CreateGeofenceCollection.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toCreateGeofenceCollection", []))

    @jsii.member(jsii_name="toCreateMap")
    def to_create_map(self) -> "Geo":
        '''(experimental) Grants permission to create a map resource.

        Access Level: Write

        https://docs.aws.amazon.com/location/latest/developerguide/API_CreateMap.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toCreateMap", []))

    @jsii.member(jsii_name="toCreatePlaceIndex")
    def to_create_place_index(self) -> "Geo":
        '''(experimental) Grants permission to create a place index resource.

        Access Level: Write

        https://docs.aws.amazon.com/location/latest/developerguide/API_CreatePlaceIndex.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toCreatePlaceIndex", []))

    @jsii.member(jsii_name="toCreateTracker")
    def to_create_tracker(self) -> "Geo":
        '''(experimental) Grants permission to create a tracker resource.

        Access Level: Write

        https://docs.aws.amazon.com/location/latest/developerguide/API_CreateTracker.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toCreateTracker", []))

    @jsii.member(jsii_name="toDeleteGeofenceCollection")
    def to_delete_geofence_collection(self) -> "Geo":
        '''(experimental) Grants permission to deletes a geofence-collection.

        Access Level: Write

        https://docs.aws.amazon.com/location/latest/developerguide/API_DeleteGeofenceCollection.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toDeleteGeofenceCollection", []))

    @jsii.member(jsii_name="toDeleteMap")
    def to_delete_map(self) -> "Geo":
        '''(experimental) Grants permission to delete a map resource.

        Access Level: Write

        https://docs.aws.amazon.com/location/latest/developerguide/API_DeleteMap.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toDeleteMap", []))

    @jsii.member(jsii_name="toDeletePlaceIndex")
    def to_delete_place_index(self) -> "Geo":
        '''(experimental) Grants permission to delete a place index resource.

        Access Level: Write

        https://docs.aws.amazon.com/location/latest/developerguide/API_DeletePlaceIndex.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toDeletePlaceIndex", []))

    @jsii.member(jsii_name="toDeleteTracker")
    def to_delete_tracker(self) -> "Geo":
        '''(experimental) Grants permission to delete a tracker resource.

        Access Level: Write

        https://docs.aws.amazon.com/location/latest/developerguide/API_DeleteTracker.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toDeleteTracker", []))

    @jsii.member(jsii_name="toDescribeGeofenceCollection")
    def to_describe_geofence_collection(self) -> "Geo":
        '''(experimental) Grants permission to retrieve a geofence collection details.

        Access Level: Read

        https://docs.aws.amazon.com/location/latest/developerguide/API_DescribeGeofenceCollection.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toDescribeGeofenceCollection", []))

    @jsii.member(jsii_name="toDescribeMap")
    def to_describe_map(self) -> "Geo":
        '''(experimental) Grants permission to retrieve a map resource details.

        Access Level: Read

        https://docs.aws.amazon.com/location/latest/developerguide/API_DescribeMap.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toDescribeMap", []))

    @jsii.member(jsii_name="toDescribePlaceIndex")
    def to_describe_place_index(self) -> "Geo":
        '''(experimental) Grants permission to retrieve a a place-index resource details.

        Access Level: Read

        https://docs.aws.amazon.com/location/latest/developerguide/API_DescribePlaceIndex.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toDescribePlaceIndex", []))

    @jsii.member(jsii_name="toDescribeTracker")
    def to_describe_tracker(self) -> "Geo":
        '''(experimental) Grants permission to retrieve a tracker resource details.

        Access Level: Read

        https://docs.aws.amazon.com/location/latest/developerguide/API_DescribeTracker.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toDescribeTracker", []))

    @jsii.member(jsii_name="toDisassociateTrackerConsumer")
    def to_disassociate_tracker_consumer(self) -> "Geo":
        '''(experimental) Grants permission to remove the association between a tracker resource and a geofence-collection.

        Access Level: Write

        https://docs.aws.amazon.com/location/latest/developerguide/API_DisassociateTrackerConsumer.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toDisassociateTrackerConsumer", []))

    @jsii.member(jsii_name="toGetDevicePosition")
    def to_get_device_position(self) -> "Geo":
        '''(experimental) Grants permission to retrieve the latest device position.

        Access Level: Read

        https://docs.aws.amazon.com/location/latest/developerguide/API_GetDevicePosition.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toGetDevicePosition", []))

    @jsii.member(jsii_name="toGetDevicePositionHistory")
    def to_get_device_position_history(self) -> "Geo":
        '''(experimental) Grant permission to retrieve the device position history.

        Access Level: Read

        https://docs.aws.amazon.com/location/latest/developerguide/API_GetDevicePositionHistory.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toGetDevicePositionHistory", []))

    @jsii.member(jsii_name="toGetGeofence")
    def to_get_geofence(self) -> "Geo":
        '''(experimental) Grants permission to retrieve the geofence details from a geofence-collection.

        Access Level: Read

        https://docs.aws.amazon.com/location/latest/developerguide/API_GetGeofence.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toGetGeofence", []))

    @jsii.member(jsii_name="toGetMapGlyphs")
    def to_get_map_glyphs(self) -> "Geo":
        '''(experimental) Grants permission to retrieve the glyph file for a map resource.

        Access Level: Read

        https://docs.aws.amazon.com/location/latest/developerguide/API_GetMapGlyphs.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toGetMapGlyphs", []))

    @jsii.member(jsii_name="toGetMapSprites")
    def to_get_map_sprites(self) -> "Geo":
        '''(experimental) Grants permission to retrieve the sprite file for a map resource.

        Access Level: Read

        https://docs.aws.amazon.com/location/latest/developerguide/API_GetMapSprites.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toGetMapSprites", []))

    @jsii.member(jsii_name="toGetMapStyleDescriptor")
    def to_get_map_style_descriptor(self) -> "Geo":
        '''(experimental) Grants permission to retrieve the map style descriptor from a map resource.

        Access Level: Read

        https://docs.aws.amazon.com/location/latest/developerguide/API_GetMapStyleDescriptor.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toGetMapStyleDescriptor", []))

    @jsii.member(jsii_name="toGetMapTile")
    def to_get_map_tile(self) -> "Geo":
        '''(experimental) Grants permission to retrieve the map tile from the map resource.

        Access Level: Read

        https://docs.aws.amazon.com/location/latest/developerguide/API_GetMapTile.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toGetMapTile", []))

    @jsii.member(jsii_name="toGetMapTileJson")
    def to_get_map_tile_json(self) -> "Geo":
        '''(experimental) Grants permission to retrieves the map TileJSON details from a given map resource.

        Access Level: Read

        https://docs.aws.amazon.com/location/latest/developerguide/API_GetMapTileJson.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toGetMapTileJson", []))

    @jsii.member(jsii_name="toListGeofenceCollections")
    def to_list_geofence_collections(self) -> "Geo":
        '''(experimental) Grants permission to lists geofence-collections.

        Access Level: List

        https://docs.aws.amazon.com/location/latest/developerguide/API_ListGeofenceCollections.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toListGeofenceCollections", []))

    @jsii.member(jsii_name="toListGeofences")
    def to_list_geofences(self) -> "Geo":
        '''(experimental) Grants permission to list geofences stored in a given geofence collection.

        Access Level: Read

        https://docs.aws.amazon.com/location/latest/developerguide/API_ListGeofences.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toListGeofences", []))

    @jsii.member(jsii_name="toListMaps")
    def to_list_maps(self) -> "Geo":
        '''(experimental) Grants permission to list map resources.

        Access Level: List

        https://docs.aws.amazon.com/location/latest/developerguide/API_ListMaps.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toListMaps", []))

    @jsii.member(jsii_name="toListPlaceIndexes")
    def to_list_place_indexes(self) -> "Geo":
        '''(experimental) Grants permission to return a list of place index resources.

        Access Level: List

        https://docs.aws.amazon.com/location/latest/developerguide/API_ListPlaceIndexes.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toListPlaceIndexes", []))

    @jsii.member(jsii_name="toListTrackerConsumers")
    def to_list_tracker_consumers(self) -> "Geo":
        '''(experimental) Grants permission to retrieve a list of geofence collections currently associated to the given tracker resource.

        Access Level: Read

        https://docs.aws.amazon.com/location/latest/developerguide/API_ListTrackerConsumers.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toListTrackerConsumers", []))

    @jsii.member(jsii_name="toListTrackers")
    def to_list_trackers(self) -> "Geo":
        '''(experimental) Grants permission to return a list of tracker resources.

        Access Level: List

        https://docs.aws.amazon.com/location/latest/developerguide/API_ListTrackers.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toListTrackers", []))

    @jsii.member(jsii_name="toPutGeofence")
    def to_put_geofence(self) -> "Geo":
        '''(experimental) Grants permission to add a new geofence or update an existing geofence to a given geofence-collection.

        Access Level: Write

        https://docs.aws.amazon.com/location/latest/developerguide/API_PutGeofence.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toPutGeofence", []))

    @jsii.member(jsii_name="toSearchPlaceIndexForPosition")
    def to_search_place_index_for_position(self) -> "Geo":
        '''(experimental) Grants permission to reverse geocodes a given coordinate.

        Access Level: Read

        https://docs.aws.amazon.com/location/latest/developerguide/API_SearchPlaceIndexForPosition.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toSearchPlaceIndexForPosition", []))

    @jsii.member(jsii_name="toSearchPlaceIndexForText")
    def to_search_place_index_for_text(self) -> "Geo":
        '''(experimental) Grants permission to geocode free-form text, such as an address, name, city or region.

        Access Level: Read

        https://docs.aws.amazon.com/location/latest/developerguide/API_SearchPlaceIndexForText.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toSearchPlaceIndexForText", []))

    @jsii.member(jsii_name="toUpdateGeofenceCollection")
    def to_update_geofence_collection(self) -> "Geo":
        '''(experimental) Grants permission to update the description of a geofence collection.

        Access Level: Write

        https://docs.aws.amazon.com/location/latest/developerguide/API_UpdateGeofenceCollection.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toUpdateGeofenceCollection", []))

    @jsii.member(jsii_name="toUpdateTracker")
    def to_update_tracker(self) -> "Geo":
        '''(experimental) Grants permission to update the description of a tracker resource.

        Access Level: Write

        https://docs.aws.amazon.com/location/latest/developerguide/API_UpdateTracker.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toUpdateTracker", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Glacier(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Glacier"):
    '''(experimental) Statement provider for service `glacier <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonglacier.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `glacier <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonglacier.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Glacier, self, [sid])

    @jsii.member(jsii_name="ifArchiveAgeInDays")
    def if_archive_age_in_days(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Glacier":
        '''(experimental) How long an archive has been stored in the vault, in days.

        https://docs.aws.amazon.com/amazonglacier/latest/dev/access-control-overview.html#specifying-conditions

        Applies to actions:

        - .toDeleteArchive()
        - .toInitiateJob()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "ifArchiveAgeInDays", [value, operator]))

    @jsii.member(jsii_name="ifResourceTagExists")
    def if_resource_tag_exists(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Glacier":
        '''(experimental) A customer-defined tag.

        https://docs.aws.amazon.com/amazonglacier/latest/dev/access-control-overview.html#specifying-conditions

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "ifResourceTagExists", [value, operator]))

    @jsii.member(jsii_name="onVault")
    def on_vault(
        self,
        vault_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Glacier":
        '''(experimental) Adds a resource of type vault to the statement.

        https://docs.aws.amazon.com/amazonglacier/latest/dev/working-with-vaults.html

        :param vault_name: - Identifier for the vaultName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "onVault", [vault_name, account, region, partition]))

    @jsii.member(jsii_name="toAbortMultipartUpload")
    def to_abort_multipart_upload(self) -> "Glacier":
        '''(experimental) Aborts a multipart upload identified by the upload ID.

        Access Level: Write

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-multipart-abort-upload.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toAbortMultipartUpload", []))

    @jsii.member(jsii_name="toAbortVaultLock")
    def to_abort_vault_lock(self) -> "Glacier":
        '''(experimental) Aborts the vault locking process if the vault lock is not in the Locked state.

        Access Level: Permissions management

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-AbortVaultLock.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toAbortVaultLock", []))

    @jsii.member(jsii_name="toAddTagsToVault")
    def to_add_tags_to_vault(self) -> "Glacier":
        '''(experimental) Adds the specified tags to a vault.

        Access Level: Tagging

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-AddTagsToVault.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toAddTagsToVault", []))

    @jsii.member(jsii_name="toCompleteMultipartUpload")
    def to_complete_multipart_upload(self) -> "Glacier":
        '''(experimental) Completes a multipart upload process.

        Access Level: Write

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-multipart-complete-upload.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toCompleteMultipartUpload", []))

    @jsii.member(jsii_name="toCompleteVaultLock")
    def to_complete_vault_lock(self) -> "Glacier":
        '''(experimental) Completes the vault locking process.

        Access Level: Permissions management

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-CompleteVaultLock.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toCompleteVaultLock", []))

    @jsii.member(jsii_name="toCreateVault")
    def to_create_vault(self) -> "Glacier":
        '''(experimental) Creates a new vault with the specified name.

        Access Level: Write

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-vault-put.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toCreateVault", []))

    @jsii.member(jsii_name="toDeleteArchive")
    def to_delete_archive(self) -> "Glacier":
        '''(experimental) Deletes an archive from a vault.

        Access Level: Write

        Possible conditions:

        - .ifArchiveAgeInDays()

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-archive-delete.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toDeleteArchive", []))

    @jsii.member(jsii_name="toDeleteVault")
    def to_delete_vault(self) -> "Glacier":
        '''(experimental) Deletes a vault.

        Access Level: Write

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-vault-delete.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toDeleteVault", []))

    @jsii.member(jsii_name="toDeleteVaultAccessPolicy")
    def to_delete_vault_access_policy(self) -> "Glacier":
        '''(experimental) Deletes the access policy associated with the specified vault.

        Access Level: Permissions management

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-DeleteVaultAccessPolicy.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toDeleteVaultAccessPolicy", []))

    @jsii.member(jsii_name="toDeleteVaultNotifications")
    def to_delete_vault_notifications(self) -> "Glacier":
        '''(experimental) Deletes the notification configuration set for a vault.

        Access Level: Write

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-vault-notifications-delete.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toDeleteVaultNotifications", []))

    @jsii.member(jsii_name="toDescribeJob")
    def to_describe_job(self) -> "Glacier":
        '''(experimental) Returns information about a job you previously initiated.

        Access Level: Read

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-describe-job-get.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toDescribeJob", []))

    @jsii.member(jsii_name="toDescribeVault")
    def to_describe_vault(self) -> "Glacier":
        '''(experimental) Returns information about a vault.

        Access Level: Read

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-vault-get..html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toDescribeVault", []))

    @jsii.member(jsii_name="toGetDataRetrievalPolicy")
    def to_get_data_retrieval_policy(self) -> "Glacier":
        '''(experimental) Returns the current data retrieval policy for the account and region specified in the GET request.

        Access Level: Read

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-GetDataRetrievalPolicy.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toGetDataRetrievalPolicy", []))

    @jsii.member(jsii_name="toGetJobOutput")
    def to_get_job_output(self) -> "Glacier":
        '''(experimental) Downloads the output of the job you initiated.

        Access Level: Read

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-job-output-get.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toGetJobOutput", []))

    @jsii.member(jsii_name="toGetVaultAccessPolicy")
    def to_get_vault_access_policy(self) -> "Glacier":
        '''(experimental) Retrieves the access-policy subresource set on the vault.

        Access Level: Read

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-GetVaultAccessPolicy.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toGetVaultAccessPolicy", []))

    @jsii.member(jsii_name="toGetVaultLock")
    def to_get_vault_lock(self) -> "Glacier":
        '''(experimental) Retrieves attributes from the lock-policy subresource set on the specified vault.

        Access Level: Read

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-GetVaultLock.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toGetVaultLock", []))

    @jsii.member(jsii_name="toGetVaultNotifications")
    def to_get_vault_notifications(self) -> "Glacier":
        '''(experimental) Retrieves the notification-configuration subresource set on the vault.

        Access Level: Read

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-vault-notifications-get.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toGetVaultNotifications", []))

    @jsii.member(jsii_name="toInitiateJob")
    def to_initiate_job(self) -> "Glacier":
        '''(experimental) Initiates a job of the specified type.

        Access Level: Write

        Possible conditions:

        - .ifArchiveAgeInDays()

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-initiate-job-post.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toInitiateJob", []))

    @jsii.member(jsii_name="toInitiateMultipartUpload")
    def to_initiate_multipart_upload(self) -> "Glacier":
        '''(experimental) Initiates a multipart upload.

        Access Level: Write

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-multipart-initiate-upload.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toInitiateMultipartUpload", []))

    @jsii.member(jsii_name="toInitiateVaultLock")
    def to_initiate_vault_lock(self) -> "Glacier":
        '''(experimental) Initiates the vault locking process.

        Access Level: Permissions management

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-InitiateVaultLock.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toInitiateVaultLock", []))

    @jsii.member(jsii_name="toListJobs")
    def to_list_jobs(self) -> "Glacier":
        '''(experimental) Lists jobs for a vault that are in-progress and jobs that have recently finished.

        Access Level: List

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-jobs-get.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toListJobs", []))

    @jsii.member(jsii_name="toListMultipartUploads")
    def to_list_multipart_uploads(self) -> "Glacier":
        '''(experimental) Lists in-progress multipart uploads for the specified vault.

        Access Level: List

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-multipart-list-uploads.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toListMultipartUploads", []))

    @jsii.member(jsii_name="toListParts")
    def to_list_parts(self) -> "Glacier":
        '''(experimental) Lists the parts of an archive that have been uploaded in a specific multipart upload.

        Access Level: List

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-multipart-list-parts.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toListParts", []))

    @jsii.member(jsii_name="toListProvisionedCapacity")
    def to_list_provisioned_capacity(self) -> "Glacier":
        '''(experimental) This operation lists the provisioned capacity for the specified AWS account.

        Access Level: List

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-ListProvisionedCapacity.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toListProvisionedCapacity", []))

    @jsii.member(jsii_name="toListTagsForVault")
    def to_list_tags_for_vault(self) -> "Glacier":
        '''(experimental) Lists all the tags attached to a vault.

        Access Level: List

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-ListTagsForVault.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toListTagsForVault", []))

    @jsii.member(jsii_name="toListVaults")
    def to_list_vaults(self) -> "Glacier":
        '''(experimental) Lists all vaults.

        Access Level: List

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-vaults-get.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toListVaults", []))

    @jsii.member(jsii_name="toPurchaseProvisionedCapacity")
    def to_purchase_provisioned_capacity(self) -> "Glacier":
        '''(experimental) This operation purchases a provisioned capacity unit for an AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-PurchaseProvisionedCapacity.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toPurchaseProvisionedCapacity", []))

    @jsii.member(jsii_name="toRemoveTagsFromVault")
    def to_remove_tags_from_vault(self) -> "Glacier":
        '''(experimental) Removes one or more tags from the set of tags attached to a vault.

        Access Level: Tagging

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-RemoveTagsFromVault.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toRemoveTagsFromVault", []))

    @jsii.member(jsii_name="toSetDataRetrievalPolicy")
    def to_set_data_retrieval_policy(self) -> "Glacier":
        '''(experimental) Sets and then enacts a data retrieval policy in the region specified in the PUT request.

        Access Level: Permissions management

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-SetDataRetrievalPolicy.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toSetDataRetrievalPolicy", []))

    @jsii.member(jsii_name="toSetVaultAccessPolicy")
    def to_set_vault_access_policy(self) -> "Glacier":
        '''(experimental) Configures an access policy for a vault and will overwrite an existing policy.

        Access Level: Permissions management

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-SetVaultAccessPolicy.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toSetVaultAccessPolicy", []))

    @jsii.member(jsii_name="toSetVaultNotifications")
    def to_set_vault_notifications(self) -> "Glacier":
        '''(experimental) Configures vault notifications.

        Access Level: Write

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-vault-notifications-put.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toSetVaultNotifications", []))

    @jsii.member(jsii_name="toUploadArchive")
    def to_upload_archive(self) -> "Glacier":
        '''(experimental) Adds an archive to a vault.

        Access Level: Write

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-archive-post.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toUploadArchive", []))

    @jsii.member(jsii_name="toUploadMultipartPart")
    def to_upload_multipart_part(self) -> "Glacier":
        '''(experimental) Uploads a part of an archive.

        Access Level: Write

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-upload-part.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toUploadMultipartPart", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Globalaccelerator(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Globalaccelerator",
):
    '''(experimental) Statement provider for service `globalaccelerator <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsglobalaccelerator.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `globalaccelerator <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsglobalaccelerator.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Globalaccelerator, self, [sid])

    @jsii.member(jsii_name="onAccelerator")
    def on_accelerator(
        self,
        accelerator_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Globalaccelerator":
        '''(experimental) Adds a resource of type accelerator to the statement.

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_Accelerator.html

        :param accelerator_id: - Identifier for the acceleratorId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "onAccelerator", [accelerator_id, account, partition]))

    @jsii.member(jsii_name="onEndpointgroup")
    def on_endpointgroup(
        self,
        accelerator_id: builtins.str,
        listener_id: builtins.str,
        endpoint_group_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Globalaccelerator":
        '''(experimental) Adds a resource of type endpointgroup to the statement.

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_EndpointGroup.html

        :param accelerator_id: - Identifier for the acceleratorId.
        :param listener_id: - Identifier for the listenerId.
        :param endpoint_group_id: - Identifier for the endpointGroupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "onEndpointgroup", [accelerator_id, listener_id, endpoint_group_id, account, partition]))

    @jsii.member(jsii_name="onListener")
    def on_listener(
        self,
        accelerator_id: builtins.str,
        listener_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Globalaccelerator":
        '''(experimental) Adds a resource of type listener to the statement.

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_Listener.html

        :param accelerator_id: - Identifier for the acceleratorId.
        :param listener_id: - Identifier for the listenerId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "onListener", [accelerator_id, listener_id, account, partition]))

    @jsii.member(jsii_name="toAddCustomRoutingEndpoints")
    def to_add_custom_routing_endpoints(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to add a virtual private cloud (VPC) subnet endpoint to a custom routing accelerator endpoint group.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_AddCustomRoutingEndpoints.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toAddCustomRoutingEndpoints", []))

    @jsii.member(jsii_name="toAdvertiseByoipCidr")
    def to_advertise_byoip_cidr(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to advertises an IPv4 address range that is provisioned for use with your accelerator through bring your own IP addresses (BYOIP).

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_AdvertiseByoipCidr.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toAdvertiseByoipCidr", []))

    @jsii.member(jsii_name="toAllowCustomRoutingTraffic")
    def to_allow_custom_routing_traffic(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to allows custom routing of user traffic to a private destination IP:PORT in a specific VPC subnet.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_AllowCustomRoutingTraffic.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toAllowCustomRoutingTraffic", []))

    @jsii.member(jsii_name="toCreateAccelerator")
    def to_create_accelerator(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to create a standard accelerator.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_CreateAccelerator.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toCreateAccelerator", []))

    @jsii.member(jsii_name="toCreateCustomRoutingAccelerator")
    def to_create_custom_routing_accelerator(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to create a Custom Routing accelerator.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_CreateCustomRoutingAccelerator.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toCreateCustomRoutingAccelerator", []))

    @jsii.member(jsii_name="toCreateCustomRoutingEndpointGroup")
    def to_create_custom_routing_endpoint_group(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to create an endpoint group for the specified listener for a custom routing accelerator.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_CreateCustomRoutingEndpointGroup.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toCreateCustomRoutingEndpointGroup", []))

    @jsii.member(jsii_name="toCreateCustomRoutingListener")
    def to_create_custom_routing_listener(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to create a listener to process inbound connections from clients to a custom routing accelerator.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_CreateCustomRoutingListener.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toCreateCustomRoutingListener", []))

    @jsii.member(jsii_name="toCreateEndpointGroup")
    def to_create_endpoint_group(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to add an endpoint group to a standard accelerator listener.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_CreateEndpointGroup.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toCreateEndpointGroup", []))

    @jsii.member(jsii_name="toCreateListener")
    def to_create_listener(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to add a listener to a standard accelerator.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_CreateListener.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toCreateListener", []))

    @jsii.member(jsii_name="toDeleteAccelerator")
    def to_delete_accelerator(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to delete a standard accelerator.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_DeleteAccelerator.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toDeleteAccelerator", []))

    @jsii.member(jsii_name="toDeleteCustomRoutingAccelerator")
    def to_delete_custom_routing_accelerator(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to delete a custom routing accelerator.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_DeleteCustomRoutingAccelerator.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toDeleteCustomRoutingAccelerator", []))

    @jsii.member(jsii_name="toDeleteCustomRoutingEndpointGroup")
    def to_delete_custom_routing_endpoint_group(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to delete an endpoint group from a listener for a custom routing accelerator.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_DeleteCustomRoutingEndpointGroup.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toDeleteCustomRoutingEndpointGroup", []))

    @jsii.member(jsii_name="toDeleteCustomRoutingListener")
    def to_delete_custom_routing_listener(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to delete a listener for a custom routing accelerator.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_DeleteCustomRoutingListener.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toDeleteCustomRoutingListener", []))

    @jsii.member(jsii_name="toDeleteEndpointGroup")
    def to_delete_endpoint_group(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to delete an endpoint group associated with a standard accelerator listener.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_DeleteEndpointGroup.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toDeleteEndpointGroup", []))

    @jsii.member(jsii_name="toDeleteListener")
    def to_delete_listener(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to delete a listener from a standard accelerator.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_DeleteListener.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toDeleteListener", []))

    @jsii.member(jsii_name="toDenyCustomRoutingTraffic")
    def to_deny_custom_routing_traffic(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to disallows custom routing of user traffic to a private destination IP:PORT in a specific VPC subnet.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_DenyCustomRoutingTraffic.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toDenyCustomRoutingTraffic", []))

    @jsii.member(jsii_name="toDeprovisionByoipCidr")
    def to_deprovision_byoip_cidr(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to releases the specified address range that you provisioned for use with your accelerator through bring your own IP addresses (BYOIP).

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_DeprovisionByoipCidr.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toDeprovisionByoipCidr", []))

    @jsii.member(jsii_name="toDescribeAccelerator")
    def to_describe_accelerator(self) -> "Globalaccelerator":
        '''(experimental) Grants permissions to describe a standard accelerator.

        Access Level: Read

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_DescribeAccelerator.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toDescribeAccelerator", []))

    @jsii.member(jsii_name="toDescribeAcceleratorAttributes")
    def to_describe_accelerator_attributes(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to describe a standard accelerator attributes.

        Access Level: Read

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_DescribeAcceleratorAttributes.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toDescribeAcceleratorAttributes", []))

    @jsii.member(jsii_name="toDescribeCustomRoutingAccelerator")
    def to_describe_custom_routing_accelerator(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to describe a custom routing accelerator.

        Access Level: Read

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_DescribeCustomRoutingAccelerator.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toDescribeCustomRoutingAccelerator", []))

    @jsii.member(jsii_name="toDescribeCustomRoutingAcceleratorAttributes")
    def to_describe_custom_routing_accelerator_attributes(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to describe the attributes of a custom routing accelerator.

        Access Level: Read

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_DescribeCustomRoutingAcceleratorAttributes.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toDescribeCustomRoutingAcceleratorAttributes", []))

    @jsii.member(jsii_name="toDescribeCustomRoutingEndpointGroup")
    def to_describe_custom_routing_endpoint_group(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to describe an endpoint group for a custom routing accelerator.

        Access Level: Read

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_DescribeCustomRoutingEndpointGroup.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toDescribeCustomRoutingEndpointGroup", []))

    @jsii.member(jsii_name="toDescribeCustomRoutingListener")
    def to_describe_custom_routing_listener(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to describe a listener for a custom routing accelerator.

        Access Level: Read

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_DescribeCustomRoutingListener.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toDescribeCustomRoutingListener", []))

    @jsii.member(jsii_name="toDescribeEndpointGroup")
    def to_describe_endpoint_group(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to describe a standard accelerator endpoint group.

        Access Level: Read

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_DescribeEndpointGroup.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toDescribeEndpointGroup", []))

    @jsii.member(jsii_name="toDescribeListener")
    def to_describe_listener(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to describe a standard accelerator listener.

        Access Level: Read

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_DescribeListener.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toDescribeListener", []))

    @jsii.member(jsii_name="toListAccelerators")
    def to_list_accelerators(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to list all standard accelerators.

        Access Level: List

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_ListAccelerators.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toListAccelerators", []))

    @jsii.member(jsii_name="toListByoipCidrs")
    def to_list_byoip_cidrs(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to list the BYOIP cidrs.

        Access Level: List

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_ListByoipCidrs.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toListByoipCidrs", []))

    @jsii.member(jsii_name="toListCustomRoutingAccelerators")
    def to_list_custom_routing_accelerators(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to list the custom routing accelerators for an AWS account.

        Access Level: List

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_ListCustomRoutingAccelerators.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toListCustomRoutingAccelerators", []))

    @jsii.member(jsii_name="toListCustomRoutingEndpointGroups")
    def to_list_custom_routing_endpoint_groups(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to list the endpoint groups that are associated with a listener for a custom routing accelerator.

        Access Level: List

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_ListCustomRoutingEndpointGroups.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toListCustomRoutingEndpointGroups", []))

    @jsii.member(jsii_name="toListCustomRoutingListeners")
    def to_list_custom_routing_listeners(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to list the listeners for a custom routing accelerator.

        Access Level: List

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_ListCustomRoutingListeners.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toListCustomRoutingListeners", []))

    @jsii.member(jsii_name="toListCustomRoutingPortMappings")
    def to_list_custom_routing_port_mappings(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to list the port mappings for a custom routing accelerator.

        Access Level: List

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_ListCustomRoutingPortMappings.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toListCustomRoutingPortMappings", []))

    @jsii.member(jsii_name="toListCustomRoutingPortMappingsByDestination")
    def to_list_custom_routing_port_mappings_by_destination(
        self,
    ) -> "Globalaccelerator":
        '''(experimental) Grants permission to list the port mappings for a specific endpoint IP address (a destination address) in a subnet.

        Access Level: List

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_ListCustomRoutingPortMappingsByDestination.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toListCustomRoutingPortMappingsByDestination", []))

    @jsii.member(jsii_name="toListEndpointGroups")
    def to_list_endpoint_groups(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to list all endpoint groups associated with a standard accelerator listener.

        Access Level: List

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_ListEndpointGroups.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toListEndpointGroups", []))

    @jsii.member(jsii_name="toListListeners")
    def to_list_listeners(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to list all listeners associated with a standard accelerator.

        Access Level: List

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_ListListeners.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toListListeners", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to list tags for a globalaccelerator resource.

        Access Level: Read

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toProvisionByoipCidr")
    def to_provision_byoip_cidr(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to provisions an address range for use with your accelerator through bring your own IP addresses (BYOIP).

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_ProvisionByoipCidr.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toProvisionByoipCidr", []))

    @jsii.member(jsii_name="toRemoveCustomRoutingEndpoints")
    def to_remove_custom_routing_endpoints(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to remove virtual private cloud (VPC) subnet endpoints from a custom routing accelerator endpoint group.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_RemoveCustomRoutingEndpoints.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toRemoveCustomRoutingEndpoints", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to add tags to a globalaccelerator resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to remove tags from a globalaccelerator resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAccelerator")
    def to_update_accelerator(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to update a standard accelerator.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_UpdateAccelerator.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toUpdateAccelerator", []))

    @jsii.member(jsii_name="toUpdateAcceleratorAttributes")
    def to_update_accelerator_attributes(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to update a standard accelerator attributes.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_UpdateAcceleratorAttributes.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toUpdateAcceleratorAttributes", []))

    @jsii.member(jsii_name="toUpdateCustomRoutingAccelerator")
    def to_update_custom_routing_accelerator(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to update a custom routing accelerator.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_UpdateCustomRoutingAccelerator.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toUpdateCustomRoutingAccelerator", []))

    @jsii.member(jsii_name="toUpdateCustomRoutingAcceleratorAttributes")
    def to_update_custom_routing_accelerator_attributes(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to update the attributes for a custom routing accelerator.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_UpdateCustomRoutingAcceleratorAttributes.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toUpdateCustomRoutingAcceleratorAttributes", []))

    @jsii.member(jsii_name="toUpdateCustomRoutingListener")
    def to_update_custom_routing_listener(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to update a listener for a custom routing accelerator.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_UpdateCustomRoutingListener.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toUpdateCustomRoutingListener", []))

    @jsii.member(jsii_name="toUpdateEndpointGroup")
    def to_update_endpoint_group(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to update an endpoint group on a standard accelerator listener.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_UpdateEndpointGroup.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toUpdateEndpointGroup", []))

    @jsii.member(jsii_name="toUpdateListener")
    def to_update_listener(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to update a listener on a standard accelerator.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_UpdateListener.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toUpdateListener", []))

    @jsii.member(jsii_name="toWithdrawByoipCidr")
    def to_withdraw_byoip_cidr(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to stops advertising a BYOIP IPv4 address.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_WithdrawByoipCidr.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toWithdrawByoipCidr", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Glue(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Glue"):
    '''(experimental) Statement provider for service `glue <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsglue.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `glue <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsglue.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Glue, self, [sid])

    @jsii.member(jsii_name="onCatalog")
    def on_catalog(
        self,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Glue":
        '''(experimental) Adds a resource of type catalog to the statement.

        https://docs.aws.amazon.com/glue/latest/dg/glue-specifying-resource-arns.html

        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "onCatalog", [account, region, partition]))

    @jsii.member(jsii_name="onConnection")
    def on_connection(
        self,
        connection_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Glue":
        '''(experimental) Adds a resource of type connection to the statement.

        https://docs.aws.amazon.com/glue/latest/dg/glue-specifying-resource-arns.html

        :param connection_name: - Identifier for the connectionName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "onConnection", [connection_name, account, region, partition]))

    @jsii.member(jsii_name="onCrawler")
    def on_crawler(
        self,
        crawler_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Glue":
        '''(experimental) Adds a resource of type crawler to the statement.

        https://docs.aws.amazon.com/glue/latest/dg/glue-specifying-resource-arns.html

        :param crawler_name: - Identifier for the crawlerName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "onCrawler", [crawler_name, account, region, partition]))

    @jsii.member(jsii_name="onDatabase")
    def on_database(
        self,
        database_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Glue":
        '''(experimental) Adds a resource of type database to the statement.

        https://docs.aws.amazon.com/glue/latest/dg/glue-specifying-resource-arns.html

        :param database_name: - Identifier for the databaseName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "onDatabase", [database_name, account, region, partition]))

    @jsii.member(jsii_name="onDevendpoint")
    def on_devendpoint(
        self,
        dev_endpoint_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Glue":
        '''(experimental) Adds a resource of type devendpoint to the statement.

        https://docs.aws.amazon.com/glue/latest/dg/glue-specifying-resource-arns.html

        :param dev_endpoint_name: - Identifier for the devEndpointName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "onDevendpoint", [dev_endpoint_name, account, region, partition]))

    @jsii.member(jsii_name="onJob")
    def on_job(
        self,
        job_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Glue":
        '''(experimental) Adds a resource of type job to the statement.

        https://docs.aws.amazon.com/glue/latest/dg/glue-specifying-resource-arns.html

        :param job_name: - Identifier for the jobName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "onJob", [job_name, account, region, partition]))

    @jsii.member(jsii_name="onMlTransform")
    def on_ml_transform(
        self,
        transform_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Glue":
        '''(experimental) Adds a resource of type mlTransform to the statement.

        https://docs.aws.amazon.com/glue/latest/dg/glue-specifying-resource-arns.html

        :param transform_id: - Identifier for the transformId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "onMlTransform", [transform_id, account, region, partition]))

    @jsii.member(jsii_name="onRegistry")
    def on_registry(
        self,
        registry_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Glue":
        '''(experimental) Adds a resource of type registry to the statement.

        https://docs.aws.amazon.com/glue/latest/dg/glue-specifying-resource-arns.html

        :param registry_name: - Identifier for the registryName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "onRegistry", [registry_name, account, region, partition]))

    @jsii.member(jsii_name="onSchema")
    def on_schema(
        self,
        schema_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Glue":
        '''(experimental) Adds a resource of type schema to the statement.

        https://docs.aws.amazon.com/glue/latest/dg/glue-specifying-resource-arns.html

        :param schema_name: - Identifier for the schemaName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "onSchema", [schema_name, account, region, partition]))

    @jsii.member(jsii_name="onTable")
    def on_table(
        self,
        database_name: builtins.str,
        table_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Glue":
        '''(experimental) Adds a resource of type table to the statement.

        https://docs.aws.amazon.com/glue/latest/dg/glue-specifying-resource-arns.html

        :param database_name: - Identifier for the databaseName.
        :param table_name: - Identifier for the tableName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "onTable", [database_name, table_name, account, region, partition]))

    @jsii.member(jsii_name="onTableversion")
    def on_tableversion(
        self,
        database_name: builtins.str,
        table_name: builtins.str,
        table_version_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Glue":
        '''(experimental) Adds a resource of type tableversion to the statement.

        https://docs.aws.amazon.com/glue/latest/dg/glue-specifying-resource-arns.html

        :param database_name: - Identifier for the databaseName.
        :param table_name: - Identifier for the tableName.
        :param table_version_name: - Identifier for the tableVersionName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "onTableversion", [database_name, table_name, table_version_name, account, region, partition]))

    @jsii.member(jsii_name="onTrigger")
    def on_trigger(
        self,
        trigger_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Glue":
        '''(experimental) Adds a resource of type trigger to the statement.

        https://docs.aws.amazon.com/glue/latest/dg/glue-specifying-resource-arns.html

        :param trigger_name: - Identifier for the triggerName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "onTrigger", [trigger_name, account, region, partition]))

    @jsii.member(jsii_name="onUserdefinedfunction")
    def on_userdefinedfunction(
        self,
        database_name: builtins.str,
        user_defined_function_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Glue":
        '''(experimental) Adds a resource of type userdefinedfunction to the statement.

        https://docs.aws.amazon.com/glue/latest/dg/glue-specifying-resource-arns.html

        :param database_name: - Identifier for the databaseName.
        :param user_defined_function_name: - Identifier for the userDefinedFunctionName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "onUserdefinedfunction", [database_name, user_defined_function_name, account, region, partition]))

    @jsii.member(jsii_name="onWorkflow")
    def on_workflow(
        self,
        workflow_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Glue":
        '''(experimental) Adds a resource of type workflow to the statement.

        https://docs.aws.amazon.com/glue/latest/dg/glue-specifying-resource-arns.html

        :param workflow_name: - Identifier for the workflowName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "onWorkflow", [workflow_name, account, region, partition]))

    @jsii.member(jsii_name="toBatchCreatePartition")
    def to_batch_create_partition(self) -> "Glue":
        '''(experimental) Grants permission to create one or more partitions.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-partitions.html#aws-glue-api-catalog-partitions-BatchCreatePartition

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toBatchCreatePartition", []))

    @jsii.member(jsii_name="toBatchDeleteConnection")
    def to_batch_delete_connection(self) -> "Glue":
        '''(experimental) Grants permission to delete one or more connections.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-connections.html#aws-glue-api-catalog-connections-BatchDeleteConnection

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toBatchDeleteConnection", []))

    @jsii.member(jsii_name="toBatchDeletePartition")
    def to_batch_delete_partition(self) -> "Glue":
        '''(experimental) Grants permission to delete one or more partitions.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-partitions.html#aws-glue-api-catalog-partitions-BatchDeletePartition

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toBatchDeletePartition", []))

    @jsii.member(jsii_name="toBatchDeleteTable")
    def to_batch_delete_table(self) -> "Glue":
        '''(experimental) Grants permission to delete one or more tables.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-BatchDeleteTable

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toBatchDeleteTable", []))

    @jsii.member(jsii_name="toBatchDeleteTableVersion")
    def to_batch_delete_table_version(self) -> "Glue":
        '''(experimental) Grants permission to delete one or more versions of a table.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-DeleteTableVersion

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toBatchDeleteTableVersion", []))

    @jsii.member(jsii_name="toBatchGetCrawlers")
    def to_batch_get_crawlers(self) -> "Glue":
        '''(experimental) Grants permission to retrieve one or more crawlers.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-crawling.html#aws-glue-api-crawler-crawling-BatchGetCrawlers

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toBatchGetCrawlers", []))

    @jsii.member(jsii_name="toBatchGetDevEndpoints")
    def to_batch_get_dev_endpoints(self) -> "Glue":
        '''(experimental) Grants permission to retrieve one or more development endpoints.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-dev-endpoint.html#aws-glue-api-dev-endpoint-BatchGetDevEndpoints

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toBatchGetDevEndpoints", []))

    @jsii.member(jsii_name="toBatchGetJobs")
    def to_batch_get_jobs(self) -> "Glue":
        '''(experimental) Grants permission to retrieve one or more jobs.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-job.html#aws-glue-api-jobs-job-BatchGetJobs

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toBatchGetJobs", []))

    @jsii.member(jsii_name="toBatchGetPartition")
    def to_batch_get_partition(self) -> "Glue":
        '''(experimental) Grants permission to retrieve one or more partitions.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-partitions.html#aws-glue-api-catalog-partitions-BatchGetPartition

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toBatchGetPartition", []))

    @jsii.member(jsii_name="toBatchGetTriggers")
    def to_batch_get_triggers(self) -> "Glue":
        '''(experimental) Grants permission to retrieve one or more triggers.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-trigger.html#aws-glue-api-jobs-trigger-BatchGetTriggers

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toBatchGetTriggers", []))

    @jsii.member(jsii_name="toBatchGetWorkflows")
    def to_batch_get_workflows(self) -> "Glue":
        '''(experimental) Grants permission to retrieve one or more workflows.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-workflow.html#aws-glue-api-workflow-BatchGetWorkflows

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toBatchGetWorkflows", []))

    @jsii.member(jsii_name="toBatchStopJobRun")
    def to_batch_stop_job_run(self) -> "Glue":
        '''(experimental) Grants permission to stop one or more job runs for a job.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-runs.html#aws-glue-api-jobs-runs-BatchStopStartJobRun

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toBatchStopJobRun", []))

    @jsii.member(jsii_name="toCancelMLTaskRun")
    def to_cancel_ml_task_run(self) -> "Glue":
        '''(experimental) Grants permission to stop a running ML Task Run.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-machine-learning-api.html#aws-glue-api-machine-learning-api-CancelMLTaskRun

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCancelMLTaskRun", []))

    @jsii.member(jsii_name="toCheckSchemaVersionValidity")
    def to_check_schema_version_validity(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a check the validity of schema version.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-CheckSchemaVersionValidity

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCheckSchemaVersionValidity", []))

    @jsii.member(jsii_name="toCreateClassifier")
    def to_create_classifier(self) -> "Glue":
        '''(experimental) Grants permission to create a classifier.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-classifiers.html#aws-glue-api-crawler-classifiers-CreateClassifier

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCreateClassifier", []))

    @jsii.member(jsii_name="toCreateConnection")
    def to_create_connection(self) -> "Glue":
        '''(experimental) Grants permission to create a connection.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-connections.html#aws-glue-api-catalog-connections-CreateConnection

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCreateConnection", []))

    @jsii.member(jsii_name="toCreateCrawler")
    def to_create_crawler(self) -> "Glue":
        '''(experimental) Grants permission to create a crawler.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-crawling.html#aws-glue-api-crawler-crawling-CreateCrawler

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCreateCrawler", []))

    @jsii.member(jsii_name="toCreateDatabase")
    def to_create_database(self) -> "Glue":
        '''(experimental) Grants permission to create a database.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-databases.html#aws-glue-api-catalog-databases-CreateDatabase

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCreateDatabase", []))

    @jsii.member(jsii_name="toCreateDevEndpoint")
    def to_create_dev_endpoint(self) -> "Glue":
        '''(experimental) Grants permission to create a development endpoint.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-dev-endpoint.html#aws-glue-api-dev-endpoint-CreateDevEndpoint

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCreateDevEndpoint", []))

    @jsii.member(jsii_name="toCreateJob")
    def to_create_job(self) -> "Glue":
        '''(experimental) Grants permission to create a job.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-job.html#aws-glue-api-jobs-job-CreateJob

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCreateJob", []))

    @jsii.member(jsii_name="toCreateMLTransform")
    def to_create_ml_transform(self) -> "Glue":
        '''(experimental) Grants permission to create an ML Transform.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-machine-learning-api.html#aws-glue-api-machine-learning-api-CreateMLTransform

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCreateMLTransform", []))

    @jsii.member(jsii_name="toCreatePartition")
    def to_create_partition(self) -> "Glue":
        '''(experimental) Grants permission to create a partition.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-partitions.html#aws-glue-api-catalog-partitions-CreatePartition

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCreatePartition", []))

    @jsii.member(jsii_name="toCreateRegistry")
    def to_create_registry(self) -> "Glue":
        '''(experimental) Grants permission to create a new schema registry.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-CreateRegistry

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCreateRegistry", []))

    @jsii.member(jsii_name="toCreateSchema")
    def to_create_schema(self) -> "Glue":
        '''(experimental) Grants permission to create a new schema container.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-CreateSchema

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCreateSchema", []))

    @jsii.member(jsii_name="toCreateScript")
    def to_create_script(self) -> "Glue":
        '''(experimental) Grants permission to create a script.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-etl-script-generation.html#aws-glue-api-etl-script-generation-CreateScript

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCreateScript", []))

    @jsii.member(jsii_name="toCreateSecurityConfiguration")
    def to_create_security_configuration(self) -> "Glue":
        '''(experimental) Grants permission to create a security configuration.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-security.html#aws-glue-api-jobs-security-CreateSecurityConfiguration

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCreateSecurityConfiguration", []))

    @jsii.member(jsii_name="toCreateTable")
    def to_create_table(self) -> "Glue":
        '''(experimental) Grants permission to create a table.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-CreateTable

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCreateTable", []))

    @jsii.member(jsii_name="toCreateTrigger")
    def to_create_trigger(self) -> "Glue":
        '''(experimental) Grants permission to create a trigger.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-trigger.html#aws-glue-api-jobs-trigger-CreateTrigger

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCreateTrigger", []))

    @jsii.member(jsii_name="toCreateUserDefinedFunction")
    def to_create_user_defined_function(self) -> "Glue":
        '''(experimental) Grants permission to create a function definition.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-functions.html#aws-glue-api-catalog-functions-CreateUserDefinedFunction

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCreateUserDefinedFunction", []))

    @jsii.member(jsii_name="toCreateWorkflow")
    def to_create_workflow(self) -> "Glue":
        '''(experimental) Grants permission to create a workflow.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-workflow.html#aws-glue-api-workflow-CreateWorkflow

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCreateWorkflow", []))

    @jsii.member(jsii_name="toDeleteClassifier")
    def to_delete_classifier(self) -> "Glue":
        '''(experimental) Grants permission to delete a classifier.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-classifiers.html#aws-glue-api-crawler-classifiers-DeleteClassifier

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteClassifier", []))

    @jsii.member(jsii_name="toDeleteConnection")
    def to_delete_connection(self) -> "Glue":
        '''(experimental) Grants permission to delete a connection.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-connections.html#aws-glue-api-catalog-connections-DeleteConnection

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteConnection", []))

    @jsii.member(jsii_name="toDeleteCrawler")
    def to_delete_crawler(self) -> "Glue":
        '''(experimental) Grants permission to delete a crawler.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-crawling.html#aws-glue-api-crawler-crawling-DeleteCrawler

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteCrawler", []))

    @jsii.member(jsii_name="toDeleteDatabase")
    def to_delete_database(self) -> "Glue":
        '''(experimental) Grants permission to delete a database.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-databases.html#aws-glue-api-catalog-databases-DeleteDatabase

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteDatabase", []))

    @jsii.member(jsii_name="toDeleteDevEndpoint")
    def to_delete_dev_endpoint(self) -> "Glue":
        '''(experimental) Grants permission to delete a development endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-dev-endpoint.html#aws-glue-api-dev-endpoint-DeleteDevEndpoint

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteDevEndpoint", []))

    @jsii.member(jsii_name="toDeleteJob")
    def to_delete_job(self) -> "Glue":
        '''(experimental) Grants permission to delete a job.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-job.html#aws-glue-api-jobs-job-DeleteJob

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteJob", []))

    @jsii.member(jsii_name="toDeleteMLTransform")
    def to_delete_ml_transform(self) -> "Glue":
        '''(experimental) Grants permission to delete an ML Transform.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-machine-learning-api.html#aws-glue-api-machine-learning-api-DeleteMLTransform

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteMLTransform", []))

    @jsii.member(jsii_name="toDeletePartition")
    def to_delete_partition(self) -> "Glue":
        '''(experimental) Grants permission to delete a partition.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-partitions.html#aws-glue-api-catalog-partitions-DeletePartition

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeletePartition", []))

    @jsii.member(jsii_name="toDeleteRegistry")
    def to_delete_registry(self) -> "Glue":
        '''(experimental) Grants permission to delete a schema registry.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-DeleteRegistry

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteRegistry", []))

    @jsii.member(jsii_name="toDeleteResourcePolicy")
    def to_delete_resource_policy(self) -> "Glue":
        '''(experimental) Grants permission to delete a resource policy.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-security.html#aws-glue-api-jobs-security-DeleteResourcePolicy

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteResourcePolicy", []))

    @jsii.member(jsii_name="toDeleteSchema")
    def to_delete_schema(self) -> "Glue":
        '''(experimental) Grants permission to delete a schema container.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-DeleteSchema

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteSchema", []))

    @jsii.member(jsii_name="toDeleteSchemaVersions")
    def to_delete_schema_versions(self) -> "Glue":
        '''(experimental) Grants permission to delete a range of schema versions.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-DeleteSchemaVersions

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteSchemaVersions", []))

    @jsii.member(jsii_name="toDeleteSecurityConfiguration")
    def to_delete_security_configuration(self) -> "Glue":
        '''(experimental) Grants permission to delete a security configuration.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-security.html#aws-glue-api-jobs-security-DeleteSecurityConfiguration

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteSecurityConfiguration", []))

    @jsii.member(jsii_name="toDeleteTable")
    def to_delete_table(self) -> "Glue":
        '''(experimental) Grants permission to delete a table.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-DeleteTable

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteTable", []))

    @jsii.member(jsii_name="toDeleteTableVersion")
    def to_delete_table_version(self) -> "Glue":
        '''(experimental) Grants permission to delete a version of a table.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-DeleteTableVersion

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteTableVersion", []))

    @jsii.member(jsii_name="toDeleteTrigger")
    def to_delete_trigger(self) -> "Glue":
        '''(experimental) Grants permission to delete a trigger.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-trigger.html#aws-glue-api-jobs-trigger-DeleteTrigger

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteTrigger", []))

    @jsii.member(jsii_name="toDeleteUserDefinedFunction")
    def to_delete_user_defined_function(self) -> "Glue":
        '''(experimental) Grants permission to delete a function definition.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-functions.html#aws-glue-api-catalog-functions-DeleteUserDefinedFunction

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteUserDefinedFunction", []))

    @jsii.member(jsii_name="toDeleteWorkflow")
    def to_delete_workflow(self) -> "Glue":
        '''(experimental) Grants permission to delete a workflow.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-workflow.html#aws-glue-api-workflow-DeleteWorkflow

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteWorkflow", []))

    @jsii.member(jsii_name="toGetCatalogImportStatus")
    def to_get_catalog_import_status(self) -> "Glue":
        '''(experimental) Grants permission to retrieve the catalog import status.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-migration.html#aws-glue-api-catalog-migration-GetCatalogImportStatus

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetCatalogImportStatus", []))

    @jsii.member(jsii_name="toGetClassifier")
    def to_get_classifier(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a classifier.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-classifiers.html#aws-glue-api-crawler-classifiers-GetClassifier

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetClassifier", []))

    @jsii.member(jsii_name="toGetClassifiers")
    def to_get_classifiers(self) -> "Glue":
        '''(experimental) Grants permission to list all classifiers.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-classifiers.html#aws-glue-api-crawler-classifiers-GetClassifiers

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetClassifiers", []))

    @jsii.member(jsii_name="toGetConnection")
    def to_get_connection(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a connection.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-connections.html#aws-glue-api-catalog-connections-GetConnection

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetConnection", []))

    @jsii.member(jsii_name="toGetConnections")
    def to_get_connections(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a list of connections.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-connections.html#aws-glue-api-catalog-connections-GetConnections

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetConnections", []))

    @jsii.member(jsii_name="toGetCrawler")
    def to_get_crawler(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a crawler.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-crawling.html#aws-glue-api-crawler-crawling-GetCrawler

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetCrawler", []))

    @jsii.member(jsii_name="toGetCrawlerMetrics")
    def to_get_crawler_metrics(self) -> "Glue":
        '''(experimental) Grants permission to retrieve metrics about crawlers.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-crawling.html#aws-glue-api-crawler-crawling-GetCrawlerMetrics

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetCrawlerMetrics", []))

    @jsii.member(jsii_name="toGetCrawlers")
    def to_get_crawlers(self) -> "Glue":
        '''(experimental) Grants permission to retrieve all crawlers.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-crawling.html#aws-glue-api-crawler-crawling-GetCrawlers

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetCrawlers", []))

    @jsii.member(jsii_name="toGetDatabase")
    def to_get_database(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a database.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-databases.html#aws-glue-api-catalog-databases-GetDatabase

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetDatabase", []))

    @jsii.member(jsii_name="toGetDatabases")
    def to_get_databases(self) -> "Glue":
        '''(experimental) Grants permission to retrieve all databases.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-databases.html#aws-glue-api-catalog-databases-GetDatabases

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetDatabases", []))

    @jsii.member(jsii_name="toGetDataCatalogEncryptionSettings")
    def to_get_data_catalog_encryption_settings(self) -> "Glue":
        '''(experimental) Grants permission to retrieve catalog encryption settings.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-security.html#aws-glue-api-jobs-security-GetDataCatalogEncryptionSettings

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetDataCatalogEncryptionSettings", []))

    @jsii.member(jsii_name="toGetDataflowGraph")
    def to_get_dataflow_graph(self) -> "Glue":
        '''(experimental) Grants permission to transform a script into a directed acyclic graph (DAG).

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-etl-script-generation.html#aws-glue-api-etl-script-generation-GetDataflowGraph

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetDataflowGraph", []))

    @jsii.member(jsii_name="toGetDevEndpoint")
    def to_get_dev_endpoint(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a development endpoint.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-dev-endpoint.html#aws-glue-api-dev-endpoint-GetDevEndpoint

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetDevEndpoint", []))

    @jsii.member(jsii_name="toGetDevEndpoints")
    def to_get_dev_endpoints(self) -> "Glue":
        '''(experimental) Grants permission to retrieve all development endpoints.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-dev-endpoint.html#aws-glue-api-dev-endpoint-GetDevEndpoints

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetDevEndpoints", []))

    @jsii.member(jsii_name="toGetJob")
    def to_get_job(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a job.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-job.html#aws-glue-api-jobs-job-GetJob

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetJob", []))

    @jsii.member(jsii_name="toGetJobBookmark")
    def to_get_job_bookmark(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a job bookmark.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-runs.html#aws-glue-api-jobs-job-GetJobBookmark

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetJobBookmark", []))

    @jsii.member(jsii_name="toGetJobRun")
    def to_get_job_run(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a job run.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-runs.html#aws-glue-api-jobs-runs-GetJobRun

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetJobRun", []))

    @jsii.member(jsii_name="toGetJobRuns")
    def to_get_job_runs(self) -> "Glue":
        '''(experimental) Grants permission to retrieve all job runs of a job.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-runs.html#aws-glue-api-jobs-runs-GetJobRuns

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetJobRuns", []))

    @jsii.member(jsii_name="toGetJobs")
    def to_get_jobs(self) -> "Glue":
        '''(experimental) Grants permission to retrieve all current jobs.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-job.html#aws-glue-api-jobs-job-GetJobs

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetJobs", []))

    @jsii.member(jsii_name="toGetMapping")
    def to_get_mapping(self) -> "Glue":
        '''(experimental) Grants permission to create a mapping.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-etl-script-generation.html#aws-glue-api-etl-script-generation-GetMapping

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetMapping", []))

    @jsii.member(jsii_name="toGetMLTaskRun")
    def to_get_ml_task_run(self) -> "Glue":
        '''(experimental) Grants permission to retrieve an ML Task Run.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-machine-learning-api.html#aws-glue-api-machine-learning-api-GetMLTaskRun

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetMLTaskRun", []))

    @jsii.member(jsii_name="toGetMLTaskRuns")
    def to_get_ml_task_runs(self) -> "Glue":
        '''(experimental) Grants permission to retrieve all ML Task Runs.

        Access Level: List

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-machine-learning-api.html#aws-glue-api-machine-learning-api-GetMLTaskRuns

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetMLTaskRuns", []))

    @jsii.member(jsii_name="toGetMLTransform")
    def to_get_ml_transform(self) -> "Glue":
        '''(experimental) Grants permission to retrieve an ML Transform.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-machine-learning-api.html#aws-glue-api-machine-learning-api-GetMLTransform

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetMLTransform", []))

    @jsii.member(jsii_name="toGetMLTransforms")
    def to_get_ml_transforms(self) -> "Glue":
        '''(experimental) Grants permission to retrieve all ML Transforms.

        Access Level: List

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-machine-learning-api.html#aws-glue-api-machine-learning-api-GetMLTransforms

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetMLTransforms", []))

    @jsii.member(jsii_name="toGetPartition")
    def to_get_partition(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a partition.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-partitions.html#aws-glue-api-catalog-partitions-GetPartition

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetPartition", []))

    @jsii.member(jsii_name="toGetPartitions")
    def to_get_partitions(self) -> "Glue":
        '''(experimental) Grants permission to retrieve the partitions of a table.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-partitions.html#aws-glue-api-catalog-partitions-GetPartitions

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetPartitions", []))

    @jsii.member(jsii_name="toGetPlan")
    def to_get_plan(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a mapping for a script.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-etl-script-generation.html#aws-glue-api-etl-script-generation-GetPlan

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetPlan", []))

    @jsii.member(jsii_name="toGetRegistry")
    def to_get_registry(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a schema registry.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-GetRegistry

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetRegistry", []))

    @jsii.member(jsii_name="toGetResourcePolicies")
    def to_get_resource_policies(self) -> "Glue":
        '''(experimental) Grants permission to retrieve resource policies.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-security.html#aws-glue-api-jobs-security-GetResourcePolicies

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetResourcePolicies", []))

    @jsii.member(jsii_name="toGetResourcePolicy")
    def to_get_resource_policy(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a resource policy.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-security.html#aws-glue-api-jobs-security-GetResourcePolicy

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetResourcePolicy", []))

    @jsii.member(jsii_name="toGetSchema")
    def to_get_schema(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a schema container.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-GetSchema

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetSchema", []))

    @jsii.member(jsii_name="toGetSchemaByDefinition")
    def to_get_schema_by_definition(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a schema version based on schema definition.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-GetSchemaByDefinition

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetSchemaByDefinition", []))

    @jsii.member(jsii_name="toGetSchemaVersion")
    def to_get_schema_version(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a schema version.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-GetSchemaVersion

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetSchemaVersion", []))

    @jsii.member(jsii_name="toGetSchemaVersionsDiff")
    def to_get_schema_versions_diff(self) -> "Glue":
        '''(experimental) Grants permission to compare two schema versions in schema registry.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-GetSchemaVersionsDiff

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetSchemaVersionsDiff", []))

    @jsii.member(jsii_name="toGetSecurityConfiguration")
    def to_get_security_configuration(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a security configuration.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-security.html#aws-glue-api-jobs-security-GetSecurityConfiguration

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetSecurityConfiguration", []))

    @jsii.member(jsii_name="toGetSecurityConfigurations")
    def to_get_security_configurations(self) -> "Glue":
        '''(experimental) Grants permission to retrieve one or more security configurations.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-security.html#aws-glue-api-jobs-security-GetSecurityConfigurations

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetSecurityConfigurations", []))

    @jsii.member(jsii_name="toGetTable")
    def to_get_table(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a table.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-GetTable

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetTable", []))

    @jsii.member(jsii_name="toGetTables")
    def to_get_tables(self) -> "Glue":
        '''(experimental) Grants permission to retrieve the tables in a database.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-GetTables

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetTables", []))

    @jsii.member(jsii_name="toGetTableVersion")
    def to_get_table_version(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a version of a table.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-GetTableVersion

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetTableVersion", []))

    @jsii.member(jsii_name="toGetTableVersions")
    def to_get_table_versions(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a list of versions of a table.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-GetTableVersions

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetTableVersions", []))

    @jsii.member(jsii_name="toGetTags")
    def to_get_tags(self) -> "Glue":
        '''(experimental) Grants permission to retrieve all tags associated with a resource.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-tags.html#aws-glue-api-tags-UntagResource

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetTags", []))

    @jsii.member(jsii_name="toGetTrigger")
    def to_get_trigger(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a trigger.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-trigger.html#aws-glue-api-jobs-trigger-GetTrigger

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetTrigger", []))

    @jsii.member(jsii_name="toGetTriggers")
    def to_get_triggers(self) -> "Glue":
        '''(experimental) Grants permission to retrieve the triggers associated with a job.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-trigger.html#aws-glue-api-jobs-trigger-GetTriggers

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetTriggers", []))

    @jsii.member(jsii_name="toGetUserDefinedFunction")
    def to_get_user_defined_function(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a function definition.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-functions.html#aws-glue-api-catalog-functions-GetUserDefinedFunction

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetUserDefinedFunction", []))

    @jsii.member(jsii_name="toGetUserDefinedFunctions")
    def to_get_user_defined_functions(self) -> "Glue":
        '''(experimental) Grants permission to retrieve multiple function definitions.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-functions.html#aws-glue-api-catalog-functions-GetUserDefinedFunctions

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetUserDefinedFunctions", []))

    @jsii.member(jsii_name="toGetWorkflow")
    def to_get_workflow(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a workflow.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-workflow.html#aws-glue-api-workflow-GetWorkflow

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetWorkflow", []))

    @jsii.member(jsii_name="toGetWorkflowRun")
    def to_get_workflow_run(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a workflow run.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-workflow.html#aws-glue-api-workflow-GetWorkflowRun

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetWorkflowRun", []))

    @jsii.member(jsii_name="toGetWorkflowRunProperties")
    def to_get_workflow_run_properties(self) -> "Glue":
        '''(experimental) Grants permission to retrieve workflow run properties.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-workflow.html#aws-glue-api-workflow-GetWorkflowRunProperties

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetWorkflowRunProperties", []))

    @jsii.member(jsii_name="toGetWorkflowRuns")
    def to_get_workflow_runs(self) -> "Glue":
        '''(experimental) Grants permission to retrieve all runs of a workflow.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-workflow.html#aws-glue-api-workflow-GetWorkflowRuns

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetWorkflowRuns", []))

    @jsii.member(jsii_name="toImportCatalogToGlue")
    def to_import_catalog_to_glue(self) -> "Glue":
        '''(experimental) Grants permission to import an Athena data catalog into AWS Glue.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-migration.html#aws-glue-api-catalog-migration-ImportCatalogToGlue

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toImportCatalogToGlue", []))

    @jsii.member(jsii_name="toListCrawlers")
    def to_list_crawlers(self) -> "Glue":
        '''(experimental) Grants permission to retrieve all crawlers.

        Access Level: List

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-crawling.html#aws-glue-api-crawler-crawling-ListCrawlers

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toListCrawlers", []))

    @jsii.member(jsii_name="toListDevEndpoints")
    def to_list_dev_endpoints(self) -> "Glue":
        '''(experimental) Grants permission to retrieve all development endpoints.

        Access Level: List

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-dev-endpoint.html#aws-glue-api-dev-endpoint-ListDevEndpoints

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toListDevEndpoints", []))

    @jsii.member(jsii_name="toListJobs")
    def to_list_jobs(self) -> "Glue":
        '''(experimental) Grants permission to retrieve all current jobs.

        Access Level: List

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-job.html#aws-glue-api-jobs-job-ListJobs

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toListJobs", []))

    @jsii.member(jsii_name="toListMLTransforms")
    def to_list_ml_transforms(self) -> "Glue":
        '''(experimental) Grants permission to retrieve all ML Transforms.

        Access Level: List

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-machine-learning-api.html#aws-glue-api-machine-learning-api-ListMLTransforms

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toListMLTransforms", []))

    @jsii.member(jsii_name="toListRegistries")
    def to_list_registries(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a list of schema registries.

        Access Level: List

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-ListRegistries

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toListRegistries", []))

    @jsii.member(jsii_name="toListSchemas")
    def to_list_schemas(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a list of schema containers.

        Access Level: List

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-ListSchemas

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toListSchemas", []))

    @jsii.member(jsii_name="toListSchemaVersions")
    def to_list_schema_versions(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a list of schema versions.

        Access Level: List

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-ListSchemaVersions

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toListSchemaVersions", []))

    @jsii.member(jsii_name="toListTriggers")
    def to_list_triggers(self) -> "Glue":
        '''(experimental) Grants permission to retrieve all triggers.

        Access Level: List

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-trigger.html#aws-glue-api-jobs-trigger-ListTriggers

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toListTriggers", []))

    @jsii.member(jsii_name="toListWorkflows")
    def to_list_workflows(self) -> "Glue":
        '''(experimental) Grants permission to retrieve all workflows.

        Access Level: List

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-workflow.html#aws-glue-api-workflow-ListWorkflows

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toListWorkflows", []))

    @jsii.member(jsii_name="toPutDataCatalogEncryptionSettings")
    def to_put_data_catalog_encryption_settings(self) -> "Glue":
        '''(experimental) Grants permission to update catalog encryption settings.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-security.html#aws-glue-api-jobs-security-PutDataCatalogEncryptionSettings

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toPutDataCatalogEncryptionSettings", []))

    @jsii.member(jsii_name="toPutResourcePolicy")
    def to_put_resource_policy(self) -> "Glue":
        '''(experimental) Grants permission to update a resource policy.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-security.html#aws-glue-api-jobs-security-PutResourcePolicy

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toPutResourcePolicy", []))

    @jsii.member(jsii_name="toPutSchemaVersionMetadata")
    def to_put_schema_version_metadata(self) -> "Glue":
        '''(experimental) Grants permission to add metadata to schema version.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-PutSchemaVersionMetadata

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toPutSchemaVersionMetadata", []))

    @jsii.member(jsii_name="toPutWorkflowRunProperties")
    def to_put_workflow_run_properties(self) -> "Glue":
        '''(experimental) Grants permission to update workflow run properties.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-workflow.html#aws-glue-api-workflow-PutWorkflowRunProperties

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toPutWorkflowRunProperties", []))

    @jsii.member(jsii_name="toQuerySchemaVersionMetadata")
    def to_query_schema_version_metadata(self) -> "Glue":
        '''(experimental) Grants permission to fetch metadata for a schema version.

        Access Level: List

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-QuerySchemaVersionMetadata

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toQuerySchemaVersionMetadata", []))

    @jsii.member(jsii_name="toRegisterSchemaVersion")
    def to_register_schema_version(self) -> "Glue":
        '''(experimental) Grants permission to create a new schema version.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-RegisterSchemaVersion

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toRegisterSchemaVersion", []))

    @jsii.member(jsii_name="toRemoveSchemaVersionMetadata")
    def to_remove_schema_version_metadata(self) -> "Glue":
        '''(experimental) Grants permission to remove metadata from schema version.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-RemoveSchemaVersionMetadata

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toRemoveSchemaVersionMetadata", []))

    @jsii.member(jsii_name="toResetJobBookmark")
    def to_reset_job_bookmark(self) -> "Glue":
        '''(experimental) Grants permission to reset a job bookmark.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-runs.html#aws-glue-api-jobs-runs-ResetJobBookmark

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toResetJobBookmark", []))

    @jsii.member(jsii_name="toSearchTables")
    def to_search_tables(self) -> "Glue":
        '''(experimental) Grants permission to retrieve the tables in the catalog.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-SearchTables

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toSearchTables", []))

    @jsii.member(jsii_name="toStartCrawler")
    def to_start_crawler(self) -> "Glue":
        '''(experimental) Grants permission to start a crawler.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-crawling.html#aws-glue-api-crawler-crawling-StartCrawler

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toStartCrawler", []))

    @jsii.member(jsii_name="toStartCrawlerSchedule")
    def to_start_crawler_schedule(self) -> "Glue":
        '''(experimental) Grants permission to change the schedule state of a crawler to SCHEDULED.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-scheduler.html#aws-glue-api-crawler-scheduler-StartCrawlerSchedule

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toStartCrawlerSchedule", []))

    @jsii.member(jsii_name="toStartExportLabelsTaskRun")
    def to_start_export_labels_task_run(self) -> "Glue":
        '''(experimental) Grants permission to start an Export Labels ML Task Run.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-machine-learning-api.html#aws-glue-api-machine-learning-api-StartExportLabelsTaskRun

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toStartExportLabelsTaskRun", []))

    @jsii.member(jsii_name="toStartImportLabelsTaskRun")
    def to_start_import_labels_task_run(self) -> "Glue":
        '''(experimental) Grants permission to start an Import Labels ML Task Run.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-machine-learning-api.html#aws-glue-api-machine-learning-api-StartImportLabelsTaskRun

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toStartImportLabelsTaskRun", []))

    @jsii.member(jsii_name="toStartJobRun")
    def to_start_job_run(self) -> "Glue":
        '''(experimental) Grants permission to start running a job.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-runs.html#aws-glue-api-jobs-runs-StartJobRun

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toStartJobRun", []))

    @jsii.member(jsii_name="toStartMLEvaluationTaskRun")
    def to_start_ml_evaluation_task_run(self) -> "Glue":
        '''(experimental) Grants permission to start an Evaluation ML Task Run.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-machine-learning-api.html#aws-glue-api-machine-learning-api-StartMLEvaluationTaskRun

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toStartMLEvaluationTaskRun", []))

    @jsii.member(jsii_name="toStartMLLabelingSetGenerationTaskRun")
    def to_start_ml_labeling_set_generation_task_run(self) -> "Glue":
        '''(experimental) Grants permission to start a Labeling Set Generation ML Task Run.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-machine-learning-api.html#aws-glue-api-machine-learning-api-StartMLLabelingSetGenerationTaskRun

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toStartMLLabelingSetGenerationTaskRun", []))

    @jsii.member(jsii_name="toStartTrigger")
    def to_start_trigger(self) -> "Glue":
        '''(experimental) Grants permission to start a trigger.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-trigger.html#aws-glue-api-jobs-trigger-StartTrigger

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toStartTrigger", []))

    @jsii.member(jsii_name="toStartWorkflowRun")
    def to_start_workflow_run(self) -> "Glue":
        '''(experimental) Grants permission to start running a workflow.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-workflow.html#aws-glue-api-workflow-StartWorkflowRun

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toStartWorkflowRun", []))

    @jsii.member(jsii_name="toStopCrawler")
    def to_stop_crawler(self) -> "Glue":
        '''(experimental) Grants permission to stop a running crawler.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-crawling.html#aws-glue-api-crawler-crawling-StopCrawler

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toStopCrawler", []))

    @jsii.member(jsii_name="toStopCrawlerSchedule")
    def to_stop_crawler_schedule(self) -> "Glue":
        '''(experimental) Grants permission to set the schedule state of a crawler to NOT_SCHEDULED.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-scheduler.html#aws-glue-api-crawler-scheduler-StopCrawlerSchedule

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toStopCrawlerSchedule", []))

    @jsii.member(jsii_name="toStopTrigger")
    def to_stop_trigger(self) -> "Glue":
        '''(experimental) Grants permission to stop a trigger.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-trigger.html#aws-glue-api-jobs-trigger-StopTrigger

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toStopTrigger", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Glue":
        '''(experimental) Grants permission to add tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-tags.html#aws-glue-api-tags-TagResource

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Glue":
        '''(experimental) Grants permission to remove tags associated with a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-tags.html#aws-glue-api-tags-UntagResource

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateClassifier")
    def to_update_classifier(self) -> "Glue":
        '''(experimental) Grants permission to update a classifier.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-classifiers.html#aws-glue-api-crawler-classifiers-UpdateClassifier

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUpdateClassifier", []))

    @jsii.member(jsii_name="toUpdateConnection")
    def to_update_connection(self) -> "Glue":
        '''(experimental) Grants permission to update a connection.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-connections.html#aws-glue-api-catalog-connections-UpdateConnection

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUpdateConnection", []))

    @jsii.member(jsii_name="toUpdateCrawler")
    def to_update_crawler(self) -> "Glue":
        '''(experimental) Grants permission to update a crawler.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-crawling.html#aws-glue-api-crawler-crawling-UpdateCrawler

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUpdateCrawler", []))

    @jsii.member(jsii_name="toUpdateCrawlerSchedule")
    def to_update_crawler_schedule(self) -> "Glue":
        '''(experimental) Grants permission to update the schedule of a crawler.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-scheduler.html#aws-glue-api-crawler-scheduler-UpdateCrawlerSchedule

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUpdateCrawlerSchedule", []))

    @jsii.member(jsii_name="toUpdateDatabase")
    def to_update_database(self) -> "Glue":
        '''(experimental) Grants permission to update a database.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-databases.html#aws-glue-api-catalog-databases-UpdateDatabase

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUpdateDatabase", []))

    @jsii.member(jsii_name="toUpdateDevEndpoint")
    def to_update_dev_endpoint(self) -> "Glue":
        '''(experimental) Grants permission to update a development endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-dev-endpoint.html#aws-glue-api-dev-endpoint-UpdateDevEndpoint

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUpdateDevEndpoint", []))

    @jsii.member(jsii_name="toUpdateJob")
    def to_update_job(self) -> "Glue":
        '''(experimental) Grants permission to update a job.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-job.html#aws-glue-api-jobs-job-UpdateJob

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUpdateJob", []))

    @jsii.member(jsii_name="toUpdateMLTransform")
    def to_update_ml_transform(self) -> "Glue":
        '''(experimental) Grants permission to update an ML Transform.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-machine-learning-api.html#aws-glue-api-machine-learning-api-UpdateMLTransform

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUpdateMLTransform", []))

    @jsii.member(jsii_name="toUpdatePartition")
    def to_update_partition(self) -> "Glue":
        '''(experimental) Grants permission to update a partition.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-partitions.html#aws-glue-api-catalog-partitions-UpdatePartition

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUpdatePartition", []))

    @jsii.member(jsii_name="toUpdateRegistry")
    def to_update_registry(self) -> "Glue":
        '''(experimental) Grants permission to update a schema registry.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-UpdateRegistry

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUpdateRegistry", []))

    @jsii.member(jsii_name="toUpdateSchema")
    def to_update_schema(self) -> "Glue":
        '''(experimental) Grants permission to update a schema container.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-UpdateSchema

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUpdateSchema", []))

    @jsii.member(jsii_name="toUpdateTable")
    def to_update_table(self) -> "Glue":
        '''(experimental) Grants permission to update a table.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-UpdateTable

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUpdateTable", []))

    @jsii.member(jsii_name="toUpdateTrigger")
    def to_update_trigger(self) -> "Glue":
        '''(experimental) Grants permission to update a trigger.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-trigger.html#aws-glue-api-jobs-trigger-UpdateTrigger

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUpdateTrigger", []))

    @jsii.member(jsii_name="toUpdateUserDefinedFunction")
    def to_update_user_defined_function(self) -> "Glue":
        '''(experimental) Grants permission to update a function definition.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-functions.html#aws-glue-api-catalog-functions-UpdateUserDefinedFunction

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUpdateUserDefinedFunction", []))

    @jsii.member(jsii_name="toUpdateWorkflow")
    def to_update_workflow(self) -> "Glue":
        '''(experimental) Grants permission to update a workflow.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-workflow.html#aws-glue-api-workflow-UpdateWorkflow

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUpdateWorkflow", []))

    @jsii.member(jsii_name="toUseMLTransforms")
    def to_use_ml_transforms(self) -> "Glue":
        '''(experimental) Grants permission to use an ML Transform from within a Glue ETL Script.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-machine-learning-api.html

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUseMLTransforms", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Grafana(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Grafana"):
    '''(experimental) Statement provider for service `grafana <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmanagedserviceforgrafana.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `grafana <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmanagedserviceforgrafana.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Grafana, self, [sid])

    @jsii.member(jsii_name="onWorkspace")
    def on_workspace(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Grafana":
        '''(experimental) Adds a resource of type workspace to the statement.

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Grafana", jsii.invoke(self, "onWorkspace", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateWorkspace")
    def to_create_workspace(self) -> "Grafana":
        '''(experimental) Grants permission to create a workspace.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Grafana", jsii.invoke(self, "toCreateWorkspace", []))

    @jsii.member(jsii_name="toDeleteWorkspace")
    def to_delete_workspace(self) -> "Grafana":
        '''(experimental) Grants permission to delete a workspace.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Grafana", jsii.invoke(self, "toDeleteWorkspace", []))

    @jsii.member(jsii_name="toDescribeWorkspace")
    def to_describe_workspace(self) -> "Grafana":
        '''(experimental) Grants permission to describe a workspace.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Grafana", jsii.invoke(self, "toDescribeWorkspace", []))

    @jsii.member(jsii_name="toListPermissions")
    def to_list_permissions(self) -> "Grafana":
        '''(experimental) Grants permission to list the permissions on a wokspace.

        Access Level: List

        :stability: experimental
        '''
        return typing.cast("Grafana", jsii.invoke(self, "toListPermissions", []))

    @jsii.member(jsii_name="toListWorkspaces")
    def to_list_workspaces(self) -> "Grafana":
        '''(experimental) Grants permission to list workspaces.

        Access Level: List

        :stability: experimental
        '''
        return typing.cast("Grafana", jsii.invoke(self, "toListWorkspaces", []))

    @jsii.member(jsii_name="toUpdatePermissions")
    def to_update_permissions(self) -> "Grafana":
        '''(experimental) Grants permission to modify the permissions on a workspace.

        Access Level: Permissions management

        :stability: experimental
        '''
        return typing.cast("Grafana", jsii.invoke(self, "toUpdatePermissions", []))

    @jsii.member(jsii_name="toUpdateWorkspace")
    def to_update_workspace(self) -> "Grafana":
        '''(experimental) Grants permission to modify a workspace.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Grafana", jsii.invoke(self, "toUpdateWorkspace", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Greengrass(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Greengrass",
):
    '''(experimental) Statement provider for service `greengrass <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotgreengrass.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `greengrass <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotgreengrass.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Greengrass, self, [sid])

    @jsii.member(jsii_name="onBulkDeployment")
    def on_bulk_deployment(
        self,
        bulk_deployment_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type bulkDeployment to the statement.

        https://docs.aws.amazon.com/greengrass/latest/developerguide/bulk-deploy-cli.html

        :param bulk_deployment_id: - Identifier for the bulkDeploymentId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "onBulkDeployment", [bulk_deployment_id, account, region, partition]))

    @jsii.member(jsii_name="onCertificateAuthority")
    def on_certificate_authority(
        self,
        group_id: builtins.str,
        certificate_authority_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type certificateAuthority to the statement.

        https://docs.aws.amazon.com/greengrass/latest/developerguide/gg-sec.html

        :param group_id: - Identifier for the groupId.
        :param certificate_authority_id: - Identifier for the certificateAuthorityId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "onCertificateAuthority", [group_id, certificate_authority_id, account, region, partition]))

    @jsii.member(jsii_name="onConnectivityInfo")
    def on_connectivity_info(
        self,
        thing_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type connectivityInfo to the statement.

        https://docs.aws.amazon.com/greengrass/latest/apireference/definitions-connectivityinfo.html

        :param thing_name: - Identifier for the thingName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "onConnectivityInfo", [thing_name, account, region, partition]))

    @jsii.member(jsii_name="onConnectorDefinition")
    def on_connector_definition(
        self,
        connector_definition_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type connectorDefinition to the statement.

        https://docs.aws.amazon.com/greengrass/latest/apireference/definitions-connector.html

        :param connector_definition_id: - Identifier for the connectorDefinitionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "onConnectorDefinition", [connector_definition_id, account, region, partition]))

    @jsii.member(jsii_name="onConnectorDefinitionVersion")
    def on_connector_definition_version(
        self,
        connector_definition_id: builtins.str,
        version_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type connectorDefinitionVersion to the statement.

        https://docs.aws.amazon.com/greengrass/latest/apireference/definitions-connectordefinitionversion.html

        :param connector_definition_id: - Identifier for the connectorDefinitionId.
        :param version_id: - Identifier for the versionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "onConnectorDefinitionVersion", [connector_definition_id, version_id, account, region, partition]))

    @jsii.member(jsii_name="onCoreDefinition")
    def on_core_definition(
        self,
        core_definition_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type coreDefinition to the statement.

        https://docs.aws.amazon.com/greengrass/latest/apireference/definitions-core.html

        :param core_definition_id: - Identifier for the coreDefinitionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "onCoreDefinition", [core_definition_id, account, region, partition]))

    @jsii.member(jsii_name="onCoreDefinitionVersion")
    def on_core_definition_version(
        self,
        core_definition_id: builtins.str,
        version_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type coreDefinitionVersion to the statement.

        https://docs.aws.amazon.com/greengrass/latest/apireference/definitions-coredefinitionversion.html

        :param core_definition_id: - Identifier for the coreDefinitionId.
        :param version_id: - Identifier for the versionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "onCoreDefinitionVersion", [core_definition_id, version_id, account, region, partition]))

    @jsii.member(jsii_name="onDeployment")
    def on_deployment(
        self,
        group_id: builtins.str,
        deployment_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type deployment to the statement.

        https://docs.aws.amazon.com/greengrass/latest/apireference/definitions-createdeploymentrequest.html

        :param group_id: - Identifier for the groupId.
        :param deployment_id: - Identifier for the deploymentId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "onDeployment", [group_id, deployment_id, account, region, partition]))

    @jsii.member(jsii_name="onDeviceDefinition")
    def on_device_definition(
        self,
        device_definition_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type deviceDefinition to the statement.

        https://docs.aws.amazon.com/greengrass/latest/apireference/definitions-device.html

        :param device_definition_id: - Identifier for the deviceDefinitionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "onDeviceDefinition", [device_definition_id, account, region, partition]))

    @jsii.member(jsii_name="onDeviceDefinitionVersion")
    def on_device_definition_version(
        self,
        device_definition_id: builtins.str,
        version_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type deviceDefinitionVersion to the statement.

        https://docs.aws.amazon.com/greengrass/latest/apireference/definitions-devicedefinitionversion.html

        :param device_definition_id: - Identifier for the deviceDefinitionId.
        :param version_id: - Identifier for the versionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "onDeviceDefinitionVersion", [device_definition_id, version_id, account, region, partition]))

    @jsii.member(jsii_name="onFunctionDefinition")
    def on_function_definition(
        self,
        function_definition_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type functionDefinition to the statement.

        https://docs.aws.amazon.com/greengrass/latest/apireference/definitions-function.html

        :param function_definition_id: - Identifier for the functionDefinitionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "onFunctionDefinition", [function_definition_id, account, region, partition]))

    @jsii.member(jsii_name="onFunctionDefinitionVersion")
    def on_function_definition_version(
        self,
        function_definition_id: builtins.str,
        version_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type functionDefinitionVersion to the statement.

        https://docs.aws.amazon.com/greengrass/latest/apireference/definitions-functiondefinitionversion.html

        :param function_definition_id: - Identifier for the functionDefinitionId.
        :param version_id: - Identifier for the versionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "onFunctionDefinitionVersion", [function_definition_id, version_id, account, region, partition]))

    @jsii.member(jsii_name="onGroup")
    def on_group(
        self,
        group_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type group to the statement.

        https://docs.aws.amazon.com/greengrass/latest/apireference/definitions-groupinformation.html

        :param group_id: - Identifier for the groupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "onGroup", [group_id, account, region, partition]))

    @jsii.member(jsii_name="onGroupVersion")
    def on_group_version(
        self,
        group_id: builtins.str,
        version_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type groupVersion to the statement.

        https://docs.aws.amazon.com/greengrass/latest/apireference/definitions-groupversion.html

        :param group_id: - Identifier for the groupId.
        :param version_id: - Identifier for the versionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "onGroupVersion", [group_id, version_id, account, region, partition]))

    @jsii.member(jsii_name="onLoggerDefinition")
    def on_logger_definition(
        self,
        logger_definition_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type loggerDefinition to the statement.

        https://docs.aws.amazon.com/greengrass/latest/apireference/definitions-logger.html

        :param logger_definition_id: - Identifier for the loggerDefinitionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "onLoggerDefinition", [logger_definition_id, account, region, partition]))

    @jsii.member(jsii_name="onLoggerDefinitionVersion")
    def on_logger_definition_version(
        self,
        logger_definition_id: builtins.str,
        version_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type loggerDefinitionVersion to the statement.

        https://docs.aws.amazon.com/greengrass/latest/apireference/definitions-loggerdefinitionversion.html

        :param logger_definition_id: - Identifier for the loggerDefinitionId.
        :param version_id: - Identifier for the versionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "onLoggerDefinitionVersion", [logger_definition_id, version_id, account, region, partition]))

    @jsii.member(jsii_name="onResourceDefinition")
    def on_resource_definition(
        self,
        resource_definition_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type resourceDefinition to the statement.

        https://docs.aws.amazon.com/greengrass/latest/apireference/definitions-resource.html

        :param resource_definition_id: - Identifier for the resourceDefinitionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "onResourceDefinition", [resource_definition_id, account, region, partition]))

    @jsii.member(jsii_name="onResourceDefinitionVersion")
    def on_resource_definition_version(
        self,
        resource_definition_id: builtins.str,
        version_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type resourceDefinitionVersion to the statement.

        https://docs.aws.amazon.com/greengrass/latest/apireference/definitions-resourcedefinitionversion.html

        :param resource_definition_id: - Identifier for the resourceDefinitionId.
        :param version_id: - Identifier for the versionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "onResourceDefinitionVersion", [resource_definition_id, version_id, account, region, partition]))

    @jsii.member(jsii_name="onSubscriptionDefinition")
    def on_subscription_definition(
        self,
        subscription_definition_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type subscriptionDefinition to the statement.

        https://docs.aws.amazon.com/greengrass/latest/apireference/definitions-subscription.html

        :param subscription_definition_id: - Identifier for the subscriptionDefinitionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "onSubscriptionDefinition", [subscription_definition_id, account, region, partition]))

    @jsii.member(jsii_name="onSubscriptionDefinitionVersion")
    def on_subscription_definition_version(
        self,
        subscription_definition_id: builtins.str,
        version_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type subscriptionDefinitionVersion to the statement.

        https://docs.aws.amazon.com/greengrass/latest/apireference/definitions-subscriptiondefinitionversion.html

        :param subscription_definition_id: - Identifier for the subscriptionDefinitionId.
        :param version_id: - Identifier for the versionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "onSubscriptionDefinitionVersion", [subscription_definition_id, version_id, account, region, partition]))

    @jsii.member(jsii_name="onThing")
    def on_thing(
        self,
        thing_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type thing to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/thing-registry.html

        :param thing_name: - Identifier for the thingName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "onThing", [thing_name, account, region, partition]))

    @jsii.member(jsii_name="onThingRuntimeConfig")
    def on_thing_runtime_config(
        self,
        thing_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type thingRuntimeConfig to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/thing-registry.html

        :param thing_name: - Identifier for the thingName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "onThingRuntimeConfig", [thing_name, account, region, partition]))

    @jsii.member(jsii_name="toAssociateRoleToGroup")
    def to_associate_role_to_group(self) -> "Greengrass":
        '''(experimental) Grants permission to associate a role with a group.

        The role's permissions must allow Greengrass core Lambda functions and connectors to perform actions in other AWS services

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/latest/apireference/associateroletogroup-put.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toAssociateRoleToGroup", []))

    @jsii.member(jsii_name="toAssociateServiceRoleToAccount")
    def to_associate_service_role_to_account(self) -> "Greengrass":
        '''(experimental) Grants permission to associate a role with your account.

        AWS IoT Greengrass uses this role to access your Lambda functions and AWS IoT resources

        Access Level: Permissions management

        https://docs.aws.amazon.com/greengrass/latest/apireference/associateserviceroletoaccount-put.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toAssociateServiceRoleToAccount", []))

    @jsii.member(jsii_name="toCreateConnectorDefinition")
    def to_create_connector_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to create a connector definition.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/greengrass/latest/apireference/createconnectordefinition-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateConnectorDefinition", []))

    @jsii.member(jsii_name="toCreateConnectorDefinitionVersion")
    def to_create_connector_definition_version(self) -> "Greengrass":
        '''(experimental) Grants permission to create a version of an existing connector definition.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/latest/apireference/createconnectordefinitionversion-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateConnectorDefinitionVersion", []))

    @jsii.member(jsii_name="toCreateCoreDefinition")
    def to_create_core_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to create a core definition.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/greengrass/latest/apireference/createcoredefinition-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateCoreDefinition", []))

    @jsii.member(jsii_name="toCreateCoreDefinitionVersion")
    def to_create_core_definition_version(self) -> "Greengrass":
        '''(experimental) Grants permission to create a version of an existing core definition.

        Greengrass groups must each contain exactly one Greengrass core

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/latest/apireference/createcoredefinitionversion-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateCoreDefinitionVersion", []))

    @jsii.member(jsii_name="toCreateDeployment")
    def to_create_deployment(self) -> "Greengrass":
        '''(experimental) Grants permission to create a deployment.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/latest/apireference/createdeployment-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateDeployment", []))

    @jsii.member(jsii_name="toCreateDeviceDefinition")
    def to_create_device_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to create a device definition.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/greengrass/latest/apireference/createdevicedefinition-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateDeviceDefinition", []))

    @jsii.member(jsii_name="toCreateDeviceDefinitionVersion")
    def to_create_device_definition_version(self) -> "Greengrass":
        '''(experimental) Grants permission to create a version of an existing device definition.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/latest/apireference/createdevicedefinitionversion-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateDeviceDefinitionVersion", []))

    @jsii.member(jsii_name="toCreateFunctionDefinition")
    def to_create_function_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to create a Lambda function definition to be used in a group that contains a list of Lambda functions and their configurations.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/greengrass/latest/apireference/createfunctiondefinition-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateFunctionDefinition", []))

    @jsii.member(jsii_name="toCreateFunctionDefinitionVersion")
    def to_create_function_definition_version(self) -> "Greengrass":
        '''(experimental) Grants permission to create a version of an existing Lambda function definition.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/latest/apireference/createfunctiondefinitionversion-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateFunctionDefinitionVersion", []))

    @jsii.member(jsii_name="toCreateGroup")
    def to_create_group(self) -> "Greengrass":
        '''(experimental) Grants permission to create a group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/greengrass/latest/apireference/creategroup-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateGroup", []))

    @jsii.member(jsii_name="toCreateGroupCertificateAuthority")
    def to_create_group_certificate_authority(self) -> "Greengrass":
        '''(experimental) Grants permission to create a CA for the group, or rotate the existing CA.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/latest/apireference/creategroupcertificateauthority-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateGroupCertificateAuthority", []))

    @jsii.member(jsii_name="toCreateGroupVersion")
    def to_create_group_version(self) -> "Greengrass":
        '''(experimental) Grants permission to create a version of a group that has already been defined.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/latest/apireference/creategroupversion-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateGroupVersion", []))

    @jsii.member(jsii_name="toCreateLoggerDefinition")
    def to_create_logger_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to create a logger definition.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/greengrass/latest/apireference/createloggerdefinition-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateLoggerDefinition", []))

    @jsii.member(jsii_name="toCreateLoggerDefinitionVersion")
    def to_create_logger_definition_version(self) -> "Greengrass":
        '''(experimental) Grants permission to create a version of an existing logger definition.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/latest/apireference/createloggerdefinitionversion-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateLoggerDefinitionVersion", []))

    @jsii.member(jsii_name="toCreateResourceDefinition")
    def to_create_resource_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to create a resource definition that contains a list of resources to be used in a group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/greengrass/latest/apireference/createresourcedefinition-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateResourceDefinition", []))

    @jsii.member(jsii_name="toCreateResourceDefinitionVersion")
    def to_create_resource_definition_version(self) -> "Greengrass":
        '''(experimental) Grants permission to create a version of an existing resource definition.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/latest/apireference/createresourcedefinitionversion-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateResourceDefinitionVersion", []))

    @jsii.member(jsii_name="toCreateSoftwareUpdateJob")
    def to_create_software_update_job(self) -> "Greengrass":
        '''(experimental) Grants permission to create an AWS IoT job that will trigger your Greengrass cores to update the software they are running.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/latest/apireference/createsoftwareupdatejob-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateSoftwareUpdateJob", []))

    @jsii.member(jsii_name="toCreateSubscriptionDefinition")
    def to_create_subscription_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to create a subscription definition.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/greengrass/latest/apireference/createsubscriptiondefinition-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateSubscriptionDefinition", []))

    @jsii.member(jsii_name="toCreateSubscriptionDefinitionVersion")
    def to_create_subscription_definition_version(self) -> "Greengrass":
        '''(experimental) Grants permission to create a version of an existing subscription definition.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/latest/apireference/createsubscriptiondefinitionversion-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateSubscriptionDefinitionVersion", []))

    @jsii.member(jsii_name="toDeleteConnectorDefinition")
    def to_delete_connector_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to delete a connector definition.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/latest/apireference/deleteconnectordefinition-delete.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toDeleteConnectorDefinition", []))

    @jsii.member(jsii_name="toDeleteCoreDefinition")
    def to_delete_core_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to delete a core definition.

        Deleting a definition that is currently in use in a deployment affects future deployments

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/latest/apireference/deletecoredefinition-delete.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toDeleteCoreDefinition", []))

    @jsii.member(jsii_name="toDeleteDeviceDefinition")
    def to_delete_device_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to delete a device definition.

        Deleting a definition that is currently in use in a deployment affects future deployments

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/latest/apireference/deletedevicedefinition-delete.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toDeleteDeviceDefinition", []))

    @jsii.member(jsii_name="toDeleteFunctionDefinition")
    def to_delete_function_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to delete a Lambda function definition.

        Deleting a definition that is currently in use in a deployment affects future deployments

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/latest/apireference/deletefunctiondefinition-delete.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toDeleteFunctionDefinition", []))

    @jsii.member(jsii_name="toDeleteGroup")
    def to_delete_group(self) -> "Greengrass":
        '''(experimental) Grants permission to delete a group that is not currently in use in a deployment.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/latest/apireference/deletegroup-delete.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toDeleteGroup", []))

    @jsii.member(jsii_name="toDeleteLoggerDefinition")
    def to_delete_logger_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to delete a logger definition.

        Deleting a definition that is currently in use in a deployment affects future deployments

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/latest/apireference/deleteloggerdefinition-delete.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toDeleteLoggerDefinition", []))

    @jsii.member(jsii_name="toDeleteResourceDefinition")
    def to_delete_resource_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to delete a resource definition.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/latest/apireference/deleteresourcedefinition-delete.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toDeleteResourceDefinition", []))

    @jsii.member(jsii_name="toDeleteSubscriptionDefinition")
    def to_delete_subscription_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to delete a subscription definition.

        Deleting a definition that is currently in use in a deployment affects future deployments

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/latest/apireference/deletesubscriptiondefinition-delete.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toDeleteSubscriptionDefinition", []))

    @jsii.member(jsii_name="toDisassociateRoleFromGroup")
    def to_disassociate_role_from_group(self) -> "Greengrass":
        '''(experimental) Grants permission to disassociate the role from a group.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/latest/apireference/disassociaterolefromgroup-delete.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toDisassociateRoleFromGroup", []))

    @jsii.member(jsii_name="toDisassociateServiceRoleFromAccount")
    def to_disassociate_service_role_from_account(self) -> "Greengrass":
        '''(experimental) Grants permission to disassociate the service role from an account. Without a service role, deployments will not work.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/latest/apireference/disassociateservicerolefromaccount-delete.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toDisassociateServiceRoleFromAccount", []))

    @jsii.member(jsii_name="toDiscover")
    def to_discover(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve information required to connect to a Greengrass core.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/latest/developerguide/gg-discover-api.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toDiscover", []))

    @jsii.member(jsii_name="toGetAssociatedRole")
    def to_get_associated_role(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve the role associated with a group.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/latest/apireference/getassociatedrole-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetAssociatedRole", []))

    @jsii.member(jsii_name="toGetBulkDeploymentStatus")
    def to_get_bulk_deployment_status(self) -> "Greengrass":
        '''(experimental) Grants permission to return the status of a bulk deployment.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/latest/apireference/getbulkdeploymentstatus-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetBulkDeploymentStatus", []))

    @jsii.member(jsii_name="toGetConnectivityInfo")
    def to_get_connectivity_info(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve the connectivity information for a core.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/latest/apireference/getconnectivityinfo-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetConnectivityInfo", []))

    @jsii.member(jsii_name="toGetConnectorDefinition")
    def to_get_connector_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve information about a connector definition.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/latest/apireference/getconnectordefinition-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetConnectorDefinition", []))

    @jsii.member(jsii_name="toGetConnectorDefinitionVersion")
    def to_get_connector_definition_version(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve information about a connector definition version.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/latest/apireference/getconnectordefinitionversion-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetConnectorDefinitionVersion", []))

    @jsii.member(jsii_name="toGetCoreDefinition")
    def to_get_core_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve information about a core definition.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/latest/apireference/getcoredefinition-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetCoreDefinition", []))

    @jsii.member(jsii_name="toGetCoreDefinitionVersion")
    def to_get_core_definition_version(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve information about a core definition version.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/latest/apireference/getcoredefinitionversion-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetCoreDefinitionVersion", []))

    @jsii.member(jsii_name="toGetDeploymentStatus")
    def to_get_deployment_status(self) -> "Greengrass":
        '''(experimental) Grants permission to return the status of a deployment.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/latest/apireference/getdeploymentstatus-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetDeploymentStatus", []))

    @jsii.member(jsii_name="toGetDeviceDefinition")
    def to_get_device_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve information about a device definition.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/latest/apireference/getdevicedefinition-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetDeviceDefinition", []))

    @jsii.member(jsii_name="toGetDeviceDefinitionVersion")
    def to_get_device_definition_version(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve information about a device definition version.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/latest/apireference/getdevicedefinitionversion-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetDeviceDefinitionVersion", []))

    @jsii.member(jsii_name="toGetFunctionDefinition")
    def to_get_function_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve information about a Lambda function definition, such as its creation time and latest version.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/latest/apireference/getfunctiondefinition-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetFunctionDefinition", []))

    @jsii.member(jsii_name="toGetFunctionDefinitionVersion")
    def to_get_function_definition_version(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve information about a Lambda function definition version, such as which Lambda functions are included in the version and their configurations.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/latest/apireference/getfunctiondefinitionversion-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetFunctionDefinitionVersion", []))

    @jsii.member(jsii_name="toGetGroup")
    def to_get_group(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve information about a group.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/latest/apireference/getgroup-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetGroup", []))

    @jsii.member(jsii_name="toGetGroupCertificateAuthority")
    def to_get_group_certificate_authority(self) -> "Greengrass":
        '''(experimental) Grants permission to return the public key of the CA associated with a group.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/latest/apireference/getgroupcertificateauthority-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetGroupCertificateAuthority", []))

    @jsii.member(jsii_name="toGetGroupCertificateConfiguration")
    def to_get_group_certificate_configuration(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve the current configuration for the CA used by a group.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/latest/apireference/getgroupcertificateconfiguration-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetGroupCertificateConfiguration", []))

    @jsii.member(jsii_name="toGetGroupVersion")
    def to_get_group_version(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve information about a group version.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/latest/apireference/getgroupversion-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetGroupVersion", []))

    @jsii.member(jsii_name="toGetLoggerDefinition")
    def to_get_logger_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve information about a logger definition.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/latest/apireference/getloggerdefinition-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetLoggerDefinition", []))

    @jsii.member(jsii_name="toGetLoggerDefinitionVersion")
    def to_get_logger_definition_version(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve information about a logger definition version.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/latest/apireference/getloggerdefinitionversion-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetLoggerDefinitionVersion", []))

    @jsii.member(jsii_name="toGetResourceDefinition")
    def to_get_resource_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve information about a resource definition, such as its creation time and latest version.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/latest/apireference/getresourcedefinition-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetResourceDefinition", []))

    @jsii.member(jsii_name="toGetResourceDefinitionVersion")
    def to_get_resource_definition_version(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve information about a resource definition version, such as which resources are included in the version.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/latest/apireference/getresourcedefinitionversion-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetResourceDefinitionVersion", []))

    @jsii.member(jsii_name="toGetServiceRoleForAccount")
    def to_get_service_role_for_account(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve the service role that is attached to an account.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/latest/apireference/getserviceroleforaccount-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetServiceRoleForAccount", []))

    @jsii.member(jsii_name="toGetSubscriptionDefinition")
    def to_get_subscription_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve information about a subscription definition.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/latest/apireference/getsubscriptiondefinition-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetSubscriptionDefinition", []))

    @jsii.member(jsii_name="toGetSubscriptionDefinitionVersion")
    def to_get_subscription_definition_version(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve information about a subscription definition version.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/latest/apireference/getsubscriptiondefinitionversion-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetSubscriptionDefinitionVersion", []))

    @jsii.member(jsii_name="toGetThingRuntimeConfiguration")
    def to_get_thing_runtime_configuration(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve runtime configuration of a thing.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/latest/apireference/getthingruntimeconfiguration-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetThingRuntimeConfiguration", []))

    @jsii.member(jsii_name="toListBulkDeploymentDetailedReports")
    def to_list_bulk_deployment_detailed_reports(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve a paginated list of the deployments that have been started in a bulk deployment operation and their current deployment status.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/latest/apireference/listbulkdeploymentdetailedreports-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListBulkDeploymentDetailedReports", []))

    @jsii.member(jsii_name="toListBulkDeployments")
    def to_list_bulk_deployments(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve a list of bulk deployments.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/latest/apireference/listbulkdeployments-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListBulkDeployments", []))

    @jsii.member(jsii_name="toListConnectorDefinitions")
    def to_list_connector_definitions(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve a list of connector definitions.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/latest/apireference/listconnectordefinitions-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListConnectorDefinitions", []))

    @jsii.member(jsii_name="toListConnectorDefinitionVersions")
    def to_list_connector_definition_versions(self) -> "Greengrass":
        '''(experimental) Grants permission to list the versions of a connector definition.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/latest/apireference/listconnectordefinitionversions-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListConnectorDefinitionVersions", []))

    @jsii.member(jsii_name="toListCoreDefinitions")
    def to_list_core_definitions(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve a list of core definitions.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/latest/apireference/listcoredefinitions-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListCoreDefinitions", []))

    @jsii.member(jsii_name="toListCoreDefinitionVersions")
    def to_list_core_definition_versions(self) -> "Greengrass":
        '''(experimental) Grants permission to list the versions of a core definition.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/latest/apireference/listcoredefinitionversions-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListCoreDefinitionVersions", []))

    @jsii.member(jsii_name="toListDeployments")
    def to_list_deployments(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve a list of all deployments for a group.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/latest/apireference/listdeployments-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListDeployments", []))

    @jsii.member(jsii_name="toListDeviceDefinitions")
    def to_list_device_definitions(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve a list of device definitions.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/latest/apireference/listdevicedefinitions-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListDeviceDefinitions", []))

    @jsii.member(jsii_name="toListDeviceDefinitionVersions")
    def to_list_device_definition_versions(self) -> "Greengrass":
        '''(experimental) Grants permission to list the versions of a device definition.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/latest/apireference/listdevicedefinitionversions-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListDeviceDefinitionVersions", []))

    @jsii.member(jsii_name="toListFunctionDefinitions")
    def to_list_function_definitions(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve a list of Lambda function definitions.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/latest/apireference/listfunctiondefinitions-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListFunctionDefinitions", []))

    @jsii.member(jsii_name="toListFunctionDefinitionVersions")
    def to_list_function_definition_versions(self) -> "Greengrass":
        '''(experimental) Grants permission to list the versions of a Lambda function definition.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/latest/apireference/listfunctiondefinitionversions-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListFunctionDefinitionVersions", []))

    @jsii.member(jsii_name="toListGroupCertificateAuthorities")
    def to_list_group_certificate_authorities(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve a list of current CAs for a group.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/latest/apireference/listgroupcertificateauthorities-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListGroupCertificateAuthorities", []))

    @jsii.member(jsii_name="toListGroups")
    def to_list_groups(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve a list of groups.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/latest/apireference/listgroups-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListGroups", []))

    @jsii.member(jsii_name="toListGroupVersions")
    def to_list_group_versions(self) -> "Greengrass":
        '''(experimental) Grants permission to list the versions of a group.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/latest/apireference/listgroupversions-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListGroupVersions", []))

    @jsii.member(jsii_name="toListLoggerDefinitions")
    def to_list_logger_definitions(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve a list of logger definitions.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/latest/apireference/listloggerdefinitions-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListLoggerDefinitions", []))

    @jsii.member(jsii_name="toListLoggerDefinitionVersions")
    def to_list_logger_definition_versions(self) -> "Greengrass":
        '''(experimental) Grants permission to list the versions of a logger definition.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/latest/apireference/listloggerdefinitionversions-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListLoggerDefinitionVersions", []))

    @jsii.member(jsii_name="toListResourceDefinitions")
    def to_list_resource_definitions(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve a list of resource definitions.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/latest/apireference/listresourcedefinitions-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListResourceDefinitions", []))

    @jsii.member(jsii_name="toListResourceDefinitionVersions")
    def to_list_resource_definition_versions(self) -> "Greengrass":
        '''(experimental) Grants permission to list the versions of a resource definition.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/latest/apireference/listresourcedefinitionversions-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListResourceDefinitionVersions", []))

    @jsii.member(jsii_name="toListSubscriptionDefinitions")
    def to_list_subscription_definitions(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve a list of subscription definitions.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/latest/apireference/listsubscriptiondefinitions-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListSubscriptionDefinitions", []))

    @jsii.member(jsii_name="toListSubscriptionDefinitionVersions")
    def to_list_subscription_definition_versions(self) -> "Greengrass":
        '''(experimental) Grants permission to list the versions of a subscription definition.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/latest/apireference/listsubscriptiondefinitionversions-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListSubscriptionDefinitionVersions", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Greengrass":
        '''(experimental) Grants permission to list the tags for a resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/greengrass/latest/apireference/listtagsforresource-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toResetDeployments")
    def to_reset_deployments(self) -> "Greengrass":
        '''(experimental) Grants permission to reset a group's deployments.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/latest/apireference/resetdeployments-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toResetDeployments", []))

    @jsii.member(jsii_name="toStartBulkDeployment")
    def to_start_bulk_deployment(self) -> "Greengrass":
        '''(experimental) Grants permission to deploy multiple groups in one operation.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/latest/apireference/startbulkdeployment-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toStartBulkDeployment", []))

    @jsii.member(jsii_name="toStopBulkDeployment")
    def to_stop_bulk_deployment(self) -> "Greengrass":
        '''(experimental) Grants permission to stop the execution of a bulk deployment.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/latest/apireference/stopbulkdeployment-put.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toStopBulkDeployment", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Greengrass":
        '''(experimental) Grants permission to add tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/greengrass/latest/apireference/tagresource-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Greengrass":
        '''(experimental) Grants permission to remove tags from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/greengrass/latest/apireference/untagresource-delete.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateConnectivityInfo")
    def to_update_connectivity_info(self) -> "Greengrass":
        '''(experimental) Grants permission to update the connectivity information for a Greengrass core.

        Any devices that belong to the group that has this core will receive this information in order to find the location of the core and connect to it

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/latest/apireference/updateconnectivityinfo-put.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toUpdateConnectivityInfo", []))

    @jsii.member(jsii_name="toUpdateConnectorDefinition")
    def to_update_connector_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to update a connector definition.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/latest/apireference/updateconnectordefinition-put.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toUpdateConnectorDefinition", []))

    @jsii.member(jsii_name="toUpdateCoreDefinition")
    def to_update_core_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to update a core definition.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/latest/apireference/updatecoredefinition-put.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toUpdateCoreDefinition", []))

    @jsii.member(jsii_name="toUpdateDeviceDefinition")
    def to_update_device_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to update a device definition.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/latest/apireference/updatedevicedefinition-put.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toUpdateDeviceDefinition", []))

    @jsii.member(jsii_name="toUpdateFunctionDefinition")
    def to_update_function_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to update a Lambda function definition.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/latest/apireference/updatefunctiondefinition-put.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toUpdateFunctionDefinition", []))

    @jsii.member(jsii_name="toUpdateGroup")
    def to_update_group(self) -> "Greengrass":
        '''(experimental) Grants permission to update a group.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/latest/apireference/updategroup-put.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toUpdateGroup", []))

    @jsii.member(jsii_name="toUpdateGroupCertificateConfiguration")
    def to_update_group_certificate_configuration(self) -> "Greengrass":
        '''(experimental) Grants permission to update the certificate expiry time for a group.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/latest/apireference/updategroupcertificateconfiguration-put.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toUpdateGroupCertificateConfiguration", []))

    @jsii.member(jsii_name="toUpdateLoggerDefinition")
    def to_update_logger_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to update a logger definition.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/latest/apireference/updateloggerdefinition-put.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toUpdateLoggerDefinition", []))

    @jsii.member(jsii_name="toUpdateResourceDefinition")
    def to_update_resource_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to update a resource definition.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/latest/apireference/updateresourcedefinition-put.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toUpdateResourceDefinition", []))

    @jsii.member(jsii_name="toUpdateSubscriptionDefinition")
    def to_update_subscription_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to update a subscription definition.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/latest/apireference/updatesubscriptiondefinition-put.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toUpdateSubscriptionDefinition", []))

    @jsii.member(jsii_name="toUpdateThingRuntimeConfiguration")
    def to_update_thing_runtime_configuration(self) -> "Greengrass":
        '''(experimental) Grants permission to update runtime configuration of a thing.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/latest/apireference/updatethingruntimeconfiguration-put.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toUpdateThingRuntimeConfiguration", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class GreengrassV2(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.GreengrassV2",
):
    '''(experimental) Statement provider for service `greengrass-v2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotgreengrassv2.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `greengrass-v2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotgreengrassv2.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(GreengrassV2, self, [sid])

    @jsii.member(jsii_name="onComponent")
    def on_component(
        self,
        component_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "GreengrassV2":
        '''(experimental) Adds a resource of type component to the statement.

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_Component.html

        :param component_name: - Identifier for the componentName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "onComponent", [component_name, account, region, partition]))

    @jsii.member(jsii_name="onComponentVersion")
    def on_component_version(
        self,
        component_name: builtins.str,
        component_version: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "GreengrassV2":
        '''(experimental) Adds a resource of type componentVersion to the statement.

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_Component.html

        :param component_name: - Identifier for the componentName.
        :param component_version: - Identifier for the componentVersion.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "onComponentVersion", [component_name, component_version, account, region, partition]))

    @jsii.member(jsii_name="onCoreDevice")
    def on_core_device(
        self,
        core_device_thing_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "GreengrassV2":
        '''(experimental) Adds a resource of type coreDevice to the statement.

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_CoreDevice.html

        :param core_device_thing_name: - Identifier for the coreDeviceThingName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "onCoreDevice", [core_device_thing_name, account, region, partition]))

    @jsii.member(jsii_name="onDeployment")
    def on_deployment(
        self,
        deployment_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "GreengrassV2":
        '''(experimental) Adds a resource of type deployment to the statement.

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_Deployment.html

        :param deployment_id: - Identifier for the deploymentId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "onDeployment", [deployment_id, account, region, partition]))

    @jsii.member(jsii_name="toCancelDeployment")
    def to_cancel_deployment(self) -> "GreengrassV2":
        '''(experimental) Grants permission to cancel a deployment.

        Access Level: Write

        Dependent actions:

        - iot:CancelJob
        - iot:DeleteThingShadow
        - iot:DescribeJob
        - iot:DescribeThing
        - iot:DescribeThingGroup
        - iot:GetThingShadow
        - iot:UpdateJob
        - iot:UpdateThingShadow

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_CancelDeployment.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toCancelDeployment", []))

    @jsii.member(jsii_name="toCreateComponentVersion")
    def to_create_component_version(self) -> "GreengrassV2":
        '''(experimental) Grants permission to create a component.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_CreateComponentVersion.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toCreateComponentVersion", []))

    @jsii.member(jsii_name="toCreateDeployment")
    def to_create_deployment(self) -> "GreengrassV2":
        '''(experimental) Grants permission to create a deployment.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iot:CancelJob
        - iot:CreateJob
        - iot:DeleteThingShadow
        - iot:DescribeJob
        - iot:DescribeThing
        - iot:DescribeThingGroup
        - iot:GetThingShadow
        - iot:UpdateJob
        - iot:UpdateThingShadow

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_CreateDeployment.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toCreateDeployment", []))

    @jsii.member(jsii_name="toDeleteComponent")
    def to_delete_component(self) -> "GreengrassV2":
        '''(experimental) Grants permission to delete a component.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_DeleteComponent.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toDeleteComponent", []))

    @jsii.member(jsii_name="toDeleteCoreDevice")
    def to_delete_core_device(self) -> "GreengrassV2":
        '''(experimental) Grants permission to delete a AWS IoT Greengrass core device, which is an AWS IoT thing.

        This operation removes the core device from the list of core devices. This operation doesn't delete the AWS IoT thing

        Access Level: Write

        Dependent actions:

        - iot:DescribeJobExecution

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_DeleteCoreDevice.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toDeleteCoreDevice", []))

    @jsii.member(jsii_name="toDescribeComponent")
    def to_describe_component(self) -> "GreengrassV2":
        '''(experimental) Grants permission to retrieve metadata for a version of a component.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_DescribeComponent.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toDescribeComponent", []))

    @jsii.member(jsii_name="toGetComponent")
    def to_get_component(self) -> "GreengrassV2":
        '''(experimental) Grants permission to get the recipe for a version of a component.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_GetComponent.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toGetComponent", []))

    @jsii.member(jsii_name="toGetCoreDevice")
    def to_get_core_device(self) -> "GreengrassV2":
        '''(experimental) Grants permission to retrieves metadata for a AWS IoT Greengrass core device.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_GetCoreDevice.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toGetCoreDevice", []))

    @jsii.member(jsii_name="toGetDeployment")
    def to_get_deployment(self) -> "GreengrassV2":
        '''(experimental) Grants permission to get a deployment.

        Access Level: Read

        Dependent actions:

        - iot:DescribeJob
        - iot:DescribeThing
        - iot:DescribeThingGroup
        - iot:GetThingShadow

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_GetDeployment.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toGetDeployment", []))

    @jsii.member(jsii_name="toListComponents")
    def to_list_components(self) -> "GreengrassV2":
        '''(experimental) Grants permission to retrieve a paginated list of component summaries.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_ListComponents.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toListComponents", []))

    @jsii.member(jsii_name="toListComponentVersions")
    def to_list_component_versions(self) -> "GreengrassV2":
        '''(experimental) Grants permission to retrieve a paginated list of all versions for a component.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_ListComponentVersions.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toListComponentVersions", []))

    @jsii.member(jsii_name="toListCoreDevices")
    def to_list_core_devices(self) -> "GreengrassV2":
        '''(experimental) Grants permission to retrieve a paginated list of AWS IoT Greengrass core devices.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_ListCoreDevices.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toListCoreDevices", []))

    @jsii.member(jsii_name="toListDeployments")
    def to_list_deployments(self) -> "GreengrassV2":
        '''(experimental) Grants permission to retrieves a paginated list of deployments.

        Access Level: List

        Dependent actions:

        - iot:DescribeJob
        - iot:DescribeThing
        - iot:DescribeThingGroup
        - iot:GetThingShadow

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_ListDeployments.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toListDeployments", []))

    @jsii.member(jsii_name="toListEffectiveDeployments")
    def to_list_effective_deployments(self) -> "GreengrassV2":
        '''(experimental) Grants permission to retrieves a paginated list of deployment jobs that AWS IoT Greengrass sends to AWS IoT Greengrass core devices.

        Access Level: List

        Dependent actions:

        - iot:DescribeJob
        - iot:DescribeJobExecution
        - iot:DescribeThing
        - iot:DescribeThingGroup
        - iot:GetThingShadow

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_ListEffectiveDeployments.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toListEffectiveDeployments", []))

    @jsii.member(jsii_name="toListInstalledComponents")
    def to_list_installed_components(self) -> "GreengrassV2":
        '''(experimental) Grants permission to retrieve a paginated list of the components that a AWS IoT Greengrass core device runs.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_ListInstalledComponents.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toListInstalledComponents", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "GreengrassV2":
        '''(experimental) Grants permission to list the tags for a resource.

        Access Level: List

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "GreengrassV2":
        '''(experimental) Grants permission to add tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "GreengrassV2":
        '''(experimental) Grants permission to remove tags from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toUntagResource", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Groundstation(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Groundstation",
):
    '''(experimental) Statement provider for service `groundstation <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsgroundstation.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `groundstation <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsgroundstation.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Groundstation, self, [sid])

    @jsii.member(jsii_name="ifConfigId")
    def if_config_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Groundstation":
        '''(experimental) Filters access by the ID of a config.

        Applies to resource types:

        - Config

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "ifConfigId", [value, operator]))

    @jsii.member(jsii_name="ifConfigType")
    def if_config_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Groundstation":
        '''(experimental) Filters access by the type of a config.

        Applies to resource types:

        - Config

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "ifConfigType", [value, operator]))

    @jsii.member(jsii_name="ifContactId")
    def if_contact_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Groundstation":
        '''(experimental) Filters access by the ID of a contact.

        Applies to resource types:

        - Contact

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "ifContactId", [value, operator]))

    @jsii.member(jsii_name="ifDataflowEndpointGroupId")
    def if_dataflow_endpoint_group_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Groundstation":
        '''(experimental) Filters access by the ID of a dataflow endpoint group.

        Applies to resource types:

        - DataflowEndpointGroup

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "ifDataflowEndpointGroupId", [value, operator]))

    @jsii.member(jsii_name="ifGroundStationId")
    def if_ground_station_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Groundstation":
        '''(experimental) Filters access by the ID of a ground station.

        Applies to resource types:

        - GroundStationResource

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "ifGroundStationId", [value, operator]))

    @jsii.member(jsii_name="ifMissionProfileId")
    def if_mission_profile_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Groundstation":
        '''(experimental) Filters access by the ID of a mission profile.

        Applies to resource types:

        - MissionProfile

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "ifMissionProfileId", [value, operator]))

    @jsii.member(jsii_name="ifSatelliteId")
    def if_satellite_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Groundstation":
        '''(experimental) Filters access by the ID of a satellite.

        Applies to resource types:

        - Satellite

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "ifSatelliteId", [value, operator]))

    @jsii.member(jsii_name="onConfig")
    def on_config(
        self,
        config_type: builtins.str,
        config_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Groundstation":
        '''(experimental) Adds a resource of type Config to the statement.

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_ConfigListItem.html

        :param config_type: - Identifier for the configType.
        :param config_id: - Identifier for the configId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifConfigId() - .ifConfigType()

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "onConfig", [config_type, config_id, account, region, partition]))

    @jsii.member(jsii_name="onContact")
    def on_contact(
        self,
        contact_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Groundstation":
        '''(experimental) Adds a resource of type Contact to the statement.

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_ContactData.html

        :param contact_id: - Identifier for the contactId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifContactId()

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "onContact", [contact_id, account, region, partition]))

    @jsii.member(jsii_name="onDataflowEndpointGroup")
    def on_dataflow_endpoint_group(
        self,
        dataflow_endpoint_group_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Groundstation":
        '''(experimental) Adds a resource of type DataflowEndpointGroup to the statement.

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_DataflowEndpoint.html

        :param dataflow_endpoint_group_id: - Identifier for the dataflowEndpointGroupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifDataflowEndpointGroupId()

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "onDataflowEndpointGroup", [dataflow_endpoint_group_id, account, region, partition]))

    @jsii.member(jsii_name="onGroundStationResource")
    def on_ground_station_resource(
        self,
        ground_station_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Groundstation":
        '''(experimental) Adds a resource of type GroundStationResource to the statement.

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_GroundStationData.html

        :param ground_station_id: - Identifier for the groundStationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifGroundStationId()

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "onGroundStationResource", [ground_station_id, account, region, partition]))

    @jsii.member(jsii_name="onMissionProfile")
    def on_mission_profile(
        self,
        mission_profile_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Groundstation":
        '''(experimental) Adds a resource of type MissionProfile to the statement.

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_MissionProfileListItem.html

        :param mission_profile_id: - Identifier for the missionProfileId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag() - .ifMissionProfileId()

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "onMissionProfile", [mission_profile_id, account, region, partition]))

    @jsii.member(jsii_name="onSatellite")
    def on_satellite(
        self,
        satellite_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Groundstation":
        '''(experimental) Adds a resource of type Satellite to the statement.

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_SatelliteListItem.html

        :param satellite_id: - Identifier for the satelliteId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifSatelliteId()

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "onSatellite", [satellite_id, account, region, partition]))

    @jsii.member(jsii_name="toCancelContact")
    def to_cancel_contact(self) -> "Groundstation":
        '''(experimental) Grants permission to cancel a contact.

        Access Level: Write

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_CancelContact.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toCancelContact", []))

    @jsii.member(jsii_name="toCreateConfig")
    def to_create_config(self) -> "Groundstation":
        '''(experimental) Grants permission to create a configuration.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_CreateConfig.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toCreateConfig", []))

    @jsii.member(jsii_name="toCreateDataflowEndpointGroup")
    def to_create_dataflow_endpoint_group(self) -> "Groundstation":
        '''(experimental) Grants permission to create a data flow endpoint group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_CreateDataflowEndpointGroup.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toCreateDataflowEndpointGroup", []))

    @jsii.member(jsii_name="toCreateMissionProfile")
    def to_create_mission_profile(self) -> "Groundstation":
        '''(experimental) Grants permission to create a mission profile.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_CreateMissionProfile.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toCreateMissionProfile", []))

    @jsii.member(jsii_name="toDeleteConfig")
    def to_delete_config(self) -> "Groundstation":
        '''(experimental) Grants permission to delete a config.

        Access Level: Write

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_DeleteConfig.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toDeleteConfig", []))

    @jsii.member(jsii_name="toDeleteDataflowEndpointGroup")
    def to_delete_dataflow_endpoint_group(self) -> "Groundstation":
        '''(experimental) Grants permission to delete a data flow endpoint group.

        Access Level: Write

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_DeleteDataflowEndpointGroup.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toDeleteDataflowEndpointGroup", []))

    @jsii.member(jsii_name="toDeleteMissionProfile")
    def to_delete_mission_profile(self) -> "Groundstation":
        '''(experimental) Grants permission to delete a mission profile.

        Access Level: Write

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_DeleteMissionProfile.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toDeleteMissionProfile", []))

    @jsii.member(jsii_name="toDescribeContact")
    def to_describe_contact(self) -> "Groundstation":
        '''(experimental) Grants permission to describe a contact.

        Access Level: Read

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_DescribeContact.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toDescribeContact", []))

    @jsii.member(jsii_name="toGetConfig")
    def to_get_config(self) -> "Groundstation":
        '''(experimental) Grants permission to return a configuration.

        Access Level: Read

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_GetConfig.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toGetConfig", []))

    @jsii.member(jsii_name="toGetDataflowEndpointGroup")
    def to_get_dataflow_endpoint_group(self) -> "Groundstation":
        '''(experimental) Grants permission to return a data flow endpoint group.

        Access Level: Read

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_GetDataflowEndpointGroup.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toGetDataflowEndpointGroup", []))

    @jsii.member(jsii_name="toGetMinuteUsage")
    def to_get_minute_usage(self) -> "Groundstation":
        '''(experimental) Grants permission to return minutes usage.

        Access Level: Read

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_GetMinuteUsage.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toGetMinuteUsage", []))

    @jsii.member(jsii_name="toGetMissionProfile")
    def to_get_mission_profile(self) -> "Groundstation":
        '''(experimental) Grants permission to retrieve a mission profile.

        Access Level: Read

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_GetMissionProfile.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toGetMissionProfile", []))

    @jsii.member(jsii_name="toGetSatellite")
    def to_get_satellite(self) -> "Groundstation":
        '''(experimental) Grants permission to return information about a satellite.

        Access Level: Read

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_GetSatellite.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toGetSatellite", []))

    @jsii.member(jsii_name="toListConfigs")
    def to_list_configs(self) -> "Groundstation":
        '''(experimental) Grants permisson to return a list of past configurations.

        Access Level: List

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_ListConfigs.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toListConfigs", []))

    @jsii.member(jsii_name="toListContacts")
    def to_list_contacts(self) -> "Groundstation":
        '''(experimental) Grants permission to return a list of contacts.

        Access Level: List

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_ListContacts.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toListContacts", []))

    @jsii.member(jsii_name="toListDataflowEndpointGroups")
    def to_list_dataflow_endpoint_groups(self) -> "Groundstation":
        '''(experimental) Grants permission to list data flow endpoint groups.

        Access Level: List

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_ListDataflowEndpointGroups.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toListDataflowEndpointGroups", []))

    @jsii.member(jsii_name="toListGroundStations")
    def to_list_ground_stations(self) -> "Groundstation":
        '''(experimental) Grants permission to list ground stations.

        Access Level: List

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_ListGroundStations.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toListGroundStations", []))

    @jsii.member(jsii_name="toListMissionProfiles")
    def to_list_mission_profiles(self) -> "Groundstation":
        '''(experimental) Grants permission to return a list of mission profiles.

        Access Level: List

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_ListMissionProfiles.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toListMissionProfiles", []))

    @jsii.member(jsii_name="toListSatellites")
    def to_list_satellites(self) -> "Groundstation":
        '''(experimental) Grants permission to list satellites.

        Access Level: List

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_ListSatellites.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toListSatellites", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Groundstation":
        '''(experimental) Grants permission to list tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toReserveContact")
    def to_reserve_contact(self) -> "Groundstation":
        '''(experimental) Grants permission to reserve a contact.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_ReserveContact.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toReserveContact", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Groundstation":
        '''(experimental) Grants permission to assign a resource tag.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Groundstation":
        '''(experimental) Grants permission to deassign a resource tag.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateConfig")
    def to_update_config(self) -> "Groundstation":
        '''(experimental) Grants permission to update a configuration.

        Access Level: Write

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_UpdateConfig.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toUpdateConfig", []))

    @jsii.member(jsii_name="toUpdateMissionProfile")
    def to_update_mission_profile(self) -> "Groundstation":
        '''(experimental) Grants permission to update a mission profile.

        Access Level: Write

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_UpdateMissionProfile.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toUpdateMissionProfile", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Groundtruthlabeling(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Groundtruthlabeling",
):
    '''(experimental) Statement provider for service `groundtruthlabeling <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazongroundtruthlabeling.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `groundtruthlabeling <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazongroundtruthlabeling.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Groundtruthlabeling, self, [sid])

    @jsii.member(jsii_name="toDescribeConsoleJob")
    def to_describe_console_job(self) -> "Groundtruthlabeling":
        '''(experimental) Get status of GroundTruthLabeling Jobs.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/sms-data-input.html#sms-console-create-manifest-file

        :stability: experimental
        '''
        return typing.cast("Groundtruthlabeling", jsii.invoke(self, "toDescribeConsoleJob", []))

    @jsii.member(jsii_name="toListDatasetObjects")
    def to_list_dataset_objects(self) -> "Groundtruthlabeling":
        '''(experimental) Paginated list API to list dataset objects in a manifest file.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/sms-data-input.html#sms-console-create-manifest-file

        :stability: experimental
        '''
        return typing.cast("Groundtruthlabeling", jsii.invoke(self, "toListDatasetObjects", []))

    @jsii.member(jsii_name="toRunFilterOrSampleDatasetJob")
    def to_run_filter_or_sample_dataset_job(self) -> "Groundtruthlabeling":
        '''(experimental) Filter records from a manifest file using S3 select. Get sample entries based on random sampling.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/sms-data-input.html#sms-data-filtering

        :stability: experimental
        '''
        return typing.cast("Groundtruthlabeling", jsii.invoke(self, "toRunFilterOrSampleDatasetJob", []))

    @jsii.member(jsii_name="toRunGenerateManifestByCrawlingJob")
    def to_run_generate_manifest_by_crawling_job(self) -> "Groundtruthlabeling":
        '''(experimental) List a S3 prefix and create manifest files from objects in that location.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/sms-data-input.html#sms-console-create-manifest-file

        :stability: experimental
        '''
        return typing.cast("Groundtruthlabeling", jsii.invoke(self, "toRunGenerateManifestByCrawlingJob", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Guardduty(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Guardduty",
):
    '''(experimental) Statement provider for service `guardduty <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonguardduty.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `guardduty <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonguardduty.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Guardduty, self, [sid])

    @jsii.member(jsii_name="onDetector")
    def on_detector(
        self,
        detector_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Guardduty":
        '''(experimental) Adds a resource of type detector to the statement.

        https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_managing_access.html#guardduty-resources

        :param detector_id: - Identifier for the detectorId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "onDetector", [detector_id, account, region, partition]))

    @jsii.member(jsii_name="onFilter")
    def on_filter(
        self,
        detector_id: builtins.str,
        filter_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Guardduty":
        '''(experimental) Adds a resource of type filter to the statement.

        https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_managing_access.html#guardduty-resources

        :param detector_id: - Identifier for the detectorId.
        :param filter_name: - Identifier for the filterName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "onFilter", [detector_id, filter_name, account, region, partition]))

    @jsii.member(jsii_name="onIpset")
    def on_ipset(
        self,
        detector_id: builtins.str,
        i_p_set_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Guardduty":
        '''(experimental) Adds a resource of type ipset to the statement.

        https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_managing_access.html#guardduty-resources

        :param detector_id: - Identifier for the detectorId.
        :param i_p_set_id: - Identifier for the iPSetId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "onIpset", [detector_id, i_p_set_id, account, region, partition]))

    @jsii.member(jsii_name="onPublishingDestination")
    def on_publishing_destination(
        self,
        detector_id: builtins.str,
        publishing_destination_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Guardduty":
        '''(experimental) Adds a resource of type publishingDestination to the statement.

        https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_managing_access.html#guardduty-resources

        :param detector_id: - Identifier for the detectorId.
        :param publishing_destination_id: - Identifier for the publishingDestinationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "onPublishingDestination", [detector_id, publishing_destination_id, account, region, partition]))

    @jsii.member(jsii_name="onThreatintelset")
    def on_threatintelset(
        self,
        detector_id: builtins.str,
        threat_intel_set_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Guardduty":
        '''(experimental) Adds a resource of type threatintelset to the statement.

        https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_managing_access.html#guardduty-resources

        :param detector_id: - Identifier for the detectorId.
        :param threat_intel_set_id: - Identifier for the threatIntelSetId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "onThreatintelset", [detector_id, threat_intel_set_id, account, region, partition]))

    @jsii.member(jsii_name="toAcceptInvitation")
    def to_accept_invitation(self) -> "Guardduty":
        '''(experimental) Grants permission to accept invitations to become a GuardDuty member account.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_AcceptInvitation.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toAcceptInvitation", []))

    @jsii.member(jsii_name="toArchiveFindings")
    def to_archive_findings(self) -> "Guardduty":
        '''(experimental) Grants permission to archive GuardDuty findings.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ArchiveFindings.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toArchiveFindings", []))

    @jsii.member(jsii_name="toCreateDetector")
    def to_create_detector(self) -> "Guardduty":
        '''(experimental) Grants permission to create a detector.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_CreateDetector.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toCreateDetector", []))

    @jsii.member(jsii_name="toCreateFilter")
    def to_create_filter(self) -> "Guardduty":
        '''(experimental) Grants permission to create GuardDuty filters. A filters defines finding attributes and conditions used to filter findings.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_CreateFilter.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toCreateFilter", []))

    @jsii.member(jsii_name="toCreateIPSet")
    def to_create_ip_set(self) -> "Guardduty":
        '''(experimental) Grants permission to create an IPSet.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_CreateIPSet.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toCreateIPSet", []))

    @jsii.member(jsii_name="toCreateMembers")
    def to_create_members(self) -> "Guardduty":
        '''(experimental) Grants permission to create GuardDuty member accounts, where the account used to create a member becomes the GuardDuty administrator account.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_CreateMembers.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toCreateMembers", []))

    @jsii.member(jsii_name="toCreatePublishingDestination")
    def to_create_publishing_destination(self) -> "Guardduty":
        '''(experimental) Grants permission to create a publishing destination.

        Access Level: Write

        Dependent actions:

        - s3:GetObject
        - s3:ListBucket

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_CreatePublishingDestination.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toCreatePublishingDestination", []))

    @jsii.member(jsii_name="toCreateSampleFindings")
    def to_create_sample_findings(self) -> "Guardduty":
        '''(experimental) Grants permission to create sample findings.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_CreateSampleFindings.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toCreateSampleFindings", []))

    @jsii.member(jsii_name="toCreateThreatIntelSet")
    def to_create_threat_intel_set(self) -> "Guardduty":
        '''(experimental) Grants permission to create GuardDuty ThreatIntelSets, where a ThreatIntelSet consists of known malicious IP addresses used by GuardDuty to generate findings.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_CreateThreatIntelSet.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toCreateThreatIntelSet", []))

    @jsii.member(jsii_name="toDeclineInvitations")
    def to_decline_invitations(self) -> "Guardduty":
        '''(experimental) Grants permission to decline invitations to become a GuardDuty member account.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DeclineInvitations.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toDeclineInvitations", []))

    @jsii.member(jsii_name="toDeleteDetector")
    def to_delete_detector(self) -> "Guardduty":
        '''(experimental) Grants permission to delete GuardDuty detectors.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DeleteDetector.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toDeleteDetector", []))

    @jsii.member(jsii_name="toDeleteFilter")
    def to_delete_filter(self) -> "Guardduty":
        '''(experimental) Grants permission to delete GuardDuty filters.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DeleteFilter.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toDeleteFilter", []))

    @jsii.member(jsii_name="toDeleteInvitations")
    def to_delete_invitations(self) -> "Guardduty":
        '''(experimental) Grants permission to delete invitations to become a GuardDuty member account.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DeleteInvitations.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toDeleteInvitations", []))

    @jsii.member(jsii_name="toDeleteIPSet")
    def to_delete_ip_set(self) -> "Guardduty":
        '''(experimental) Grants permission to delete GuardDuty IPSets.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DeleteIPSet.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toDeleteIPSet", []))

    @jsii.member(jsii_name="toDeleteMembers")
    def to_delete_members(self) -> "Guardduty":
        '''(experimental) Grants permission to delete GuardDuty member accounts.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DeleteMembers.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toDeleteMembers", []))

    @jsii.member(jsii_name="toDeletePublishingDestination")
    def to_delete_publishing_destination(self) -> "Guardduty":
        '''(experimental) Grants permission to delete a publishing destination.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DeletePublishingDestination.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toDeletePublishingDestination", []))

    @jsii.member(jsii_name="toDeleteThreatIntelSet")
    def to_delete_threat_intel_set(self) -> "Guardduty":
        '''(experimental) Grants permission to delete GuardDuty ThreatIntelSets.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DeleteThreatIntelSet.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toDeleteThreatIntelSet", []))

    @jsii.member(jsii_name="toDescribeOrganizationConfiguration")
    def to_describe_organization_configuration(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve details about the delegated administrator associated with a GuardDuty detector.

        Access Level: Read

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DescribeOrganizationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toDescribeOrganizationConfiguration", []))

    @jsii.member(jsii_name="toDescribePublishingDestination")
    def to_describe_publishing_destination(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve details about a publishing destination.

        Access Level: Read

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DescribePublishingDestination.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toDescribePublishingDestination", []))

    @jsii.member(jsii_name="toDisableOrganizationAdminAccount")
    def to_disable_organization_admin_account(self) -> "Guardduty":
        '''(experimental) Grants permission to disable the organization delegated administrator for GuardDuty.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DisableOrganizationAdminAccount.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toDisableOrganizationAdminAccount", []))

    @jsii.member(jsii_name="toDisassociateFromMasterAccount")
    def to_disassociate_from_master_account(self) -> "Guardduty":
        '''(experimental) Grants permission to disassociate a GuardDuty member account from its GuardDuty master account.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DisassociateFromMasterAccount.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toDisassociateFromMasterAccount", []))

    @jsii.member(jsii_name="toDisassociateMembers")
    def to_disassociate_members(self) -> "Guardduty":
        '''(experimental) Grants permission to disassociate GuardDuty member accounts from their master GuardDuty account.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DisassociateMembers.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toDisassociateMembers", []))

    @jsii.member(jsii_name="toEnableOrganizationAdminAccount")
    def to_enable_organization_admin_account(self) -> "Guardduty":
        '''(experimental) Grants permission to enable an organization delegated administrator for GuardDuty.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_EnableOrganizationAdminAccount.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toEnableOrganizationAdminAccount", []))

    @jsii.member(jsii_name="toGetDetector")
    def to_get_detector(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve GuardDuty detectors.

        Access Level: Read

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_GetDetector.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toGetDetector", []))

    @jsii.member(jsii_name="toGetFilter")
    def to_get_filter(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve GuardDuty filters.

        Access Level: Read

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_GetFilter.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toGetFilter", []))

    @jsii.member(jsii_name="toGetFindings")
    def to_get_findings(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve GuardDuty findings.

        Access Level: Read

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_GetFindings.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toGetFindings", []))

    @jsii.member(jsii_name="toGetFindingsStatistics")
    def to_get_findings_statistics(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve a list of GuardDuty finding statistics.

        Access Level: Read

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_GetFindingsStatistics.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toGetFindingsStatistics", []))

    @jsii.member(jsii_name="toGetInvitationsCount")
    def to_get_invitations_count(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve the count of all GuardDuty invitations sent to a specified account, which does not include the accepted invitation.

        Access Level: Read

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_GetInvitationsCount.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toGetInvitationsCount", []))

    @jsii.member(jsii_name="toGetIPSet")
    def to_get_ip_set(self) -> "Guardduty":
        '''(experimental) Grants permsission to retrieve GuardDuty IPSets.

        Access Level: Read

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_GetIPSet.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toGetIPSet", []))

    @jsii.member(jsii_name="toGetMasterAccount")
    def to_get_master_account(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve details of the GuardDuty master account associated with a member account.

        Access Level: Read

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_GetMasterAccount.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toGetMasterAccount", []))

    @jsii.member(jsii_name="toGetMembers")
    def to_get_members(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve the member accounts associated with a master account.

        Access Level: Read

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_GetMembers.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toGetMembers", []))

    @jsii.member(jsii_name="toGetThreatIntelSet")
    def to_get_threat_intel_set(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve GuardDuty ThreatIntelSets.

        Access Level: Read

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_GetThreatIntelSet.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toGetThreatIntelSet", []))

    @jsii.member(jsii_name="toInviteMembers")
    def to_invite_members(self) -> "Guardduty":
        '''(experimental) Grants permission to invite other AWS accounts to enable GuardDuty and become GuardDuty member accounts.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_InviteMembers.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toInviteMembers", []))

    @jsii.member(jsii_name="toListDetectors")
    def to_list_detectors(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve a list of GuardDuty detectors.

        Access Level: List

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListDetectors.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toListDetectors", []))

    @jsii.member(jsii_name="toListFilters")
    def to_list_filters(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve a list of GuardDuty filters.

        Access Level: List

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListFilters.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toListFilters", []))

    @jsii.member(jsii_name="toListFindings")
    def to_list_findings(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve a list of GuardDuty findings.

        Access Level: List

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListFindings.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toListFindings", []))

    @jsii.member(jsii_name="toListInvitations")
    def to_list_invitations(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve a lists of all of the GuardDuty membership invitations that were sent to an AWS account.

        Access Level: List

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListInvitations.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toListInvitations", []))

    @jsii.member(jsii_name="toListIPSets")
    def to_list_ip_sets(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve a list of GuardDuty IPSets.

        Access Level: List

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListIPSets.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toListIPSets", []))

    @jsii.member(jsii_name="toListMembers")
    def to_list_members(self) -> "Guardduty":
        '''(experimental) Grants permission to retrierve a lsit of GuardDuty member accounts associated with a master account.

        Access Level: List

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListMembers.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toListMembers", []))

    @jsii.member(jsii_name="toListOrganizationAdminAccounts")
    def to_list_organization_admin_accounts(self) -> "Guardduty":
        '''(experimental) Grants permission to list details about the organization delegated administrator for GuardDuty.

        Access Level: List

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListOrganizationAdminAccounts.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toListOrganizationAdminAccounts", []))

    @jsii.member(jsii_name="toListPublishingDestinations")
    def to_list_publishing_destinations(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve a list of publishing destinations.

        Access Level: List

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListPublishingDestinations.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toListPublishingDestinations", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve a list of tags associated with a GuardDuty resource.

        Access Level: List

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListThreatIntelSets")
    def to_list_threat_intel_sets(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve a list of GuardDuty ThreatIntelSets.

        Access Level: List

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListThreatIntelSets.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toListThreatIntelSets", []))

    @jsii.member(jsii_name="toStartMonitoringMembers")
    def to_start_monitoring_members(self) -> "Guardduty":
        '''(experimental) Grants permission to a GuardDuty administrator account to monitor findings from GuardDuty member accounts.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_StartMonitoringMembers.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toStartMonitoringMembers", []))

    @jsii.member(jsii_name="toStopMonitoringMembers")
    def to_stop_monitoring_members(self) -> "Guardduty":
        '''(experimental) Grants permission to disable monitoring findings from member accounts.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_StopMonitoringMembers.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toStopMonitoringMembers", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Guardduty":
        '''(experimental) Grants permission to add tags to a GuardDuty resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUnarchiveFindings")
    def to_unarchive_findings(self) -> "Guardduty":
        '''(experimental) Grants permission to unarchive GuardDuty findings.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UnarchiveFindings.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toUnarchiveFindings", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Guardduty":
        '''(experimental) Grants permission to remove tags from a GuardDuty resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateDetector")
    def to_update_detector(self) -> "Guardduty":
        '''(experimental) Grants permission to update GuardDuty detectors.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateDetector.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toUpdateDetector", []))

    @jsii.member(jsii_name="toUpdateFilter")
    def to_update_filter(self) -> "Guardduty":
        '''(experimental) Grants permission to updates GuardDuty filters.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateFilter.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toUpdateFilter", []))

    @jsii.member(jsii_name="toUpdateFindingsFeedback")
    def to_update_findings_feedback(self) -> "Guardduty":
        '''(experimental) Grants permission to update findings feedback to mark GuardDuty findings as useful or not useful.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateFindingsFeedback.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toUpdateFindingsFeedback", []))

    @jsii.member(jsii_name="toUpdateIPSet")
    def to_update_ip_set(self) -> "Guardduty":
        '''(experimental) Grants permission to update GuardDuty IPSets.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateIPSet.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toUpdateIPSet", []))

    @jsii.member(jsii_name="toUpdateOrganizationConfiguration")
    def to_update_organization_configuration(self) -> "Guardduty":
        '''(experimental) Grants permission to update the delegated administrator configuration associated with a GuardDuty detector.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateOrganizationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toUpdateOrganizationConfiguration", []))

    @jsii.member(jsii_name="toUpdatePublishingDestination")
    def to_update_publishing_destination(self) -> "Guardduty":
        '''(experimental) Grants permission to update a publishing destination.

        Access Level: Write

        Dependent actions:

        - s3:GetObject
        - s3:ListBucket

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdatePublishingDestination.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toUpdatePublishingDestination", []))

    @jsii.member(jsii_name="toUpdateThreatIntelSet")
    def to_update_threat_intel_set(self) -> "Guardduty":
        '''(experimental) Grants permission to updates the GuardDuty ThreatIntelSets.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateThreatIntelSet.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toUpdateThreatIntelSet", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Health(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Health"):
    '''(experimental) Statement provider for service `health <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awshealthapisandnotifications.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `health <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awshealthapisandnotifications.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Health, self, [sid])

    @jsii.member(jsii_name="ifEventTypeCode")
    def if_event_type_code(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Health":
        '''(experimental) The type of event.

        https://docs.aws.amazon.com/health/latest/ug/controlling-access.html

        Applies to actions:

        - .toDescribeAffectedEntities()
        - .toDescribeEventDetails()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Health", jsii.invoke(self, "ifEventTypeCode", [value, operator]))

    @jsii.member(jsii_name="ifService")
    def if_service(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Health":
        '''(experimental) The service of the event.

        https://docs.aws.amazon.com/health/latest/ug/controlling-access.html

        Applies to actions:

        - .toDescribeAffectedEntities()
        - .toDescribeEventDetails()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Health", jsii.invoke(self, "ifService", [value, operator]))

    @jsii.member(jsii_name="onEvent")
    def on_event(
        self,
        service: builtins.str,
        event_type_code: builtins.str,
        event_type_plus_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Health":
        '''(experimental) Adds a resource of type event to the statement.

        https://docs.aws.amazon.com/health/latest/ug/supported-operations.html

        :param service: - Identifier for the service.
        :param event_type_code: - Identifier for the eventTypeCode.
        :param event_type_plus_id: - Identifier for the eventTypePlusId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Health", jsii.invoke(self, "onEvent", [service, event_type_code, event_type_plus_id, account, region, partition]))

    @jsii.member(jsii_name="toDescribeAffectedAccountsForOrganization")
    def to_describe_affected_accounts_for_organization(self) -> "Health":
        '''(experimental) Gets a list of accounts that have been affected by the specified events in organization.

        Access Level: Read

        Dependent actions:

        - organizations:ListAccounts

        https://docs.aws.amazon.com/health/latest/APIReference/API_DescribeAffectedAccountsForOrganization.html

        :stability: experimental
        '''
        return typing.cast("Health", jsii.invoke(self, "toDescribeAffectedAccountsForOrganization", []))

    @jsii.member(jsii_name="toDescribeAffectedEntities")
    def to_describe_affected_entities(self) -> "Health":
        '''(experimental) Gets a list of entities that have been affected by the specified events.

        Access Level: Read

        Possible conditions:

        - .ifEventTypeCode()
        - .ifService()

        https://docs.aws.amazon.com/health/latest/APIReference/API_DescribeAffectedEntities.html

        :stability: experimental
        '''
        return typing.cast("Health", jsii.invoke(self, "toDescribeAffectedEntities", []))

    @jsii.member(jsii_name="toDescribeAffectedEntitiesForOrganization")
    def to_describe_affected_entities_for_organization(self) -> "Health":
        '''(experimental) Gets a list of entities that have been affected by the specified events and accounts in organization.

        Access Level: Read

        Dependent actions:

        - organizations:ListAccounts

        https://docs.aws.amazon.com/health/latest/APIReference/API_DescribeAffectedEntitiesForOrganization.html

        :stability: experimental
        '''
        return typing.cast("Health", jsii.invoke(self, "toDescribeAffectedEntitiesForOrganization", []))

    @jsii.member(jsii_name="toDescribeEntityAggregates")
    def to_describe_entity_aggregates(self) -> "Health":
        '''(experimental) Returns the number of entities that are affected by each of the specified events.

        Access Level: Read

        https://docs.aws.amazon.com/health/latest/APIReference/API_DescribeEntityAggregates.html

        :stability: experimental
        '''
        return typing.cast("Health", jsii.invoke(self, "toDescribeEntityAggregates", []))

    @jsii.member(jsii_name="toDescribeEventAggregates")
    def to_describe_event_aggregates(self) -> "Health":
        '''(experimental) Returns the number of events of each event type (issue, scheduled change, and account notification).

        Access Level: Read

        https://docs.aws.amazon.com/health/latest/APIReference/API_DescribeEventAggregates.html

        :stability: experimental
        '''
        return typing.cast("Health", jsii.invoke(self, "toDescribeEventAggregates", []))

    @jsii.member(jsii_name="toDescribeEventDetails")
    def to_describe_event_details(self) -> "Health":
        '''(experimental) Returns detailed information about one or more specified events.

        Access Level: Read

        Possible conditions:

        - .ifEventTypeCode()
        - .ifService()

        https://docs.aws.amazon.com/health/latest/APIReference/API_DescribeEventDetails.html

        :stability: experimental
        '''
        return typing.cast("Health", jsii.invoke(self, "toDescribeEventDetails", []))

    @jsii.member(jsii_name="toDescribeEventDetailsForOrganization")
    def to_describe_event_details_for_organization(self) -> "Health":
        '''(experimental) Returns detailed information about one or more specified events for provided accounts in organization.

        Access Level: Read

        Dependent actions:

        - organizations:ListAccounts

        https://docs.aws.amazon.com/health/latest/APIReference/API_DescribeEventDetailsForOrganization.html

        :stability: experimental
        '''
        return typing.cast("Health", jsii.invoke(self, "toDescribeEventDetailsForOrganization", []))

    @jsii.member(jsii_name="toDescribeEvents")
    def to_describe_events(self) -> "Health":
        '''(experimental) Returns information about events that meet the specified filter criteria.

        Access Level: Read

        https://docs.aws.amazon.com/health/latest/APIReference/API_DescribeEvents.html

        :stability: experimental
        '''
        return typing.cast("Health", jsii.invoke(self, "toDescribeEvents", []))

    @jsii.member(jsii_name="toDescribeEventsForOrganization")
    def to_describe_events_for_organization(self) -> "Health":
        '''(experimental) Returns information about events that meet the specified filter criteria in organization.

        Access Level: Read

        Dependent actions:

        - organizations:ListAccounts

        https://docs.aws.amazon.com/health/latest/APIReference/API_DescribeEventsForOrganization.html

        :stability: experimental
        '''
        return typing.cast("Health", jsii.invoke(self, "toDescribeEventsForOrganization", []))

    @jsii.member(jsii_name="toDescribeEventTypes")
    def to_describe_event_types(self) -> "Health":
        '''(experimental) Returns the event types that meet the specified filter criteria.

        Access Level: Read

        https://docs.aws.amazon.com/health/latest/APIReference/API_DescribeEventTypes.html

        :stability: experimental
        '''
        return typing.cast("Health", jsii.invoke(self, "toDescribeEventTypes", []))

    @jsii.member(jsii_name="toDescribeHealthServiceStatusForOrganization")
    def to_describe_health_service_status_for_organization(self) -> "Health":
        '''(experimental) Returns the status of enabling or disabling the Organizational View feature.

        Access Level: Read

        Dependent actions:

        - organizations:ListAccounts

        https://docs.aws.amazon.com/health/latest/APIReference/API_DescribeHealthServiceStatusForOrganization.html

        :stability: experimental
        '''
        return typing.cast("Health", jsii.invoke(self, "toDescribeHealthServiceStatusForOrganization", []))

    @jsii.member(jsii_name="toDisableHealthServiceAccessForOrganization")
    def to_disable_health_service_access_for_organization(self) -> "Health":
        '''(experimental) Disables the Organizational View feature.

        Access Level: Permissions management

        Dependent actions:

        - organizations:DisableAWSServiceAccess
        - organizations:ListAccounts

        https://docs.aws.amazon.com/health/latest/APIReference/API_DisableHealthServiceAccessForOrganization.html

        :stability: experimental
        '''
        return typing.cast("Health", jsii.invoke(self, "toDisableHealthServiceAccessForOrganization", []))

    @jsii.member(jsii_name="toEnableHealthServiceAccessForOrganization")
    def to_enable_health_service_access_for_organization(self) -> "Health":
        '''(experimental) Enables the Organizational View feature.

        Access Level: Permissions management

        Dependent actions:

        - iam:CreateServiceLinkedRole
        - organizations:EnableAWSServiceAccess
        - organizations:ListAccounts

        https://docs.aws.amazon.com/health/latest/APIReference/API_EnableHealthServiceAccessForOrganization.html

        :stability: experimental
        '''
        return typing.cast("Health", jsii.invoke(self, "toEnableHealthServiceAccessForOrganization", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Healthlake(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Healthlake",
):
    '''(experimental) Statement provider for service `healthlake <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonhealthlake.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `healthlake <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonhealthlake.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Healthlake, self, [sid])

    @jsii.member(jsii_name="onDatastore")
    def on_datastore(
        self,
        datastore_id: builtins.str,
        account_id: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Healthlake":
        '''(experimental) Adds a resource of type datastore to the statement.

        https://docs.aws.amazon.com/healthlake/latest/APIReference/API_DatastoreProperties.html

        :param datastore_id: - Identifier for the datastoreId.
        :param account_id: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Healthlake", jsii.invoke(self, "onDatastore", [datastore_id, account_id, region, partition]))

    @jsii.member(jsii_name="toCreateFHIRDatastore")
    def to_create_fhir_datastore(self) -> "Healthlake":
        '''(experimental) Grants permission to create a datastore that can ingest and export FHIR data.

        Access Level: Write

        https://docs.aws.amazon.com/healthlake/latest/APIReference/API_CreateFHIRDatastore.html

        :stability: experimental
        '''
        return typing.cast("Healthlake", jsii.invoke(self, "toCreateFHIRDatastore", []))

    @jsii.member(jsii_name="toCreateResource")
    def to_create_resource(self) -> "Healthlake":
        '''(experimental) Grants permission to create resource.

        Access Level: Write

        https://docs.aws.amazon.com/healthlake/latest/devguide/crud-healthlake.html

        :stability: experimental
        '''
        return typing.cast("Healthlake", jsii.invoke(self, "toCreateResource", []))

    @jsii.member(jsii_name="toDeleteFHIRDatastore")
    def to_delete_fhir_datastore(self) -> "Healthlake":
        '''(experimental) Grants permission to delete a datastore.

        Access Level: Write

        https://docs.aws.amazon.com/healthlake/latest/APIReference/API_DeleteFHIRDatastore.html

        :stability: experimental
        '''
        return typing.cast("Healthlake", jsii.invoke(self, "toDeleteFHIRDatastore", []))

    @jsii.member(jsii_name="toDeleteResource")
    def to_delete_resource(self) -> "Healthlake":
        '''(experimental) Grants permission to delete resource.

        Access Level: Write

        https://docs.aws.amazon.com/healthlake/latest/devguide/crud-healthlake.html

        :stability: experimental
        '''
        return typing.cast("Healthlake", jsii.invoke(self, "toDeleteResource", []))

    @jsii.member(jsii_name="toDescribeFHIRDatastore")
    def to_describe_fhir_datastore(self) -> "Healthlake":
        '''(experimental) Grants permission to get the properties associated with the FHIR datastore, including the datastore ID, datastore ARN, datastore name, datastore status, created at, datastore type version, and datastore endpoint.

        Access Level: Read

        https://docs.aws.amazon.com/healthlake/latest/APIReference/API_DescribeFHIRDatastore.html

        :stability: experimental
        '''
        return typing.cast("Healthlake", jsii.invoke(self, "toDescribeFHIRDatastore", []))

    @jsii.member(jsii_name="toDescribeFHIRExportJob")
    def to_describe_fhir_export_job(self) -> "Healthlake":
        '''(experimental) Grants permission to display the properties of a FHIR export job, including the ID, ARN, name, and the status of the datastore.

        Access Level: Read

        https://docs.aws.amazon.com/healthlake/latest/APIReference/API_DescribeFHIRExportJob.html

        :stability: experimental
        '''
        return typing.cast("Healthlake", jsii.invoke(self, "toDescribeFHIRExportJob", []))

    @jsii.member(jsii_name="toDescribeFHIRImportJob")
    def to_describe_fhir_import_job(self) -> "Healthlake":
        '''(experimental) Grants permission to display the properties of a FHIR import job, including the ID, ARN, name, and the status of the datastore.

        Access Level: Read

        https://docs.aws.amazon.com/healthlake/latest/APIReference/API_DescribeFHIRImportJob.html

        :stability: experimental
        '''
        return typing.cast("Healthlake", jsii.invoke(self, "toDescribeFHIRImportJob", []))

    @jsii.member(jsii_name="toGetCapabilities")
    def to_get_capabilities(self) -> "Healthlake":
        '''(experimental) Grants permission to lists all FHIR datastores that are in the user’s account, regardless of datastore status.

        Access Level: Read

        https://docs.aws.amazon.com/healthlake/latest/devguide/crud-healthlake.html

        :stability: experimental
        '''
        return typing.cast("Healthlake", jsii.invoke(self, "toGetCapabilities", []))

    @jsii.member(jsii_name="toListFHIRDatastores")
    def to_list_fhir_datastores(self) -> "Healthlake":
        '''(experimental) Grants permission to list all FHIR datastores that are in the user’s account, regardless of datastore status.

        Access Level: List

        https://docs.aws.amazon.com/healthlake/latest/APIReference/API_ListFHIRDatastores.html

        :stability: experimental
        '''
        return typing.cast("Healthlake", jsii.invoke(self, "toListFHIRDatastores", []))

    @jsii.member(jsii_name="toReadResource")
    def to_read_resource(self) -> "Healthlake":
        '''(experimental) Grants permission to read resource.

        Access Level: Read

        https://docs.aws.amazon.com/healthlake/latest/devguide/crud-healthlake.html

        :stability: experimental
        '''
        return typing.cast("Healthlake", jsii.invoke(self, "toReadResource", []))

    @jsii.member(jsii_name="toSearchWithGet")
    def to_search_with_get(self) -> "Healthlake":
        '''(experimental) Grants permission to search resources with GET method.

        Access Level: Read

        https://docs.aws.amazon.com/healthlake/latest/devguide/search-healthlake.html

        :stability: experimental
        '''
        return typing.cast("Healthlake", jsii.invoke(self, "toSearchWithGet", []))

    @jsii.member(jsii_name="toSearchWithPost")
    def to_search_with_post(self) -> "Healthlake":
        '''(experimental) Grants permission to search resources with POST method.

        Access Level: Read

        https://docs.aws.amazon.com/healthlake/latest/devguide/search-healthlake.html

        :stability: experimental
        '''
        return typing.cast("Healthlake", jsii.invoke(self, "toSearchWithPost", []))

    @jsii.member(jsii_name="toStartFHIRExportJob")
    def to_start_fhir_export_job(self) -> "Healthlake":
        '''(experimental) Grants permission to begin a FHIR Export job.

        Access Level: Write

        https://docs.aws.amazon.com/healthlake/latest/APIReference/API_StartFHIRExportJob.html

        :stability: experimental
        '''
        return typing.cast("Healthlake", jsii.invoke(self, "toStartFHIRExportJob", []))

    @jsii.member(jsii_name="toStartFHIRImportJob")
    def to_start_fhir_import_job(self) -> "Healthlake":
        '''(experimental) Grants permission to begin a FHIR Import job.

        Access Level: Write

        https://docs.aws.amazon.com/healthlake/latest/APIReference/API_StartFHIRImportJob.html

        :stability: experimental
        '''
        return typing.cast("Healthlake", jsii.invoke(self, "toStartFHIRImportJob", []))

    @jsii.member(jsii_name="toUpdateResource")
    def to_update_resource(self) -> "Healthlake":
        '''(experimental) Grants permission to update resource.

        Access Level: Write

        https://docs.aws.amazon.com/healthlake/latest/devguide/crud-healthlake.html

        :stability: experimental
        '''
        return typing.cast("Healthlake", jsii.invoke(self, "toUpdateResource", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Honeycode(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Honeycode",
):
    '''(experimental) Statement provider for service `honeycode <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonhoneycode.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `honeycode <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonhoneycode.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Honeycode, self, [sid])

    @jsii.member(jsii_name="onScreen")
    def on_screen(
        self,
        workbook_id: builtins.str,
        app_id: builtins.str,
        screen_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Honeycode":
        '''(experimental) Adds a resource of type screen to the statement.

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/resource-screen.html

        :param workbook_id: - Identifier for the workbookId.
        :param app_id: - Identifier for the appId.
        :param screen_id: - Identifier for the screenId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "onScreen", [workbook_id, app_id, screen_id, account, region, partition]))

    @jsii.member(jsii_name="onScreenAutomation")
    def on_screen_automation(
        self,
        workbook_id: builtins.str,
        app_id: builtins.str,
        screen_id: builtins.str,
        automation_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Honeycode":
        '''(experimental) Adds a resource of type screen-automation to the statement.

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/resource-screen-automation.html

        :param workbook_id: - Identifier for the workbookId.
        :param app_id: - Identifier for the appId.
        :param screen_id: - Identifier for the screenId.
        :param automation_id: - Identifier for the automationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "onScreenAutomation", [workbook_id, app_id, screen_id, automation_id, account, region, partition]))

    @jsii.member(jsii_name="onTable")
    def on_table(
        self,
        workbook_id: builtins.str,
        table_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Honeycode":
        '''(experimental) Adds a resource of type table to the statement.

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/resource-table.html

        :param workbook_id: - Identifier for the workbookId.
        :param table_id: - Identifier for the tableId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "onTable", [workbook_id, table_id, account, region, partition]))

    @jsii.member(jsii_name="onWorkbook")
    def on_workbook(
        self,
        workbook_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Honeycode":
        '''(experimental) Adds a resource of type workbook to the statement.

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/resource-workbook.html

        :param workbook_id: - Identifier for the workbookId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "onWorkbook", [workbook_id, account, region, partition]))

    @jsii.member(jsii_name="toApproveTeamAssociation")
    def to_approve_team_association(self) -> "Honeycode":
        '''(experimental) Grants permission to approve a team association request for your AWS Account.

        Access Level: Write

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/team-association.html#approve-team-association

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toApproveTeamAssociation", []))

    @jsii.member(jsii_name="toBatchCreateTableRows")
    def to_batch_create_table_rows(self) -> "Honeycode":
        '''(experimental) Grants permission to create new rows in a table.

        Access Level: Write

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/API_BatchCreateTableRows.html

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toBatchCreateTableRows", []))

    @jsii.member(jsii_name="toBatchDeleteTableRows")
    def to_batch_delete_table_rows(self) -> "Honeycode":
        '''(experimental) Grants permission to delete rows from a table.

        Access Level: Write

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/API_BatchDeleteTableRows.html

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toBatchDeleteTableRows", []))

    @jsii.member(jsii_name="toBatchUpdateTableRows")
    def to_batch_update_table_rows(self) -> "Honeycode":
        '''(experimental) Grants permission to update rows in a table.

        Access Level: Write

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/API_BatchUpdateTableRows.html

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toBatchUpdateTableRows", []))

    @jsii.member(jsii_name="toBatchUpsertTableRows")
    def to_batch_upsert_table_rows(self) -> "Honeycode":
        '''(experimental) Grants permission to upsert rows in a table.

        Access Level: Write

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/API_BatchUpsertTableRows.html

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toBatchUpsertTableRows", []))

    @jsii.member(jsii_name="toCreateTeam")
    def to_create_team(self) -> "Honeycode":
        '''(experimental) Grants permission to create a new Amazon Honeycode team for your AWS Account.

        Access Level: Write

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/team.html#create-team

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toCreateTeam", []))

    @jsii.member(jsii_name="toCreateTenant")
    def to_create_tenant(self) -> "Honeycode":
        '''(experimental) Grants permission to create a new tenant within Amazon Honeycode for your AWS Account.

        Access Level: Write

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/tenant.html#create-tenant

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toCreateTenant", []))

    @jsii.member(jsii_name="toDeregisterGroups")
    def to_deregister_groups(self) -> "Honeycode":
        '''(experimental) Grants permission to remove groups from an Amazon Honeycode team for your AWS Account.

        Access Level: Write

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/group.html#deregister-groups

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toDeregisterGroups", []))

    @jsii.member(jsii_name="toDescribeTableDataImportJob")
    def to_describe_table_data_import_job(self) -> "Honeycode":
        '''(experimental) Grants permission to get details about a table data import job.

        Access Level: Read

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/API_DescribeTableDataImportJob.html

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toDescribeTableDataImportJob", []))

    @jsii.member(jsii_name="toDescribeTeam")
    def to_describe_team(self) -> "Honeycode":
        '''(experimental) Grants permission to get details about Amazon Honeycode teams for your AWS Account.

        Access Level: Read

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/team.html#describe-team

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toDescribeTeam", []))

    @jsii.member(jsii_name="toGetScreenData")
    def to_get_screen_data(self) -> "Honeycode":
        '''(experimental) Grants permission to load the data from a screen.

        Access Level: Read

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/API_GetScreenData.html

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toGetScreenData", []))

    @jsii.member(jsii_name="toInvokeScreenAutomation")
    def to_invoke_screen_automation(self) -> "Honeycode":
        '''(experimental) Grants permission to invoke a screen automation.

        Access Level: Write

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/API_InvokeScreenAutomation.html

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toInvokeScreenAutomation", []))

    @jsii.member(jsii_name="toListDomains")
    def to_list_domains(self) -> "Honeycode":
        '''(experimental) Grants permission to list all Amazon Honeycode domains and their verification status for your AWS Account.

        Access Level: List

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/domain.html#list-domains

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toListDomains", []))

    @jsii.member(jsii_name="toListGroups")
    def to_list_groups(self) -> "Honeycode":
        '''(experimental) Grants permission to list all groups in an Amazon Honeycode team for your AWS Account.

        Access Level: List

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/group.html#list-groups

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toListGroups", []))

    @jsii.member(jsii_name="toListTableColumns")
    def to_list_table_columns(self) -> "Honeycode":
        '''(experimental) Grants permission to list the columns in a table.

        Access Level: List

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/API_ListTableColumns.html

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toListTableColumns", []))

    @jsii.member(jsii_name="toListTableRows")
    def to_list_table_rows(self) -> "Honeycode":
        '''(experimental) Grants permission to list the rows in a table.

        Access Level: List

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/API_ListTableRows.html

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toListTableRows", []))

    @jsii.member(jsii_name="toListTables")
    def to_list_tables(self) -> "Honeycode":
        '''(experimental) Grants permission to list the tables in a workbook.

        Access Level: List

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/API_ListTables.html

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toListTables", []))

    @jsii.member(jsii_name="toListTeamAssociations")
    def to_list_team_associations(self) -> "Honeycode":
        '''(experimental) Grants permission to list all pending and approved team associations with your AWS Account.

        Access Level: List

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/team-association.html#list-team-associations

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toListTeamAssociations", []))

    @jsii.member(jsii_name="toListTenants")
    def to_list_tenants(self) -> "Honeycode":
        '''(experimental) Grants permission to list all tenants of Amazon Honeycode for your AWS Account.

        Access Level: List

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/tenant.html#list-tenants

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toListTenants", []))

    @jsii.member(jsii_name="toQueryTableRows")
    def to_query_table_rows(self) -> "Honeycode":
        '''(experimental) Grants permission to query the rows of a table using a filter.

        Access Level: Read

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/API_QueryTableRows.html

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toQueryTableRows", []))

    @jsii.member(jsii_name="toRegisterDomainForVerification")
    def to_register_domain_for_verification(self) -> "Honeycode":
        '''(experimental) Grants permission to request verification of the Amazon Honeycode domains for your AWS Account.

        Access Level: Write

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/domain.html#register-domain-for-verification

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toRegisterDomainForVerification", []))

    @jsii.member(jsii_name="toRegisterGroups")
    def to_register_groups(self) -> "Honeycode":
        '''(experimental) Grants permission to add groups to an Amazon Honeycode team for your AWS Account.

        Access Level: Write

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/group.html#register-groups

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toRegisterGroups", []))

    @jsii.member(jsii_name="toRejectTeamAssociation")
    def to_reject_team_association(self) -> "Honeycode":
        '''(experimental) Grants permission to reject a team association request for your AWS Account.

        Access Level: Write

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/team-association.html#reject-team-association

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toRejectTeamAssociation", []))

    @jsii.member(jsii_name="toRestartDomainVerification")
    def to_restart_domain_verification(self) -> "Honeycode":
        '''(experimental) Grants permission to restart verification of the Amazon Honeycode domains for your AWS Account.

        Access Level: Write

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/domain.html#restart-domain-verification

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toRestartDomainVerification", []))

    @jsii.member(jsii_name="toStartTableDataImportJob")
    def to_start_table_data_import_job(self) -> "Honeycode":
        '''(experimental) Grants permission to start a table data import job.

        Access Level: Write

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/API_StartTableDataImportJob.html

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toStartTableDataImportJob", []))

    @jsii.member(jsii_name="toUpdateTeam")
    def to_update_team(self) -> "Honeycode":
        '''(experimental) Grants permission to update an Amazon Honeycode team for your AWS Account.

        Access Level: Write

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/team.html#update-team

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toUpdateTeam", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Iam(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Iam"):
    '''(experimental) Statement provider for service `iam <https://docs.aws.amazon.com/service-authorization/latest/reference/list_identityandaccessmanagement.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `iam <https://docs.aws.amazon.com/service-authorization/latest/reference/list_identityandaccessmanagement.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Iam, self, [sid])

    @jsii.member(jsii_name="ifAssociatedResourceArn")
    def if_associated_resource_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iam":
        '''(experimental) Filters by the resource that the role will be used on behalf of.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_AssociatedResourceArn

        Applies to actions:

        - .toPassRole()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "ifAssociatedResourceArn", [value, operator]))

    @jsii.member(jsii_name="ifAWSServiceName")
    def if_aws_service_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iam":
        '''(experimental) Filters access by the AWS service to which this role is attached.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_AWSServiceName

        Applies to actions:

        - .toCreateServiceLinkedRole()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "ifAWSServiceName", [value, operator]))

    @jsii.member(jsii_name="ifOrganizationsPolicyId")
    def if_organizations_policy_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iam":
        '''(experimental) Filters access by the ID of an AWS Organizations policy.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_OrganizationsPolicyId

        Applies to actions:

        - .toGenerateOrganizationsAccessReport()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "ifOrganizationsPolicyId", [value, operator]))

    @jsii.member(jsii_name="ifPassedToService")
    def if_passed_to_service(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iam":
        '''(experimental) Filters access by the AWS service to which this role is passed.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_PassedToService

        Applies to actions:

        - .toPassRole()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "ifPassedToService", [value, operator]))

    @jsii.member(jsii_name="ifPermissionsBoundary")
    def if_permissions_boundary(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iam":
        '''(experimental) Filters access if the specified policy is set as the permissions boundary on the IAM entity (user or role).

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_PermissionsBoundary

        Applies to actions:

        - .toAttachRolePolicy()
        - .toAttachUserPolicy()
        - .toCreateRole()
        - .toCreateUser()
        - .toDeleteRolePermissionsBoundary()
        - .toDeleteRolePolicy()
        - .toDeleteUserPermissionsBoundary()
        - .toDeleteUserPolicy()
        - .toDetachRolePolicy()
        - .toDetachUserPolicy()
        - .toPutRolePermissionsBoundary()
        - .toPutRolePolicy()
        - .toPutUserPermissionsBoundary()
        - .toPutUserPolicy()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "ifPermissionsBoundary", [value, operator]))

    @jsii.member(jsii_name="ifPolicyARN")
    def if_policy_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iam":
        '''(experimental) Filters access by the ARN of an IAM policy.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_PolicyARN

        Applies to actions:

        - .toAttachGroupPolicy()
        - .toAttachRolePolicy()
        - .toAttachUserPolicy()
        - .toDetachGroupPolicy()
        - .toDetachRolePolicy()
        - .toDetachUserPolicy()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "ifPolicyARN", [value, operator]))

    @jsii.member(jsii_name="ifResourceTag")
    def if_resource_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iam":
        '''(experimental) Filters access by the tags attached to an IAM entity (user or role).

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_ResourceTag

        Applies to resource types:

        - role
        - user

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "ifResourceTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="onAccessReport")
    def on_access_report(
        self,
        entity_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iam":
        '''(experimental) Adds a resource of type access-report to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_access-advisor-view-data-orgs.html

        :param entity_path: - Identifier for the entityPath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "onAccessReport", [entity_path, account, partition]))

    @jsii.member(jsii_name="onAssumedRole")
    def on_assumed_role(
        self,
        role_name: builtins.str,
        role_session_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iam":
        '''(experimental) Adds a resource of type assumed-role to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html

        :param role_name: - Identifier for the roleName.
        :param role_session_name: - Identifier for the roleSessionName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "onAssumedRole", [role_name, role_session_name, account, partition]))

    @jsii.member(jsii_name="onFederatedUser")
    def on_federated_user(
        self,
        user_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iam":
        '''(experimental) Adds a resource of type federated-user to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_saml.html

        :param user_name: - Identifier for the userName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "onFederatedUser", [user_name, account, partition]))

    @jsii.member(jsii_name="onGroup")
    def on_group(
        self,
        group_name_with_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iam":
        '''(experimental) Adds a resource of type group to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups.html

        :param group_name_with_path: - Identifier for the groupNameWithPath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "onGroup", [group_name_with_path, account, partition]))

    @jsii.member(jsii_name="onInstanceProfile")
    def on_instance_profile(
        self,
        instance_profile_name_with_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iam":
        '''(experimental) Adds a resource of type instance-profile to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html

        :param instance_profile_name_with_path: - Identifier for the instanceProfileNameWithPath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "onInstanceProfile", [instance_profile_name_with_path, account, partition]))

    @jsii.member(jsii_name="onMfa")
    def on_mfa(
        self,
        mfa_token_id_with_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iam":
        '''(experimental) Adds a resource of type mfa to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html

        :param mfa_token_id_with_path: - Identifier for the mfaTokenIdWithPath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "onMfa", [mfa_token_id_with_path, account, partition]))

    @jsii.member(jsii_name="onOidcProvider")
    def on_oidc_provider(
        self,
        oidc_provider_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iam":
        '''(experimental) Adds a resource of type oidc-provider to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html

        :param oidc_provider_name: - Identifier for the oidcProviderName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "onOidcProvider", [oidc_provider_name, account, partition]))

    @jsii.member(jsii_name="onPolicy")
    def on_policy(
        self,
        policy_name_with_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iam":
        '''(experimental) Adds a resource of type policy to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html

        :param policy_name_with_path: - Identifier for the policyNameWithPath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "onPolicy", [policy_name_with_path, account, partition]))

    @jsii.member(jsii_name="onRole")
    def on_role(
        self,
        role_name_with_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iam":
        '''(experimental) Adds a resource of type role to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html

        :param role_name_with_path: - Identifier for the roleNameWithPath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "onRole", [role_name_with_path, account, partition]))

    @jsii.member(jsii_name="onSamlProvider")
    def on_saml_provider(
        self,
        saml_provider_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iam":
        '''(experimental) Adds a resource of type saml-provider to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_saml.html

        :param saml_provider_name: - Identifier for the samlProviderName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "onSamlProvider", [saml_provider_name, account, partition]))

    @jsii.member(jsii_name="onServerCertificate")
    def on_server_certificate(
        self,
        certificate_name_with_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iam":
        '''(experimental) Adds a resource of type server-certificate to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_server-certs.html

        :param certificate_name_with_path: - Identifier for the certificateNameWithPath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "onServerCertificate", [certificate_name_with_path, account, partition]))

    @jsii.member(jsii_name="onSmsMfa")
    def on_sms_mfa(
        self,
        mfa_token_id_with_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iam":
        '''(experimental) Adds a resource of type sms-mfa to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_sms.html

        :param mfa_token_id_with_path: - Identifier for the mfaTokenIdWithPath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "onSmsMfa", [mfa_token_id_with_path, account, partition]))

    @jsii.member(jsii_name="onUser")
    def on_user(
        self,
        user_name_with_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iam":
        '''(experimental) Adds a resource of type user to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users.html

        :param user_name_with_path: - Identifier for the userNameWithPath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "onUser", [user_name_with_path, account, partition]))

    @jsii.member(jsii_name="toAddClientIDToOpenIDConnectProvider")
    def to_add_client_id_to_open_id_connect_provider(self) -> "Iam":
        '''(experimental) Grants permission to add a new client ID (audience) to the list of registered IDs for the specified IAM OpenID Connect (OIDC) provider resource.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_AddClientIDToOpenIDConnectProvider.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toAddClientIDToOpenIDConnectProvider", []))

    @jsii.member(jsii_name="toAddRoleToInstanceProfile")
    def to_add_role_to_instance_profile(self) -> "Iam":
        '''(experimental) Grants permission to add an IAM role to the specified instance profile.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_AddRoleToInstanceProfile.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toAddRoleToInstanceProfile", []))

    @jsii.member(jsii_name="toAddUserToGroup")
    def to_add_user_to_group(self) -> "Iam":
        '''(experimental) Grants permission to add an IAM user to the specified IAM group.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_AddUserToGroup.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toAddUserToGroup", []))

    @jsii.member(jsii_name="toAttachGroupPolicy")
    def to_attach_group_policy(self) -> "Iam":
        '''(experimental) Grants permission to attach a managed policy to the specified IAM group.

        Access Level: Permissions management

        Possible conditions:

        - .ifPolicyARN()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_AttachGroupPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toAttachGroupPolicy", []))

    @jsii.member(jsii_name="toAttachRolePolicy")
    def to_attach_role_policy(self) -> "Iam":
        '''(experimental) Grants permission to attach a managed policy to the specified IAM role.

        Access Level: Permissions management

        Possible conditions:

        - .ifPolicyARN()
        - .ifPermissionsBoundary()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_AttachRolePolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toAttachRolePolicy", []))

    @jsii.member(jsii_name="toAttachUserPolicy")
    def to_attach_user_policy(self) -> "Iam":
        '''(experimental) Grants permission to attach a managed policy to the specified IAM user.

        Access Level: Permissions management

        Possible conditions:

        - .ifPolicyARN()
        - .ifPermissionsBoundary()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_AttachUserPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toAttachUserPolicy", []))

    @jsii.member(jsii_name="toChangePassword")
    def to_change_password(self) -> "Iam":
        '''(experimental) Grants permission for an IAM user to to change their own password.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ChangePassword.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toChangePassword", []))

    @jsii.member(jsii_name="toCreateAccessKey")
    def to_create_access_key(self) -> "Iam":
        '''(experimental) Grants permission to create access key and secret access key for the specified IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateAccessKey.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toCreateAccessKey", []))

    @jsii.member(jsii_name="toCreateAccountAlias")
    def to_create_account_alias(self) -> "Iam":
        '''(experimental) Grants permission to create an alias for your AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateAccountAlias.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toCreateAccountAlias", []))

    @jsii.member(jsii_name="toCreateGroup")
    def to_create_group(self) -> "Iam":
        '''(experimental) Grants permission to create a new group.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateGroup.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toCreateGroup", []))

    @jsii.member(jsii_name="toCreateInstanceProfile")
    def to_create_instance_profile(self) -> "Iam":
        '''(experimental) Grants permission to create a new instance profile.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateInstanceProfile.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toCreateInstanceProfile", []))

    @jsii.member(jsii_name="toCreateLoginProfile")
    def to_create_login_profile(self) -> "Iam":
        '''(experimental) Grants permission to create a password for the specified IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateLoginProfile.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toCreateLoginProfile", []))

    @jsii.member(jsii_name="toCreateOpenIDConnectProvider")
    def to_create_open_id_connect_provider(self) -> "Iam":
        '''(experimental) Grants permission to create an IAM resource that describes an identity provider (IdP) that supports OpenID Connect (OIDC).

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateOpenIDConnectProvider.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toCreateOpenIDConnectProvider", []))

    @jsii.member(jsii_name="toCreatePolicy")
    def to_create_policy(self) -> "Iam":
        '''(experimental) Grants permission to create a new managed policy.

        Access Level: Permissions management

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreatePolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toCreatePolicy", []))

    @jsii.member(jsii_name="toCreatePolicyVersion")
    def to_create_policy_version(self) -> "Iam":
        '''(experimental) Grants permission to create a new version of the specified managed policy.

        Access Level: Permissions management

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreatePolicyVersion.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toCreatePolicyVersion", []))

    @jsii.member(jsii_name="toCreateRole")
    def to_create_role(self) -> "Iam":
        '''(experimental) Grants permission to create a new role.

        Access Level: Write

        Possible conditions:

        - .ifPermissionsBoundary()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateRole.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toCreateRole", []))

    @jsii.member(jsii_name="toCreateSAMLProvider")
    def to_create_saml_provider(self) -> "Iam":
        '''(experimental) Grants permission to create an IAM resource that describes an identity provider (IdP) that supports SAML 2.0.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateSAMLProvider.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toCreateSAMLProvider", []))

    @jsii.member(jsii_name="toCreateServiceLinkedRole")
    def to_create_service_linked_role(self) -> "Iam":
        '''(experimental) Grants permission to create an IAM role that allows an AWS service to perform actions on your behalf.

        Access Level: Write

        Possible conditions:

        - .ifAWSServiceName()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateServiceLinkedRole.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toCreateServiceLinkedRole", []))

    @jsii.member(jsii_name="toCreateServiceSpecificCredential")
    def to_create_service_specific_credential(self) -> "Iam":
        '''(experimental) Grants permission to create a new service-specific credential for an IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateServiceSpecificCredential.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toCreateServiceSpecificCredential", []))

    @jsii.member(jsii_name="toCreateUser")
    def to_create_user(self) -> "Iam":
        '''(experimental) Grants permission to create a new IAM user.

        Access Level: Write

        Possible conditions:

        - .ifPermissionsBoundary()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateUser.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toCreateUser", []))

    @jsii.member(jsii_name="toCreateVirtualMFADevice")
    def to_create_virtual_mfa_device(self) -> "Iam":
        '''(experimental) Grants permission to create a new virtual MFA device.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateVirtualMFADevice.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toCreateVirtualMFADevice", []))

    @jsii.member(jsii_name="toDeactivateMFADevice")
    def to_deactivate_mfa_device(self) -> "Iam":
        '''(experimental) Grants permission to deactivate the specified MFA device and remove its association with the IAM user for which it was originally enabled.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeactivateMFADevice.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeactivateMFADevice", []))

    @jsii.member(jsii_name="toDeleteAccessKey")
    def to_delete_access_key(self) -> "Iam":
        '''(experimental) Grants permission to delete the access key pair that is associated with the specified IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteAccessKey.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteAccessKey", []))

    @jsii.member(jsii_name="toDeleteAccountAlias")
    def to_delete_account_alias(self) -> "Iam":
        '''(experimental) Grants permission to delete the specified AWS account alias.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteAccountAlias.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteAccountAlias", []))

    @jsii.member(jsii_name="toDeleteAccountPasswordPolicy")
    def to_delete_account_password_policy(self) -> "Iam":
        '''(experimental) Grants permission to delete the password policy for the AWS account.

        Access Level: Permissions management

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteAccountPasswordPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteAccountPasswordPolicy", []))

    @jsii.member(jsii_name="toDeleteGroup")
    def to_delete_group(self) -> "Iam":
        '''(experimental) Grants permission to delete the specified IAM group.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroup.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteGroup", []))

    @jsii.member(jsii_name="toDeleteGroupPolicy")
    def to_delete_group_policy(self) -> "Iam":
        '''(experimental) Grants permission to delete the specified inline policy from its group.

        Access Level: Permissions management

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroupPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteGroupPolicy", []))

    @jsii.member(jsii_name="toDeleteInstanceProfile")
    def to_delete_instance_profile(self) -> "Iam":
        '''(experimental) Grants permission to delete the specified instance profile.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteInstanceProfile.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteInstanceProfile", []))

    @jsii.member(jsii_name="toDeleteLoginProfile")
    def to_delete_login_profile(self) -> "Iam":
        '''(experimental) Grants permission to delete the password for the specified IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteLoginProfile.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteLoginProfile", []))

    @jsii.member(jsii_name="toDeleteOpenIDConnectProvider")
    def to_delete_open_id_connect_provider(self) -> "Iam":
        '''(experimental) Grants permission to delete an OpenID Connect identity provider (IdP) resource object in IAM.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteOpenIDConnectProvider.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteOpenIDConnectProvider", []))

    @jsii.member(jsii_name="toDeletePolicy")
    def to_delete_policy(self) -> "Iam":
        '''(experimental) Grants permission to delete the specified managed policy and remove it from any IAM entities (users, groups, or roles) to which it is attached.

        Access Level: Permissions management

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeletePolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeletePolicy", []))

    @jsii.member(jsii_name="toDeletePolicyVersion")
    def to_delete_policy_version(self) -> "Iam":
        '''(experimental) Grants permission to delete a version from the specified managed policy.

        Access Level: Permissions management

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeletePolicyVersion.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeletePolicyVersion", []))

    @jsii.member(jsii_name="toDeleteRole")
    def to_delete_role(self) -> "Iam":
        '''(experimental) Grants permission to delete the specified role.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteRole.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteRole", []))

    @jsii.member(jsii_name="toDeleteRolePermissionsBoundary")
    def to_delete_role_permissions_boundary(self) -> "Iam":
        '''(experimental) Grants permission to remove the permissions boundary from a role.

        Access Level: Permissions management

        Possible conditions:

        - .ifPermissionsBoundary()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteRolePermissionsBoundary.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteRolePermissionsBoundary", []))

    @jsii.member(jsii_name="toDeleteRolePolicy")
    def to_delete_role_policy(self) -> "Iam":
        '''(experimental) Grants permission to delete the specified inline policy from the specified role.

        Access Level: Permissions management

        Possible conditions:

        - .ifPermissionsBoundary()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteRolePolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteRolePolicy", []))

    @jsii.member(jsii_name="toDeleteSAMLProvider")
    def to_delete_saml_provider(self) -> "Iam":
        '''(experimental) Grants permission to delete a SAML provider resource in IAM.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteSAMLProvider.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteSAMLProvider", []))

    @jsii.member(jsii_name="toDeleteServerCertificate")
    def to_delete_server_certificate(self) -> "Iam":
        '''(experimental) Grants permission to delete the specified server certificate.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteServerCertificate.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteServerCertificate", []))

    @jsii.member(jsii_name="toDeleteServiceLinkedRole")
    def to_delete_service_linked_role(self) -> "Iam":
        '''(experimental) Grants permission to delete an IAM role that is linked to a specific AWS service, if the service is no longer using it.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteServiceLinkedRole.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteServiceLinkedRole", []))

    @jsii.member(jsii_name="toDeleteServiceSpecificCredential")
    def to_delete_service_specific_credential(self) -> "Iam":
        '''(experimental) Grants permission to delete the specified service-specific credential for an IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteServiceSpecificCredential.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteServiceSpecificCredential", []))

    @jsii.member(jsii_name="toDeleteSigningCertificate")
    def to_delete_signing_certificate(self) -> "Iam":
        '''(experimental) Grants permission to delete a signing certificate that is associated with the specified IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteSigningCertificate.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteSigningCertificate", []))

    @jsii.member(jsii_name="toDeleteSSHPublicKey")
    def to_delete_ssh_public_key(self) -> "Iam":
        '''(experimental) Grants permission to delete the specified SSH public key.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteSSHPublicKey.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteSSHPublicKey", []))

    @jsii.member(jsii_name="toDeleteUser")
    def to_delete_user(self) -> "Iam":
        '''(experimental) Grants permission to delete the specified IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteUser.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteUser", []))

    @jsii.member(jsii_name="toDeleteUserPermissionsBoundary")
    def to_delete_user_permissions_boundary(self) -> "Iam":
        '''(experimental) Grants permission to remove the permissions boundary from the specified IAM user.

        Access Level: Permissions management

        Possible conditions:

        - .ifPermissionsBoundary()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteUserPermissionsBoundary.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteUserPermissionsBoundary", []))

    @jsii.member(jsii_name="toDeleteUserPolicy")
    def to_delete_user_policy(self) -> "Iam":
        '''(experimental) Grants permission to delete the specified inline policy from an IAM user.

        Access Level: Permissions management

        Possible conditions:

        - .ifPermissionsBoundary()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteUserPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteUserPolicy", []))

    @jsii.member(jsii_name="toDeleteVirtualMFADevice")
    def to_delete_virtual_mfa_device(self) -> "Iam":
        '''(experimental) Grants permission to delete a virtual MFA device.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteVirtualMFADevice.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteVirtualMFADevice", []))

    @jsii.member(jsii_name="toDetachGroupPolicy")
    def to_detach_group_policy(self) -> "Iam":
        '''(experimental) Grants permission to detach a managed policy from the specified IAM group.

        Access Level: Permissions management

        Possible conditions:

        - .ifPolicyARN()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DetachGroupPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDetachGroupPolicy", []))

    @jsii.member(jsii_name="toDetachRolePolicy")
    def to_detach_role_policy(self) -> "Iam":
        '''(experimental) Grants permission to detach a managed policy from the specified role.

        Access Level: Permissions management

        Possible conditions:

        - .ifPolicyARN()
        - .ifPermissionsBoundary()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DetachRolePolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDetachRolePolicy", []))

    @jsii.member(jsii_name="toDetachUserPolicy")
    def to_detach_user_policy(self) -> "Iam":
        '''(experimental) Grants permission to detach a managed policy from the specified IAM user.

        Access Level: Permissions management

        Possible conditions:

        - .ifPolicyARN()
        - .ifPermissionsBoundary()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DetachUserPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDetachUserPolicy", []))

    @jsii.member(jsii_name="toEnableMFADevice")
    def to_enable_mfa_device(self) -> "Iam":
        '''(experimental) Grants permission to enable an MFA device and associate it with the specified IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_EnableMFADevice.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toEnableMFADevice", []))

    @jsii.member(jsii_name="toGenerateCredentialReport")
    def to_generate_credential_report(self) -> "Iam":
        '''(experimental) Grants permission to generate a credential report for the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GenerateCredentialReport.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGenerateCredentialReport", []))

    @jsii.member(jsii_name="toGenerateOrganizationsAccessReport")
    def to_generate_organizations_access_report(self) -> "Iam":
        '''(experimental) Grants permission to generate an access report for an AWS Organizations entity.

        Access Level: Read

        Possible conditions:

        - .ifOrganizationsPolicyId()

        Dependent actions:

        - organizations:DescribePolicy
        - organizations:ListChildren
        - organizations:ListParents
        - organizations:ListPoliciesForTarget
        - organizations:ListRoots
        - organizations:ListTargetsForPolicy

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GenerateOrganizationsAccessReport.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGenerateOrganizationsAccessReport", []))

    @jsii.member(jsii_name="toGenerateServiceLastAccessedDetails")
    def to_generate_service_last_accessed_details(self) -> "Iam":
        '''(experimental) Grants permission to generate a service last accessed data report for an IAM resource.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GenerateServiceLastAccessedDetails.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGenerateServiceLastAccessedDetails", []))

    @jsii.member(jsii_name="toGetAccessKeyLastUsed")
    def to_get_access_key_last_used(self) -> "Iam":
        '''(experimental) Grants permission to retrieve information about when the specified access key was last used.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetAccessKeyLastUsed.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetAccessKeyLastUsed", []))

    @jsii.member(jsii_name="toGetAccountAuthorizationDetails")
    def to_get_account_authorization_details(self) -> "Iam":
        '''(experimental) Grants permission to retrieve information about all IAM users, groups, roles, and policies in your AWS account, including their relationships to one another.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetAccountAuthorizationDetails.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetAccountAuthorizationDetails", []))

    @jsii.member(jsii_name="toGetAccountPasswordPolicy")
    def to_get_account_password_policy(self) -> "Iam":
        '''(experimental) Grants permission to retrieve the password policy for the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetAccountPasswordPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetAccountPasswordPolicy", []))

    @jsii.member(jsii_name="toGetAccountSummary")
    def to_get_account_summary(self) -> "Iam":
        '''(experimental) Grants permission to retrieve information about IAM entity usage and IAM quotas in the AWS account.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetAccountSummary.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetAccountSummary", []))

    @jsii.member(jsii_name="toGetContextKeysForCustomPolicy")
    def to_get_context_keys_for_custom_policy(self) -> "Iam":
        '''(experimental) Grants permission to retrieve a list of all of the context keys that are referenced in the specified policy.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetContextKeysForCustomPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetContextKeysForCustomPolicy", []))

    @jsii.member(jsii_name="toGetContextKeysForPrincipalPolicy")
    def to_get_context_keys_for_principal_policy(self) -> "Iam":
        '''(experimental) Grants permission to retrieve a list of all context keys that are referenced in all IAM policies that are attached to the specified IAM identity (user, group, or role).

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetContextKeysForPrincipalPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetContextKeysForPrincipalPolicy", []))

    @jsii.member(jsii_name="toGetCredentialReport")
    def to_get_credential_report(self) -> "Iam":
        '''(experimental) Grants permission to retrieve a credential report for the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetCredentialReport.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetCredentialReport", []))

    @jsii.member(jsii_name="toGetGroup")
    def to_get_group(self) -> "Iam":
        '''(experimental) Grants permission to retrieve a list of IAM users in the specified IAM group.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetGroup.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetGroup", []))

    @jsii.member(jsii_name="toGetGroupPolicy")
    def to_get_group_policy(self) -> "Iam":
        '''(experimental) Grants permission to retrieve an inline policy document that is embedded in the specified IAM group.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetGroupPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetGroupPolicy", []))

    @jsii.member(jsii_name="toGetInstanceProfile")
    def to_get_instance_profile(self) -> "Iam":
        '''(experimental) Grants permission to retrieve information about the specified instance profile, including the instance profile's path, GUID, ARN, and role.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetInstanceProfile.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetInstanceProfile", []))

    @jsii.member(jsii_name="toGetLoginProfile")
    def to_get_login_profile(self) -> "Iam":
        '''(experimental) Grants permission to retrieve the user name and password creation date for the specified IAM user.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetLoginProfile.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetLoginProfile", []))

    @jsii.member(jsii_name="toGetOpenIDConnectProvider")
    def to_get_open_id_connect_provider(self) -> "Iam":
        '''(experimental) Grants permission to retrieve information about the specified OpenID Connect (OIDC) provider resource in IAM.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetOpenIDConnectProvider.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetOpenIDConnectProvider", []))

    @jsii.member(jsii_name="toGetOrganizationsAccessReport")
    def to_get_organizations_access_report(self) -> "Iam":
        '''(experimental) Grants permission to retrieve an AWS Organizations access report.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetOrganizationsAccessReport.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetOrganizationsAccessReport", []))

    @jsii.member(jsii_name="toGetPolicy")
    def to_get_policy(self) -> "Iam":
        '''(experimental) Grants permission to retrieve information about the specified managed policy, including the policy's default version and the total number of identities to which the policy is attached.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetPolicy", []))

    @jsii.member(jsii_name="toGetPolicyVersion")
    def to_get_policy_version(self) -> "Iam":
        '''(experimental) Grants permission to retrieve information about a version of the specified managed policy, including the policy document.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetPolicyVersion.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetPolicyVersion", []))

    @jsii.member(jsii_name="toGetRole")
    def to_get_role(self) -> "Iam":
        '''(experimental) Grants permission to retrieve information about the specified role, including the role's path, GUID, ARN, and the role's trust policy.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetRole.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetRole", []))

    @jsii.member(jsii_name="toGetRolePolicy")
    def to_get_role_policy(self) -> "Iam":
        '''(experimental) Grants permission to retrieve an inline policy document that is embedded with the specified IAM role.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetRolePolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetRolePolicy", []))

    @jsii.member(jsii_name="toGetSAMLProvider")
    def to_get_saml_provider(self) -> "Iam":
        '''(experimental) Grants permission to retrieve the SAML provider metadocument that was uploaded when the IAM SAML provider resource was created or updated.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetSAMLProvider.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetSAMLProvider", []))

    @jsii.member(jsii_name="toGetServerCertificate")
    def to_get_server_certificate(self) -> "Iam":
        '''(experimental) Grants permission to retrieve information about the specified server certificate stored in IAM.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetServerCertificate.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetServerCertificate", []))

    @jsii.member(jsii_name="toGetServiceLastAccessedDetails")
    def to_get_service_last_accessed_details(self) -> "Iam":
        '''(experimental) Grants permission to retrieve information about the service last accessed data report.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetServiceLastAccessedDetails.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetServiceLastAccessedDetails", []))

    @jsii.member(jsii_name="toGetServiceLastAccessedDetailsWithEntities")
    def to_get_service_last_accessed_details_with_entities(self) -> "Iam":
        '''(experimental) Grants permission to retrieve information about the entities from the service last accessed data report.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetServiceLastAccessedDetailsWithEntities.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetServiceLastAccessedDetailsWithEntities", []))

    @jsii.member(jsii_name="toGetServiceLinkedRoleDeletionStatus")
    def to_get_service_linked_role_deletion_status(self) -> "Iam":
        '''(experimental) Grants permission to retrieve an IAM service-linked role deletion status.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetServiceLinkedRoleDeletionStatus.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetServiceLinkedRoleDeletionStatus", []))

    @jsii.member(jsii_name="toGetSSHPublicKey")
    def to_get_ssh_public_key(self) -> "Iam":
        '''(experimental) Grants permission to retrieve the specified SSH public key, including metadata about the key.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetSSHPublicKey.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetSSHPublicKey", []))

    @jsii.member(jsii_name="toGetUser")
    def to_get_user(self) -> "Iam":
        '''(experimental) Grants permission to retrieve information about the specified IAM user, including the user's creation date, path, unique ID, and ARN.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetUser.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetUser", []))

    @jsii.member(jsii_name="toGetUserPolicy")
    def to_get_user_policy(self) -> "Iam":
        '''(experimental) Grants permission to retrieve an inline policy document that is embedded in the specified IAM user.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetUserPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetUserPolicy", []))

    @jsii.member(jsii_name="toListAccessKeys")
    def to_list_access_keys(self) -> "Iam":
        '''(experimental) Grants permission to list information about the access key IDs that are associated with the specified IAM user.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAccessKeys.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListAccessKeys", []))

    @jsii.member(jsii_name="toListAccountAliases")
    def to_list_account_aliases(self) -> "Iam":
        '''(experimental) Grants permission to list the account alias that is associated with the AWS account.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAccountAliases.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListAccountAliases", []))

    @jsii.member(jsii_name="toListAttachedGroupPolicies")
    def to_list_attached_group_policies(self) -> "Iam":
        '''(experimental) Grants permission to list all managed policies that are attached to the specified IAM group.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAttachedGroupPolicies.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListAttachedGroupPolicies", []))

    @jsii.member(jsii_name="toListAttachedRolePolicies")
    def to_list_attached_role_policies(self) -> "Iam":
        '''(experimental) Grants permission to list all managed policies that are attached to the specified IAM role.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAttachedRolePolicies.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListAttachedRolePolicies", []))

    @jsii.member(jsii_name="toListAttachedUserPolicies")
    def to_list_attached_user_policies(self) -> "Iam":
        '''(experimental) Grants permission to list all managed policies that are attached to the specified IAM user.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAttachedUserPolicies.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListAttachedUserPolicies", []))

    @jsii.member(jsii_name="toListEntitiesForPolicy")
    def to_list_entities_for_policy(self) -> "Iam":
        '''(experimental) Grants permission to list all IAM identities to which the specified managed policy is attached.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListEntitiesForPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListEntitiesForPolicy", []))

    @jsii.member(jsii_name="toListGroupPolicies")
    def to_list_group_policies(self) -> "Iam":
        '''(experimental) Grants permission to list the names of the inline policies that are embedded in the specified IAM group.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListGroupPolicies.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListGroupPolicies", []))

    @jsii.member(jsii_name="toListGroups")
    def to_list_groups(self) -> "Iam":
        '''(experimental) Grants permission to list the IAM groups that have the specified path prefix.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListGroups.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListGroups", []))

    @jsii.member(jsii_name="toListGroupsForUser")
    def to_list_groups_for_user(self) -> "Iam":
        '''(experimental) Grants permission to list the IAM groups that the specified IAM user belongs to.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListGroupsForUser.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListGroupsForUser", []))

    @jsii.member(jsii_name="toListInstanceProfiles")
    def to_list_instance_profiles(self) -> "Iam":
        '''(experimental) Grants permission to list the instance profiles that have the specified path prefix.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListInstanceProfiles.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListInstanceProfiles", []))

    @jsii.member(jsii_name="toListInstanceProfilesForRole")
    def to_list_instance_profiles_for_role(self) -> "Iam":
        '''(experimental) Grants permission to list the instance profiles that have the specified associated IAM role.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListInstanceProfilesForRole.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListInstanceProfilesForRole", []))

    @jsii.member(jsii_name="toListInstanceProfileTags")
    def to_list_instance_profile_tags(self) -> "Iam":
        '''(experimental) Grants permission to list the tags that are attached to the specified instance profile.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListInstanceProfileTags.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListInstanceProfileTags", []))

    @jsii.member(jsii_name="toListMFADevices")
    def to_list_mfa_devices(self) -> "Iam":
        '''(experimental) Grants permission to list the MFA devices for an IAM user.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListMFADevices.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListMFADevices", []))

    @jsii.member(jsii_name="toListMFADeviceTags")
    def to_list_mfa_device_tags(self) -> "Iam":
        '''(experimental) Grants permission to list the tags that are attached to the specified virtual mfa device.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListMFADeviceTags.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListMFADeviceTags", []))

    @jsii.member(jsii_name="toListOpenIDConnectProviders")
    def to_list_open_id_connect_providers(self) -> "Iam":
        '''(experimental) Grants permission to list information about the IAM OpenID Connect (OIDC) provider resource objects that are defined in the AWS account.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListOpenIDConnectProviders.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListOpenIDConnectProviders", []))

    @jsii.member(jsii_name="toListOpenIDConnectProviderTags")
    def to_list_open_id_connect_provider_tags(self) -> "Iam":
        '''(experimental) Grants permission to list the tags that are attached to the specified OpenID Connect provider.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListOpenIDConnectProviderTags.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListOpenIDConnectProviderTags", []))

    @jsii.member(jsii_name="toListPolicies")
    def to_list_policies(self) -> "Iam":
        '''(experimental) Grants permission to list all managed policies.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListPolicies.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListPolicies", []))

    @jsii.member(jsii_name="toListPoliciesGrantingServiceAccess")
    def to_list_policies_granting_service_access(self) -> "Iam":
        '''(experimental) Grants permission to list information about the policies that grant an entity access to a specific service.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListPoliciesGrantingServiceAccess.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListPoliciesGrantingServiceAccess", []))

    @jsii.member(jsii_name="toListPolicyTags")
    def to_list_policy_tags(self) -> "Iam":
        '''(experimental) Grants permission to list the tags that are attached to the specified managed policy.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListPolicyTags.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListPolicyTags", []))

    @jsii.member(jsii_name="toListPolicyVersions")
    def to_list_policy_versions(self) -> "Iam":
        '''(experimental) Grants permission to list information about the versions of the specified managed policy, including the version that is currently set as the policy's default version.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListPolicyVersions.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListPolicyVersions", []))

    @jsii.member(jsii_name="toListRolePolicies")
    def to_list_role_policies(self) -> "Iam":
        '''(experimental) Grants permission to list the names of the inline policies that are embedded in the specified IAM role.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListRolePolicies.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListRolePolicies", []))

    @jsii.member(jsii_name="toListRoles")
    def to_list_roles(self) -> "Iam":
        '''(experimental) Grants permission to list the IAM roles that have the specified path prefix.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListRoles.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListRoles", []))

    @jsii.member(jsii_name="toListRoleTags")
    def to_list_role_tags(self) -> "Iam":
        '''(experimental) Grants permission to list the tags that are attached to the specified IAM role.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListRoleTags.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListRoleTags", []))

    @jsii.member(jsii_name="toListSAMLProviders")
    def to_list_saml_providers(self) -> "Iam":
        '''(experimental) Grants permission to list the SAML provider resources in IAM.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListSAMLProviders.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListSAMLProviders", []))

    @jsii.member(jsii_name="toListSAMLProviderTags")
    def to_list_saml_provider_tags(self) -> "Iam":
        '''(experimental) Grants permission to list the tags that are attached to the specified SAML provider.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListSAMLProviderTags.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListSAMLProviderTags", []))

    @jsii.member(jsii_name="toListServerCertificates")
    def to_list_server_certificates(self) -> "Iam":
        '''(experimental) Grants permission to list the server certificates that have the specified path prefix.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListServerCertificates.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListServerCertificates", []))

    @jsii.member(jsii_name="toListServerCertificateTags")
    def to_list_server_certificate_tags(self) -> "Iam":
        '''(experimental) Grants permission to list the tags that are attached to the specified server certificate.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListServerCertificateTags.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListServerCertificateTags", []))

    @jsii.member(jsii_name="toListServiceSpecificCredentials")
    def to_list_service_specific_credentials(self) -> "Iam":
        '''(experimental) Grants permission to list the service-specific credentials that are associated with the specified IAM user.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListServiceSpecificCredentials.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListServiceSpecificCredentials", []))

    @jsii.member(jsii_name="toListSigningCertificates")
    def to_list_signing_certificates(self) -> "Iam":
        '''(experimental) Grants permission to list information about the signing certificates that are associated with the specified IAM user.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListSigningCertificates.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListSigningCertificates", []))

    @jsii.member(jsii_name="toListSSHPublicKeys")
    def to_list_ssh_public_keys(self) -> "Iam":
        '''(experimental) Grants permission to list information about the SSH public keys that are associated with the specified IAM user.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListSSHPublicKeys.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListSSHPublicKeys", []))

    @jsii.member(jsii_name="toListUserPolicies")
    def to_list_user_policies(self) -> "Iam":
        '''(experimental) Grants permission to list the names of the inline policies that are embedded in the specified IAM user.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListUserPolicies.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListUserPolicies", []))

    @jsii.member(jsii_name="toListUsers")
    def to_list_users(self) -> "Iam":
        '''(experimental) Grants permission to list the IAM users that have the specified path prefix.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListUsers.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListUsers", []))

    @jsii.member(jsii_name="toListUserTags")
    def to_list_user_tags(self) -> "Iam":
        '''(experimental) Grants permission to list the tags that are attached to the specified IAM user.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListUserTags.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListUserTags", []))

    @jsii.member(jsii_name="toListVirtualMFADevices")
    def to_list_virtual_mfa_devices(self) -> "Iam":
        '''(experimental) Grants permission to list virtual MFA devices by assignment status.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListVirtualMFADevices.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListVirtualMFADevices", []))

    @jsii.member(jsii_name="toPassRole")
    def to_pass_role(self) -> "Iam":
        '''(experimental) Grants permission to pass a role to a service.

        Access Level: Write

        Possible conditions:

        - .ifAssociatedResourceArn()
        - .ifPassedToService()

        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toPassRole", []))

    @jsii.member(jsii_name="toPutGroupPolicy")
    def to_put_group_policy(self) -> "Iam":
        '''(experimental) Grants permission to create or update an inline policy document that is embedded in the specified IAM group.

        Access Level: Permissions management

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_PutGroupPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toPutGroupPolicy", []))

    @jsii.member(jsii_name="toPutRolePermissionsBoundary")
    def to_put_role_permissions_boundary(self) -> "Iam":
        '''(experimental) Grants permission to set a managed policy as a permissions boundary for a role.

        Access Level: Permissions management

        Possible conditions:

        - .ifPermissionsBoundary()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_PutRolePermissionsBoundary.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toPutRolePermissionsBoundary", []))

    @jsii.member(jsii_name="toPutRolePolicy")
    def to_put_role_policy(self) -> "Iam":
        '''(experimental) Grants permission to create or update an inline policy document that is embedded in the specified IAM role.

        Access Level: Permissions management

        Possible conditions:

        - .ifPermissionsBoundary()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_PutRolePolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toPutRolePolicy", []))

    @jsii.member(jsii_name="toPutUserPermissionsBoundary")
    def to_put_user_permissions_boundary(self) -> "Iam":
        '''(experimental) Grants permission to set a managed policy as a permissions boundary for an IAM user.

        Access Level: Permissions management

        Possible conditions:

        - .ifPermissionsBoundary()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_PutUserPermissionsBoundary.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toPutUserPermissionsBoundary", []))

    @jsii.member(jsii_name="toPutUserPolicy")
    def to_put_user_policy(self) -> "Iam":
        '''(experimental) Grants permission to create or update an inline policy document that is embedded in the specified IAM user.

        Access Level: Permissions management

        Possible conditions:

        - .ifPermissionsBoundary()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_PutUserPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toPutUserPolicy", []))

    @jsii.member(jsii_name="toRemoveClientIDFromOpenIDConnectProvider")
    def to_remove_client_id_from_open_id_connect_provider(self) -> "Iam":
        '''(experimental) Grants permission to remove the client ID (audience) from the list of client IDs in the specified IAM OpenID Connect (OIDC) provider resource.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_RemoveClientIDFromOpenIDConnectProvider.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toRemoveClientIDFromOpenIDConnectProvider", []))

    @jsii.member(jsii_name="toRemoveRoleFromInstanceProfile")
    def to_remove_role_from_instance_profile(self) -> "Iam":
        '''(experimental) Grants permission to remove an IAM role from the specified EC2 instance profile.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_RemoveRoleFromInstanceProfile.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toRemoveRoleFromInstanceProfile", []))

    @jsii.member(jsii_name="toRemoveUserFromGroup")
    def to_remove_user_from_group(self) -> "Iam":
        '''(experimental) Grants permission to remove an IAM user from the specified group.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_RemoveUserFromGroup.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toRemoveUserFromGroup", []))

    @jsii.member(jsii_name="toResetServiceSpecificCredential")
    def to_reset_service_specific_credential(self) -> "Iam":
        '''(experimental) Grants permission to reset the password for an existing service-specific credential for an IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ResetServiceSpecificCredential.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toResetServiceSpecificCredential", []))

    @jsii.member(jsii_name="toResyncMFADevice")
    def to_resync_mfa_device(self) -> "Iam":
        '''(experimental) Grants permission to synchronize the specified MFA device with its IAM entity (user or role).

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ResyncMFADevice.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toResyncMFADevice", []))

    @jsii.member(jsii_name="toSetDefaultPolicyVersion")
    def to_set_default_policy_version(self) -> "Iam":
        '''(experimental) Grants permission to set the version of the specified policy as the policy's default version.

        Access Level: Permissions management

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_SetDefaultPolicyVersion.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toSetDefaultPolicyVersion", []))

    @jsii.member(jsii_name="toSetSecurityTokenServicePreferences")
    def to_set_security_token_service_preferences(self) -> "Iam":
        '''(experimental) Grants permission to set the STS global endpoint token version.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_SetSecurityTokenServicePreferences.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toSetSecurityTokenServicePreferences", []))

    @jsii.member(jsii_name="toSimulateCustomPolicy")
    def to_simulate_custom_policy(self) -> "Iam":
        '''(experimental) Grants permission to simulate whether an identity-based policy or resource-based policy provides permissions for specific API operations and resources.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_SimulateCustomPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toSimulateCustomPolicy", []))

    @jsii.member(jsii_name="toSimulatePrincipalPolicy")
    def to_simulate_principal_policy(self) -> "Iam":
        '''(experimental) Grants permission to simulate whether an identity-based policy that is attached to a specified IAM entity (user or role) provides permissions for specific API operations and resources.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_SimulatePrincipalPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toSimulatePrincipalPolicy", []))

    @jsii.member(jsii_name="toTagInstanceProfile")
    def to_tag_instance_profile(self) -> "Iam":
        '''(experimental) Grants permission to add tags to an instance profile.

        Access Level: Tagging

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_TagInstanceProfile.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toTagInstanceProfile", []))

    @jsii.member(jsii_name="toTagMFADevice")
    def to_tag_mfa_device(self) -> "Iam":
        '''(experimental) Grants permission to add tags to a virtual mfa device.

        Access Level: Tagging

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_TagMFADevice.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toTagMFADevice", []))

    @jsii.member(jsii_name="toTagOpenIDConnectProvider")
    def to_tag_open_id_connect_provider(self) -> "Iam":
        '''(experimental) Grants permission to add tags to an OpenID Connect provider.

        Access Level: Tagging

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_TagOpenIDConnectProvider.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toTagOpenIDConnectProvider", []))

    @jsii.member(jsii_name="toTagPolicy")
    def to_tag_policy(self) -> "Iam":
        '''(experimental) Grants permission to add tags to a managed policy.

        Access Level: Tagging

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_TagPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toTagPolicy", []))

    @jsii.member(jsii_name="toTagRole")
    def to_tag_role(self) -> "Iam":
        '''(experimental) Grants permission to add tags to an IAM role.

        Access Level: Tagging

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_TagRole.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toTagRole", []))

    @jsii.member(jsii_name="toTagSAMLProvider")
    def to_tag_saml_provider(self) -> "Iam":
        '''(experimental) Grants permission to add tags to a SAML Provider.

        Access Level: Tagging

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_TagSAMLProvider.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toTagSAMLProvider", []))

    @jsii.member(jsii_name="toTagServerCertificate")
    def to_tag_server_certificate(self) -> "Iam":
        '''(experimental) Grants permission to add tags to a server certificate.

        Access Level: Tagging

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_TagServerCertificate.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toTagServerCertificate", []))

    @jsii.member(jsii_name="toTagUser")
    def to_tag_user(self) -> "Iam":
        '''(experimental) Grants permission to add tags to an IAM user.

        Access Level: Tagging

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_TagUser.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toTagUser", []))

    @jsii.member(jsii_name="toUntagInstanceProfile")
    def to_untag_instance_profile(self) -> "Iam":
        '''(experimental) Grants permission to remove the specified tags from the instance profile.

        Access Level: Tagging

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UntagInstanceProfile.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUntagInstanceProfile", []))

    @jsii.member(jsii_name="toUntagMFADevice")
    def to_untag_mfa_device(self) -> "Iam":
        '''(experimental) Grants permission to remove the specified tags from the virtual mfa device.

        Access Level: Tagging

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UntagMFADevice.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUntagMFADevice", []))

    @jsii.member(jsii_name="toUntagOpenIDConnectProvider")
    def to_untag_open_id_connect_provider(self) -> "Iam":
        '''(experimental) Grants permission to remove the specified tags from the OpenID Connect provider.

        Access Level: Tagging

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UntagOpenIDConnectProvider.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUntagOpenIDConnectProvider", []))

    @jsii.member(jsii_name="toUntagPolicy")
    def to_untag_policy(self) -> "Iam":
        '''(experimental) Grants permission to remove the specified tags from the managed policy.

        Access Level: Tagging

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UntagPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUntagPolicy", []))

    @jsii.member(jsii_name="toUntagRole")
    def to_untag_role(self) -> "Iam":
        '''(experimental) Grants permission to remove the specified tags from the role.

        Access Level: Tagging

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UntagRole.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUntagRole", []))

    @jsii.member(jsii_name="toUntagSAMLProvider")
    def to_untag_saml_provider(self) -> "Iam":
        '''(experimental) Grants permission to remove the specified tags from the SAML Provider.

        Access Level: Tagging

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UntagSAMLProvider.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUntagSAMLProvider", []))

    @jsii.member(jsii_name="toUntagServerCertificate")
    def to_untag_server_certificate(self) -> "Iam":
        '''(experimental) Grants permission to remove the specified tags from the server certificate.

        Access Level: Tagging

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UntagServerCertificate.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUntagServerCertificate", []))

    @jsii.member(jsii_name="toUntagUser")
    def to_untag_user(self) -> "Iam":
        '''(experimental) Grants permission to remove the specified tags from the user.

        Access Level: Tagging

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UntagUser.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUntagUser", []))

    @jsii.member(jsii_name="toUpdateAccessKey")
    def to_update_access_key(self) -> "Iam":
        '''(experimental) Grants permission to update the status of the specified access key as Active or Inactive.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateAccessKey.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUpdateAccessKey", []))

    @jsii.member(jsii_name="toUpdateAccountPasswordPolicy")
    def to_update_account_password_policy(self) -> "Iam":
        '''(experimental) Grants permission to update the password policy settings for the AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateAccountPasswordPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUpdateAccountPasswordPolicy", []))

    @jsii.member(jsii_name="toUpdateAssumeRolePolicy")
    def to_update_assume_role_policy(self) -> "Iam":
        '''(experimental) Grants permission to update the policy that grants an IAM entity permission to assume a role.

        Access Level: Permissions management

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateAssumeRolePolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUpdateAssumeRolePolicy", []))

    @jsii.member(jsii_name="toUpdateGroup")
    def to_update_group(self) -> "Iam":
        '''(experimental) Grants permission to update the name or path of the specified IAM group.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateGroup.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUpdateGroup", []))

    @jsii.member(jsii_name="toUpdateLoginProfile")
    def to_update_login_profile(self) -> "Iam":
        '''(experimental) Grants permission to change the password for the specified IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateLoginProfile.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUpdateLoginProfile", []))

    @jsii.member(jsii_name="toUpdateOpenIDConnectProviderThumbprint")
    def to_update_open_id_connect_provider_thumbprint(self) -> "Iam":
        '''(experimental) Grants permission to update the entire list of server certificate thumbprints that are associated with an OpenID Connect (OIDC) provider resource.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateOpenIDConnectProviderThumbprint.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUpdateOpenIDConnectProviderThumbprint", []))

    @jsii.member(jsii_name="toUpdateRole")
    def to_update_role(self) -> "Iam":
        '''(experimental) Grants permission to update the description or maximum session duration setting of a role.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateRole.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUpdateRole", []))

    @jsii.member(jsii_name="toUpdateRoleDescription")
    def to_update_role_description(self) -> "Iam":
        '''(experimental) Grants permission to update only the description of a role.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateRoleDescription.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUpdateRoleDescription", []))

    @jsii.member(jsii_name="toUpdateSAMLProvider")
    def to_update_saml_provider(self) -> "Iam":
        '''(experimental) Grants permission to update the metadata document for an existing SAML provider resource.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateSAMLProvider.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUpdateSAMLProvider", []))

    @jsii.member(jsii_name="toUpdateServerCertificate")
    def to_update_server_certificate(self) -> "Iam":
        '''(experimental) Grants permission to update the name or the path of the specified server certificate stored in IAM.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateServerCertificate.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUpdateServerCertificate", []))

    @jsii.member(jsii_name="toUpdateServiceSpecificCredential")
    def to_update_service_specific_credential(self) -> "Iam":
        '''(experimental) Grants permission to update the status of a service-specific credential to active or inactive for an IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateServiceSpecificCredential.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUpdateServiceSpecificCredential", []))

    @jsii.member(jsii_name="toUpdateSigningCertificate")
    def to_update_signing_certificate(self) -> "Iam":
        '''(experimental) Grants permission to update the status of the specified user signing certificate to active or disabled.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateSigningCertificate.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUpdateSigningCertificate", []))

    @jsii.member(jsii_name="toUpdateSSHPublicKey")
    def to_update_ssh_public_key(self) -> "Iam":
        '''(experimental) Grants permission to update the status of an IAM user's SSH public key to active or inactive.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateSSHPublicKey.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUpdateSSHPublicKey", []))

    @jsii.member(jsii_name="toUpdateUser")
    def to_update_user(self) -> "Iam":
        '''(experimental) Grants permission to update the name or the path of the specified IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateUser.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUpdateUser", []))

    @jsii.member(jsii_name="toUploadServerCertificate")
    def to_upload_server_certificate(self) -> "Iam":
        '''(experimental) Grants permission to upload a server certificate entity for the AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UploadServerCertificate.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUploadServerCertificate", []))

    @jsii.member(jsii_name="toUploadSigningCertificate")
    def to_upload_signing_certificate(self) -> "Iam":
        '''(experimental) Grants permission to upload an X.509 signing certificate and associate it with the specified IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UploadSigningCertificate.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUploadSigningCertificate", []))

    @jsii.member(jsii_name="toUploadSSHPublicKey")
    def to_upload_ssh_public_key(self) -> "Iam":
        '''(experimental) Grants permission to upload an SSH public key and associate it with the specified IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UploadSSHPublicKey.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUploadSSHPublicKey", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Identitystore(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Identitystore",
):
    '''(experimental) Statement provider for service `identitystore <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsidentitystore.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `identitystore <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsidentitystore.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Identitystore, self, [sid])

    @jsii.member(jsii_name="toDescribeGroup")
    def to_describe_group(self) -> "Identitystore":
        '''(experimental) Retrieves information about group from the directory that AWS Identity Store provides by default.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/IdentityStoreAPIReference/API_DescribeGroup.html

        :stability: experimental
        '''
        return typing.cast("Identitystore", jsii.invoke(self, "toDescribeGroup", []))

    @jsii.member(jsii_name="toDescribeUser")
    def to_describe_user(self) -> "Identitystore":
        '''(experimental) Retrieves information about user from the directory that AWS Identity Store provides by default.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/IdentityStoreAPIReference/API_DescribeUser.html

        :stability: experimental
        '''
        return typing.cast("Identitystore", jsii.invoke(self, "toDescribeUser", []))

    @jsii.member(jsii_name="toListGroups")
    def to_list_groups(self) -> "Identitystore":
        '''(experimental) Search for groups within the associated directory.

        Access Level: List

        https://docs.aws.amazon.com/singlesignon/latest/IdentityStoreAPIReference/API_ListGroups.html

        :stability: experimental
        '''
        return typing.cast("Identitystore", jsii.invoke(self, "toListGroups", []))

    @jsii.member(jsii_name="toListUsers")
    def to_list_users(self) -> "Identitystore":
        '''(experimental) Search for users within the associated directory.

        Access Level: List

        https://docs.aws.amazon.com/singlesignon/latest/IdentityStoreAPIReference/API_ListUsers.html

        :stability: experimental
        '''
        return typing.cast("Identitystore", jsii.invoke(self, "toListUsers", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Imagebuilder(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Imagebuilder",
):
    '''(experimental) Statement provider for service `imagebuilder <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2imagebuilder.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `imagebuilder <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2imagebuilder.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Imagebuilder, self, [sid])

    @jsii.member(jsii_name="ifCreatedResourceTag")
    def if_created_resource_tag(
        self,
        key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Imagebuilder":
        '''(experimental) Filters access by the tag key-value pairs attached to the resource created by Image Builder.

        https://docs.aws.amazon.com/imagebuilder/latest/userguide/security_iam_service-with-iam.html#image-builder-security-createdresourcetag

        Applies to actions:

        - .toCreateInfrastructureConfiguration()
        - .toUpdateInfrastructureConfiguration()

        :param key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "ifCreatedResourceTag", [key, value, operator]))

    @jsii.member(jsii_name="ifCreatedResourceTagKeys")
    def if_created_resource_tag_keys(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Imagebuilder":
        '''(experimental) Filters access by the presence of tag keys in the request.

        https://docs.aws.amazon.com/imagebuilder/latest/userguide/security_iam_service-with-iam.html#image-builder-security-createdresourcetagkeys

        Applies to actions:

        - .toCreateInfrastructureConfiguration()
        - .toUpdateInfrastructureConfiguration()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "ifCreatedResourceTagKeys", [value, operator]))

    @jsii.member(jsii_name="onComponent")
    def on_component(
        self,
        component_name: builtins.str,
        component_version: builtins.str,
        component_build_version: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Imagebuilder":
        '''(experimental) Adds a resource of type component to the statement.

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_Component.html

        :param component_name: - Identifier for the componentName.
        :param component_version: - Identifier for the componentVersion.
        :param component_build_version: - Identifier for the componentBuildVersion.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "onComponent", [component_name, component_version, component_build_version, account, region, partition]))

    @jsii.member(jsii_name="onComponentVersion")
    def on_component_version(
        self,
        component_name: builtins.str,
        component_version: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Imagebuilder":
        '''(experimental) Adds a resource of type componentVersion to the statement.

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ComponentVersion

        :param component_name: - Identifier for the componentName.
        :param component_version: - Identifier for the componentVersion.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "onComponentVersion", [component_name, component_version, account, region, partition]))

    @jsii.member(jsii_name="onContainerRecipe")
    def on_container_recipe(
        self,
        container_recipe_name: builtins.str,
        container_recipe_version: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Imagebuilder":
        '''(experimental) Adds a resource of type containerRecipe to the statement.

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ContainerRecipe.html

        :param container_recipe_name: - Identifier for the containerRecipeName.
        :param container_recipe_version: - Identifier for the containerRecipeVersion.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "onContainerRecipe", [container_recipe_name, container_recipe_version, account, region, partition]))

    @jsii.member(jsii_name="onDistributionConfiguration")
    def on_distribution_configuration(
        self,
        distribution_configuration_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Imagebuilder":
        '''(experimental) Adds a resource of type distributionConfiguration to the statement.

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_DistributionConfiguration.html

        :param distribution_configuration_name: - Identifier for the distributionConfigurationName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "onDistributionConfiguration", [distribution_configuration_name, account, region, partition]))

    @jsii.member(jsii_name="onImage")
    def on_image(
        self,
        image_name: builtins.str,
        image_version: builtins.str,
        image_build_version: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Imagebuilder":
        '''(experimental) Adds a resource of type image to the statement.

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_Image.html

        :param image_name: - Identifier for the imageName.
        :param image_version: - Identifier for the imageVersion.
        :param image_build_version: - Identifier for the imageBuildVersion.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "onImage", [image_name, image_version, image_build_version, account, region, partition]))

    @jsii.member(jsii_name="onImagePipeline")
    def on_image_pipeline(
        self,
        image_pipeline_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Imagebuilder":
        '''(experimental) Adds a resource of type imagePipeline to the statement.

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ImagePipeline.html

        :param image_pipeline_name: - Identifier for the imagePipelineName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "onImagePipeline", [image_pipeline_name, account, region, partition]))

    @jsii.member(jsii_name="onImageRecipe")
    def on_image_recipe(
        self,
        image_recipe_name: builtins.str,
        image_recipe_version: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Imagebuilder":
        '''(experimental) Adds a resource of type imageRecipe to the statement.

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ImageRecipe.html

        :param image_recipe_name: - Identifier for the imageRecipeName.
        :param image_recipe_version: - Identifier for the imageRecipeVersion.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "onImageRecipe", [image_recipe_name, image_recipe_version, account, region, partition]))

    @jsii.member(jsii_name="onImageVersion")
    def on_image_version(
        self,
        image_name: builtins.str,
        image_version: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Imagebuilder":
        '''(experimental) Adds a resource of type imageVersion to the statement.

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ImageVersion.html

        :param image_name: - Identifier for the imageName.
        :param image_version: - Identifier for the imageVersion.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "onImageVersion", [image_name, image_version, account, region, partition]))

    @jsii.member(jsii_name="onInfrastructureConfiguration")
    def on_infrastructure_configuration(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Imagebuilder":
        '''(experimental) Adds a resource of type infrastructureConfiguration to the statement.

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_InfrastructureConfiguration.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "onInfrastructureConfiguration", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onKmsKey")
    def on_kms_key(
        self,
        key_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Imagebuilder":
        '''(experimental) Adds a resource of type kmsKey to the statement.

        https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#master_keys

        :param key_id: - Identifier for the keyId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "onKmsKey", [key_id, account, region, partition]))

    @jsii.member(jsii_name="toCancelImageCreation")
    def to_cancel_image_creation(self) -> "Imagebuilder":
        '''(experimental) Grants permission to cancel an image creation.

        Access Level: Write

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_CancelImageCreation.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toCancelImageCreation", []))

    @jsii.member(jsii_name="toCreateComponent")
    def to_create_component(self) -> "Imagebuilder":
        '''(experimental) Grants permission to create a new component.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_CreateComponent.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toCreateComponent", []))

    @jsii.member(jsii_name="toCreateContainerRecipe")
    def to_create_container_recipe(self) -> "Imagebuilder":
        '''(experimental) Grants permission to create a new Container Recipe.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - imagebuilder:GetComponent

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_CreateContainerRecipe.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toCreateContainerRecipe", []))

    @jsii.member(jsii_name="toCreateDistributionConfiguration")
    def to_create_distribution_configuration(self) -> "Imagebuilder":
        '''(experimental) Grants permission to create a new distribution configuration.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_CreateDistributionConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toCreateDistributionConfiguration", []))

    @jsii.member(jsii_name="toCreateImage")
    def to_create_image(self) -> "Imagebuilder":
        '''(experimental) Grants permission to create a new image.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - imagebuilder:GetImageRecipe
        - imagebuilder:GetInfrastructureConfiguration

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_CreateImage.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toCreateImage", []))

    @jsii.member(jsii_name="toCreateImagePipeline")
    def to_create_image_pipeline(self) -> "Imagebuilder":
        '''(experimental) Grants permission to create a new image pipeline.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - imagebuilder:GetImageRecipe

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_CreateImagePipeline.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toCreateImagePipeline", []))

    @jsii.member(jsii_name="toCreateImageRecipe")
    def to_create_image_recipe(self) -> "Imagebuilder":
        '''(experimental) Grants permission to create a new Image Recipe.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - imagebuilder:GetComponent

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_CreateImageRecipe.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toCreateImageRecipe", []))

    @jsii.member(jsii_name="toCreateInfrastructureConfiguration")
    def to_create_infrastructure_configuration(self) -> "Imagebuilder":
        '''(experimental) Grants permission to create a new infrastructure configuration.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifCreatedResourceTagKeys()
        - .ifCreatedResourceTag()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_CreateInfrastructureConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toCreateInfrastructureConfiguration", []))

    @jsii.member(jsii_name="toDeleteComponent")
    def to_delete_component(self) -> "Imagebuilder":
        '''(experimental) Grants permission to delete a component.

        Access Level: Write

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_DeleteComponent.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toDeleteComponent", []))

    @jsii.member(jsii_name="toDeleteContainerRecipe")
    def to_delete_container_recipe(self) -> "Imagebuilder":
        '''(experimental) Grants permission to delete a container recipe.

        Access Level: Write

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_DeleteContainerRecipe.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toDeleteContainerRecipe", []))

    @jsii.member(jsii_name="toDeleteDistributionConfiguration")
    def to_delete_distribution_configuration(self) -> "Imagebuilder":
        '''(experimental) Grants permission to delete a distribution configuration.

        Access Level: Write

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_DeleteDistributionConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toDeleteDistributionConfiguration", []))

    @jsii.member(jsii_name="toDeleteImage")
    def to_delete_image(self) -> "Imagebuilder":
        '''(experimental) Grants permission to delete an image.

        Access Level: Write

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_DeleteImage.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toDeleteImage", []))

    @jsii.member(jsii_name="toDeleteImagePipeline")
    def to_delete_image_pipeline(self) -> "Imagebuilder":
        '''(experimental) Grants permission to delete an image pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_DeleteImagePipeline.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toDeleteImagePipeline", []))

    @jsii.member(jsii_name="toDeleteImageRecipe")
    def to_delete_image_recipe(self) -> "Imagebuilder":
        '''(experimental) Grants permission to delete an image recipe.

        Access Level: Write

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_DeleteImageRecipe.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toDeleteImageRecipe", []))

    @jsii.member(jsii_name="toDeleteInfrastructureConfiguration")
    def to_delete_infrastructure_configuration(self) -> "Imagebuilder":
        '''(experimental) Grants permission to delete an infrastructure configuration.

        Access Level: Write

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_DeleteInfrastructureConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toDeleteInfrastructureConfiguration", []))

    @jsii.member(jsii_name="toGetComponent")
    def to_get_component(self) -> "Imagebuilder":
        '''(experimental) Grants permission to view details about a component.

        Access Level: Read

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_GetComponent.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toGetComponent", []))

    @jsii.member(jsii_name="toGetComponentPolicy")
    def to_get_component_policy(self) -> "Imagebuilder":
        '''(experimental) Grants permission to view the resource policy associated with a component.

        Access Level: Read

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_GetComponentPolicy.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toGetComponentPolicy", []))

    @jsii.member(jsii_name="toGetContainerRecipe")
    def to_get_container_recipe(self) -> "Imagebuilder":
        '''(experimental) Grants permission to view details about a container recipe.

        Access Level: Read

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_GetContainerRecipe.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toGetContainerRecipe", []))

    @jsii.member(jsii_name="toGetContainerRecipePolicy")
    def to_get_container_recipe_policy(self) -> "Imagebuilder":
        '''(experimental) Grants permission to view the resource policy associated with a container recipe.

        Access Level: Read

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_GetContainerRecipePolicy.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toGetContainerRecipePolicy", []))

    @jsii.member(jsii_name="toGetDistributionConfiguration")
    def to_get_distribution_configuration(self) -> "Imagebuilder":
        '''(experimental) Grants permission to view details about a distribution configuration.

        Access Level: Read

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_GetDistributionConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toGetDistributionConfiguration", []))

    @jsii.member(jsii_name="toGetImage")
    def to_get_image(self) -> "Imagebuilder":
        '''(experimental) Grants permission to view details about an image.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_GetImage.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toGetImage", []))

    @jsii.member(jsii_name="toGetImagePipeline")
    def to_get_image_pipeline(self) -> "Imagebuilder":
        '''(experimental) Grants permission to view details about an image pipeline.

        Access Level: Read

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_GetImagePipeline.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toGetImagePipeline", []))

    @jsii.member(jsii_name="toGetImagePolicy")
    def to_get_image_policy(self) -> "Imagebuilder":
        '''(experimental) Grants permission to view the resource policy associated with an image.

        Access Level: Read

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_GetImagePolicy.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toGetImagePolicy", []))

    @jsii.member(jsii_name="toGetImageRecipe")
    def to_get_image_recipe(self) -> "Imagebuilder":
        '''(experimental) Grants permission to view details about an image recipe.

        Access Level: Read

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_GetImageRecipe.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toGetImageRecipe", []))

    @jsii.member(jsii_name="toGetImageRecipePolicy")
    def to_get_image_recipe_policy(self) -> "Imagebuilder":
        '''(experimental) Grants permission to view the resource policy associated with an image recipe.

        Access Level: Read

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_GetImageRecipePolicy.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toGetImageRecipePolicy", []))

    @jsii.member(jsii_name="toGetInfrastructureConfiguration")
    def to_get_infrastructure_configuration(self) -> "Imagebuilder":
        '''(experimental) Grants permission to view details about an infrastructure configuration.

        Access Level: Read

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_GetInfrastructureConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toGetInfrastructureConfiguration", []))

    @jsii.member(jsii_name="toListComponentBuildVersions")
    def to_list_component_build_versions(self) -> "Imagebuilder":
        '''(experimental) Grants permission to list the component build versions in your account.

        Access Level: List

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListComponentBuildVersions.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toListComponentBuildVersions", []))

    @jsii.member(jsii_name="toListComponents")
    def to_list_components(self) -> "Imagebuilder":
        '''(experimental) Grants permission to list the component versions owned by or shared with your account.

        Access Level: List

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListComponents.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toListComponents", []))

    @jsii.member(jsii_name="toListContainerRecipes")
    def to_list_container_recipes(self) -> "Imagebuilder":
        '''(experimental) Grants permission to list the container recipes owned by or shared with your account.

        Access Level: List

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListContainerRecipes.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toListContainerRecipes", []))

    @jsii.member(jsii_name="toListDistributionConfigurations")
    def to_list_distribution_configurations(self) -> "Imagebuilder":
        '''(experimental) Grants permission to list the distribution configurations in your account.

        Access Level: List

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListDistributionConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toListDistributionConfigurations", []))

    @jsii.member(jsii_name="toListImageBuildVersions")
    def to_list_image_build_versions(self) -> "Imagebuilder":
        '''(experimental) Grants permission to list the image build versions in your account.

        Access Level: List

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListImageBuildVersions.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toListImageBuildVersions", []))

    @jsii.member(jsii_name="toListImagePackages")
    def to_list_image_packages(self) -> "Imagebuilder":
        '''(experimental) Grants permission to returns a list of packages installed on the specified image.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListImagePackages.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toListImagePackages", []))

    @jsii.member(jsii_name="toListImagePipelineImages")
    def to_list_image_pipeline_images(self) -> "Imagebuilder":
        '''(experimental) Grants permission to returns a list of images created by the specified pipeline.

        Access Level: List

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListImagePipelineImages.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toListImagePipelineImages", []))

    @jsii.member(jsii_name="toListImagePipelines")
    def to_list_image_pipelines(self) -> "Imagebuilder":
        '''(experimental) Grants permission to list the image pipelines in your account.

        Access Level: List

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListImagePipelines.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toListImagePipelines", []))

    @jsii.member(jsii_name="toListImageRecipes")
    def to_list_image_recipes(self) -> "Imagebuilder":
        '''(experimental) Grants permission to list the image recipes owned by or shared with your account.

        Access Level: List

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListImageRecipes.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toListImageRecipes", []))

    @jsii.member(jsii_name="toListImages")
    def to_list_images(self) -> "Imagebuilder":
        '''(experimental) Grants permission to list the image versions owned by or shared with your account.

        Access Level: List

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListImages.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toListImages", []))

    @jsii.member(jsii_name="toListInfrastructureConfigurations")
    def to_list_infrastructure_configurations(self) -> "Imagebuilder":
        '''(experimental) Grants permission to list the infrastructure configurations in your account.

        Access Level: List

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListInfrastructureConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toListInfrastructureConfigurations", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Imagebuilder":
        '''(experimental) Grants permission to list tag for an Image Builder resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutComponentPolicy")
    def to_put_component_policy(self) -> "Imagebuilder":
        '''(experimental) Grants permission to set the resource policy associated with a component.

        Access Level: Permissions management

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_PutComponentPolicy.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toPutComponentPolicy", []))

    @jsii.member(jsii_name="toPutContainerRecipePolicy")
    def to_put_container_recipe_policy(self) -> "Imagebuilder":
        '''(experimental) Grants permission to set the resource policy associated with a container recipe.

        Access Level: Permissions management

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_PutContainerRecipePolicy.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toPutContainerRecipePolicy", []))

    @jsii.member(jsii_name="toPutImagePolicy")
    def to_put_image_policy(self) -> "Imagebuilder":
        '''(experimental) Grants permission to set the resource policy associated with an image.

        Access Level: Permissions management

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_PutImagePolicy.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toPutImagePolicy", []))

    @jsii.member(jsii_name="toPutImageRecipePolicy")
    def to_put_image_recipe_policy(self) -> "Imagebuilder":
        '''(experimental) Grants permission to set the resource policy associated with an image recipe.

        Access Level: Permissions management

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_PutImageRecipePolicy.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toPutImageRecipePolicy", []))

    @jsii.member(jsii_name="toStartImagePipelineExecution")
    def to_start_image_pipeline_execution(self) -> "Imagebuilder":
        '''(experimental) Grants permission to create a new image from a pipeline.

        Access Level: Write

        Dependent actions:

        - imagebuilder:GetImagePipeline

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_StartImagePipelineExecution.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toStartImagePipelineExecution", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Imagebuilder":
        '''(experimental) Grants permission to tag an Image Builder resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Imagebuilder":
        '''(experimental) Grants permission to untag an Image Builder resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateDistributionConfiguration")
    def to_update_distribution_configuration(self) -> "Imagebuilder":
        '''(experimental) Grants permission to update an existing distribution configuration.

        Access Level: Write

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_UpdateDistributionConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toUpdateDistributionConfiguration", []))

    @jsii.member(jsii_name="toUpdateImagePipeline")
    def to_update_image_pipeline(self) -> "Imagebuilder":
        '''(experimental) Grants permission to update an existing image pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_UpdateImagePipeline.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toUpdateImagePipeline", []))

    @jsii.member(jsii_name="toUpdateInfrastructureConfiguration")
    def to_update_infrastructure_configuration(self) -> "Imagebuilder":
        '''(experimental) Grants permission to update an existing infrastructure configuration.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifCreatedResourceTagKeys()
        - .ifCreatedResourceTag()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_UpdateInfrastructureConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toUpdateInfrastructureConfiguration", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Importexport(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Importexport",
):
    '''(experimental) Statement provider for service `importexport <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsimportexportdiskservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `importexport <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsimportexportdiskservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Importexport, self, [sid])

    @jsii.member(jsii_name="toCancelJob")
    def to_cancel_job(self) -> "Importexport":
        '''(experimental) This action cancels a specified job.

        Only the job owner can cancel it. The action fails if the job has already started or is complete.

        Access Level: Write

        https://docs.aws.amazon.com/AWSImportExport/latest/DG/WebCancelJob.html

        :stability: experimental
        '''
        return typing.cast("Importexport", jsii.invoke(self, "toCancelJob", []))

    @jsii.member(jsii_name="toCreateJob")
    def to_create_job(self) -> "Importexport":
        '''(experimental) This action initiates the process of scheduling an upload or download of your data.

        Access Level: Write

        https://docs.aws.amazon.com/AWSImportExport/latest/DG/WebCreateJob.html

        :stability: experimental
        '''
        return typing.cast("Importexport", jsii.invoke(self, "toCreateJob", []))

    @jsii.member(jsii_name="toGetShippingLabel")
    def to_get_shipping_label(self) -> "Importexport":
        '''(experimental) This action generates a pre-paid shipping label that you will use to ship your device to AWS for processing.

        Access Level: Read

        https://docs.aws.amazon.com/AWSImportExport/latest/DG/WebGetShippingLabel.html

        :stability: experimental
        '''
        return typing.cast("Importexport", jsii.invoke(self, "toGetShippingLabel", []))

    @jsii.member(jsii_name="toGetStatus")
    def to_get_status(self) -> "Importexport":
        '''(experimental) This action returns information about a job, including where the job is in the processing pipeline, the status of the results, and the signature value associated with the job.

        Access Level: Read

        https://docs.aws.amazon.com/AWSImportExport/latest/DG/WebGetStatus.html

        :stability: experimental
        '''
        return typing.cast("Importexport", jsii.invoke(self, "toGetStatus", []))

    @jsii.member(jsii_name="toListJobs")
    def to_list_jobs(self) -> "Importexport":
        '''(experimental) This action returns the jobs associated with the requester.

        Access Level: List

        https://docs.aws.amazon.com/AWSImportExport/latest/DG/WebListJobs.html

        :stability: experimental
        '''
        return typing.cast("Importexport", jsii.invoke(self, "toListJobs", []))

    @jsii.member(jsii_name="toUpdateJob")
    def to_update_job(self) -> "Importexport":
        '''(experimental) You use this action to change the parameters specified in the original manifest file by supplying a new manifest file.

        Access Level: Write

        https://docs.aws.amazon.com/AWSImportExport/latest/DG/WebUpdateJob.html

        :stability: experimental
        '''
        return typing.cast("Importexport", jsii.invoke(self, "toUpdateJob", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Inspector(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Inspector",
):
    '''(experimental) Statement provider for service `inspector <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoninspector.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `inspector <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoninspector.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Inspector, self, [sid])

    @jsii.member(jsii_name="toAddAttributesToFindings")
    def to_add_attributes_to_findings(self) -> "Inspector":
        '''(experimental) Assigns attributes (key and value pairs) to the findings that are specified by the ARNs of the findings.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_AddAttributesToFindings.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toAddAttributesToFindings", []))

    @jsii.member(jsii_name="toCreateAssessmentTarget")
    def to_create_assessment_target(self) -> "Inspector":
        '''(experimental) Creates a new assessment target using the ARN of the resource group that is generated by CreateResourceGroup.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_CreateAssessmentTarget.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toCreateAssessmentTarget", []))

    @jsii.member(jsii_name="toCreateAssessmentTemplate")
    def to_create_assessment_template(self) -> "Inspector":
        '''(experimental) Creates an assessment template for the assessment target that is specified by the ARN of the assessment target.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_CreateAssessmentTemplate.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toCreateAssessmentTemplate", []))

    @jsii.member(jsii_name="toCreateResourceGroup")
    def to_create_resource_group(self) -> "Inspector":
        '''(experimental) Creates a resource group using the specified set of tags (key and value pairs) that are used to select the EC2 instances to be included in an Amazon Inspector assessment target.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_CreateResourceGroup.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toCreateResourceGroup", []))

    @jsii.member(jsii_name="toDeleteAssessmentRun")
    def to_delete_assessment_run(self) -> "Inspector":
        '''(experimental) Deletes the assessment run that is specified by the ARN of the assessment run.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_DeleteAssessmentRun.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toDeleteAssessmentRun", []))

    @jsii.member(jsii_name="toDeleteAssessmentTarget")
    def to_delete_assessment_target(self) -> "Inspector":
        '''(experimental) Deletes the assessment target that is specified by the ARN of the assessment target.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_DeleteAssessmentTarget.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toDeleteAssessmentTarget", []))

    @jsii.member(jsii_name="toDeleteAssessmentTemplate")
    def to_delete_assessment_template(self) -> "Inspector":
        '''(experimental) Deletes the assessment template that is specified by the ARN of the assessment template.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_DeleteAssessmentTemplate.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toDeleteAssessmentTemplate", []))

    @jsii.member(jsii_name="toDescribeAssessmentRuns")
    def to_describe_assessment_runs(self) -> "Inspector":
        '''(experimental) Describes the assessment runs that are specified by the ARNs of the assessment runs.

        Access Level: Read

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_DescribeAssessmentRuns.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toDescribeAssessmentRuns", []))

    @jsii.member(jsii_name="toDescribeAssessmentTargets")
    def to_describe_assessment_targets(self) -> "Inspector":
        '''(experimental) Describes the assessment targets that are specified by the ARNs of the assessment targets.

        Access Level: Read

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_DescribeAssessmentTargets.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toDescribeAssessmentTargets", []))

    @jsii.member(jsii_name="toDescribeAssessmentTemplates")
    def to_describe_assessment_templates(self) -> "Inspector":
        '''(experimental) Describes the assessment templates that are specified by the ARNs of the assessment templates.

        Access Level: Read

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_DescribeAssessmentTemplates.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toDescribeAssessmentTemplates", []))

    @jsii.member(jsii_name="toDescribeCrossAccountAccessRole")
    def to_describe_cross_account_access_role(self) -> "Inspector":
        '''(experimental) Describes the IAM role that enables Amazon Inspector to access your AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_DescribeCrossAccountAccessRole.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toDescribeCrossAccountAccessRole", []))

    @jsii.member(jsii_name="toDescribeFindings")
    def to_describe_findings(self) -> "Inspector":
        '''(experimental) Describes the findings that are specified by the ARNs of the findings.

        Access Level: Read

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_DescribeFindings.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toDescribeFindings", []))

    @jsii.member(jsii_name="toDescribeResourceGroups")
    def to_describe_resource_groups(self) -> "Inspector":
        '''(experimental) Describes the resource groups that are specified by the ARNs of the resource groups.

        Access Level: Read

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_DescribeResourceGroups.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toDescribeResourceGroups", []))

    @jsii.member(jsii_name="toDescribeRulesPackages")
    def to_describe_rules_packages(self) -> "Inspector":
        '''(experimental) Describes the rules packages that are specified by the ARNs of the rules packages.

        Access Level: Read

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_DescribeRulesPackages.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toDescribeRulesPackages", []))

    @jsii.member(jsii_name="toGetTelemetryMetadata")
    def to_get_telemetry_metadata(self) -> "Inspector":
        '''(experimental) Information about the data that is collected for the specified assessment run.

        Access Level: Read

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_GetTelemetryMetadata.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toGetTelemetryMetadata", []))

    @jsii.member(jsii_name="toListAssessmentRunAgents")
    def to_list_assessment_run_agents(self) -> "Inspector":
        '''(experimental) Lists the agents of the assessment runs that are specified by the ARNs of the assessment runs.

        Access Level: List

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_ListAssessmentRunAgents.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toListAssessmentRunAgents", []))

    @jsii.member(jsii_name="toListAssessmentRuns")
    def to_list_assessment_runs(self) -> "Inspector":
        '''(experimental) Lists the assessment runs that correspond to the assessment templates that are specified by the ARNs of the assessment templates.

        Access Level: List

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_ListAssessmentRuns.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toListAssessmentRuns", []))

    @jsii.member(jsii_name="toListAssessmentTargets")
    def to_list_assessment_targets(self) -> "Inspector":
        '''(experimental) Lists the ARNs of the assessment targets within this AWS account.

        Access Level: List

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_ListAssessmentTargets.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toListAssessmentTargets", []))

    @jsii.member(jsii_name="toListAssessmentTemplates")
    def to_list_assessment_templates(self) -> "Inspector":
        '''(experimental) Lists the assessment templates that correspond to the assessment targets that are specified by the ARNs of the assessment targets.

        Access Level: List

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_ListAssessmentTemplates.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toListAssessmentTemplates", []))

    @jsii.member(jsii_name="toListEventSubscriptions")
    def to_list_event_subscriptions(self) -> "Inspector":
        '''(experimental) Lists all the event subscriptions for the assessment template that is specified by the ARN of the assessment template.

        Access Level: List

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_ListEventSubscriptions.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toListEventSubscriptions", []))

    @jsii.member(jsii_name="toListFindings")
    def to_list_findings(self) -> "Inspector":
        '''(experimental) Lists findings that are generated by the assessment runs that are specified by the ARNs of the assessment runs.

        Access Level: List

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_ListFindings.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toListFindings", []))

    @jsii.member(jsii_name="toListRulesPackages")
    def to_list_rules_packages(self) -> "Inspector":
        '''(experimental) Lists all available Amazon Inspector rules packages.

        Access Level: List

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_ListRulesPackages.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toListRulesPackages", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Inspector":
        '''(experimental) Lists all tags associated with an assessment template.

        Access Level: List

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPreviewAgents")
    def to_preview_agents(self) -> "Inspector":
        '''(experimental) Previews the agents installed on the EC2 instances that are part of the specified assessment target.

        Access Level: Read

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_PreviewAgents.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toPreviewAgents", []))

    @jsii.member(jsii_name="toRegisterCrossAccountAccessRole")
    def to_register_cross_account_access_role(self) -> "Inspector":
        '''(experimental) Registers the IAM role that Amazon Inspector uses to list your EC2 instances at the start of the assessment run or when you call the PreviewAgents action.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_RegisterCrossAccountAccessRole.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toRegisterCrossAccountAccessRole", []))

    @jsii.member(jsii_name="toRemoveAttributesFromFindings")
    def to_remove_attributes_from_findings(self) -> "Inspector":
        '''(experimental) Removes entire attributes (key and value pairs) from the findings that are specified by the ARNs of the findings where an attribute with the specified key exists.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_RemoveAttributesFromFindings.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toRemoveAttributesFromFindings", []))

    @jsii.member(jsii_name="toSetTagsForResource")
    def to_set_tags_for_resource(self) -> "Inspector":
        '''(experimental) Sets tags (key and value pairs) to the assessment template that is specified by the ARN of the assessment template.

        Access Level: Tagging

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_SetTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toSetTagsForResource", []))

    @jsii.member(jsii_name="toStartAssessmentRun")
    def to_start_assessment_run(self) -> "Inspector":
        '''(experimental) Starts the assessment run specified by the ARN of the assessment template.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_StartAssessmentRun.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toStartAssessmentRun", []))

    @jsii.member(jsii_name="toStopAssessmentRun")
    def to_stop_assessment_run(self) -> "Inspector":
        '''(experimental) Stops the assessment run that is specified by the ARN of the assessment run.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_StopAssessmentRun.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toStopAssessmentRun", []))

    @jsii.member(jsii_name="toSubscribeToEvent")
    def to_subscribe_to_event(self) -> "Inspector":
        '''(experimental) Enables the process of sending Amazon Simple Notification Service (SNS) notifications about a specified event to a specified SNS topic.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_SubscribeToEvent.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toSubscribeToEvent", []))

    @jsii.member(jsii_name="toUnsubscribeFromEvent")
    def to_unsubscribe_from_event(self) -> "Inspector":
        '''(experimental) Disables the process of sending Amazon Simple Notification Service (SNS) notifications about a specified event to a specified SNS topic.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_UnsubscribeFromEvent.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toUnsubscribeFromEvent", []))

    @jsii.member(jsii_name="toUpdateAssessmentTarget")
    def to_update_assessment_target(self) -> "Inspector":
        '''(experimental) Updates the assessment target that is specified by the ARN of the assessment target.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_UpdateAssessmentTarget.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toUpdateAssessmentTarget", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Iot(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Iot"):
    '''(experimental) Statement provider for service `iot <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `iot <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Iot, self, [sid])

    @jsii.member(jsii_name="ifDelete")
    def if_delete(self, value: typing.Optional[builtins.bool] = None) -> "Iot":
        '''(experimental) The flag indicating whether or not to also delete an IoT Tunnel immediately.

        Applies to actions:

        - .toCloseTunnel()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "ifDelete", [value]))

    @jsii.member(jsii_name="ifDomainName")
    def if_domain_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iot":
        '''(experimental) Filters actions based on the domain name of an IoT DomainConfiguration.

        Applies to actions:

        - .toCreateDomainConfiguration()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "ifDomainName", [value, operator]))

    @jsii.member(jsii_name="ifThingGroupArn")
    def if_thing_group_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iot":
        '''(experimental) The list of all IoT Thing Group ARNs that the destination IoT Thing belongs to for an IoT Tunnel.

        Applies to actions:

        - .toOpenTunnel()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "ifThingGroupArn", [value, operator]))

    @jsii.member(jsii_name="ifTunnelDestinationService")
    def if_tunnel_destination_service(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iot":
        '''(experimental) The list of all destination services for an IoT Tunnel.

        Applies to actions:

        - .toOpenTunnel()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "ifTunnelDestinationService", [value, operator]))

    @jsii.member(jsii_name="onAuthorizer")
    def on_authorizer(
        self,
        authorizer_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type authorizer to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/custom-authorizer.html

        :param authorizer_name: - Identifier for the authorizerName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "onAuthorizer", [authorizer_name, account, region, partition]))

    @jsii.member(jsii_name="onBillinggroup")
    def on_billinggroup(
        self,
        billing_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type billinggroup to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/billing-groups.html

        :param billing_group_name: - Identifier for the billingGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "onBillinggroup", [billing_group_name, account, region, partition]))

    @jsii.member(jsii_name="onCacert")
    def on_cacert(
        self,
        c_a_certificate: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type cacert to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/x509-certs.html

        :param c_a_certificate: - Identifier for the cACertificate.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "onCacert", [c_a_certificate, account, region, partition]))

    @jsii.member(jsii_name="onCert")
    def on_cert(
        self,
        certificate: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type cert to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/x509-certs.html

        :param certificate: - Identifier for the certificate.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "onCert", [certificate, account, region, partition]))

    @jsii.member(jsii_name="onClient")
    def on_client(
        self,
        client_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type client to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/iot-message-broker.html

        :param client_id: - Identifier for the clientId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "onClient", [client_id, account, region, partition]))

    @jsii.member(jsii_name="onDestination")
    def on_destination(
        self,
        destination_type: builtins.str,
        uuid: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type destination to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/rule-destination.html

        :param destination_type: - Identifier for the destinationType.
        :param uuid: - Identifier for the uuid.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "onDestination", [destination_type, uuid, account, region, partition]))

    @jsii.member(jsii_name="onDimension")
    def on_dimension(
        self,
        dimension_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type dimension to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/device-defender-detect.html

        :param dimension_name: - Identifier for the dimensionName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "onDimension", [dimension_name, account, region, partition]))

    @jsii.member(jsii_name="onDomainconfiguration")
    def on_domainconfiguration(
        self,
        domain_configuration_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type domainconfiguration to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/domain-configuration.html

        :param domain_configuration_name: - Identifier for the domainConfigurationName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "onDomainconfiguration", [domain_configuration_name, account, region, partition]))

    @jsii.member(jsii_name="onDynamicthinggroup")
    def on_dynamicthinggroup(
        self,
        thing_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type dynamicthinggroup to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/dynamic-thing-groups.html

        :param thing_group_name: - Identifier for the thingGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "onDynamicthinggroup", [thing_group_name, account, region, partition]))

    @jsii.member(jsii_name="onFleetmetric")
    def on_fleetmetric(
        self,
        fleet_metric_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type fleetmetric to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/iot-indexing.html

        :param fleet_metric_name: - Identifier for the fleetMetricName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "onFleetmetric", [fleet_metric_name, account, region, partition]))

    @jsii.member(jsii_name="onIndex")
    def on_index(
        self,
        index_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type index to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/iot-indexing.html

        :param index_name: - Identifier for the indexName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "onIndex", [index_name, account, region, partition]))

    @jsii.member(jsii_name="onJob")
    def on_job(
        self,
        job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type job to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/iot-jobs.html

        :param job_id: - Identifier for the jobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "onJob", [job_id, account, region, partition]))

    @jsii.member(jsii_name="onMitigationaction")
    def on_mitigationaction(
        self,
        mitigation_action_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type mitigationaction to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/device-defender-mitigation-actions.html

        :param mitigation_action_name: - Identifier for the mitigationActionName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "onMitigationaction", [mitigation_action_name, account, region, partition]))

    @jsii.member(jsii_name="onOtaupdate")
    def on_otaupdate(
        self,
        ota_update_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type otaupdate to the statement.

        https://docs.aws.amazon.com/freertos/latest/userguide/freertos-ota-dev.html

        :param ota_update_id: - Identifier for the otaUpdateId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "onOtaupdate", [ota_update_id, account, region, partition]))

    @jsii.member(jsii_name="onPolicy")
    def on_policy(
        self,
        policy_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type policy to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/iot-policies.html

        :param policy_name: - Identifier for the policyName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "onPolicy", [policy_name, account, region, partition]))

    @jsii.member(jsii_name="onProvisioningtemplate")
    def on_provisioningtemplate(
        self,
        provisioning_template: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type provisioningtemplate to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/provision-template.html

        :param provisioning_template: - Identifier for the provisioningTemplate.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "onProvisioningtemplate", [provisioning_template, account, region, partition]))

    @jsii.member(jsii_name="onRolealias")
    def on_rolealias(
        self,
        role_alias: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type rolealias to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/authorizing-direct-aws.html

        :param role_alias: - Identifier for the roleAlias.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "onRolealias", [role_alias, account, region, partition]))

    @jsii.member(jsii_name="onRule")
    def on_rule(
        self,
        rule_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type rule to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/iot-rules.html

        :param rule_name: - Identifier for the ruleName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "onRule", [rule_name, account, region, partition]))

    @jsii.member(jsii_name="onScheduledaudit")
    def on_scheduledaudit(
        self,
        schedule_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type scheduledaudit to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/device-defender-audit.html

        :param schedule_name: - Identifier for the scheduleName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "onScheduledaudit", [schedule_name, account, region, partition]))

    @jsii.member(jsii_name="onSecurityprofile")
    def on_securityprofile(
        self,
        security_profile_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type securityprofile to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/device-defender-detect.html

        :param security_profile_name: - Identifier for the securityProfileName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "onSecurityprofile", [security_profile_name, account, region, partition]))

    @jsii.member(jsii_name="onStream")
    def on_stream(
        self,
        stream_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type stream to the statement.

        https://docs.aws.amazon.com/freertos/latest/userguide/freertos-ota-dev.html

        :param stream_id: - Identifier for the streamId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "onStream", [stream_id, account, region, partition]))

    @jsii.member(jsii_name="onThing")
    def on_thing(
        self,
        thing_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type thing to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/thing-registry.html

        :param thing_name: - Identifier for the thingName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "onThing", [thing_name, account, region, partition]))

    @jsii.member(jsii_name="onThinggroup")
    def on_thinggroup(
        self,
        thing_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type thinggroup to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/thing-groups.html

        :param thing_group_name: - Identifier for the thingGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "onThinggroup", [thing_group_name, account, region, partition]))

    @jsii.member(jsii_name="onThingtype")
    def on_thingtype(
        self,
        thing_type_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type thingtype to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/thing-types.html

        :param thing_type_name: - Identifier for the thingTypeName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "onThingtype", [thing_type_name, account, region, partition]))

    @jsii.member(jsii_name="onTopic")
    def on_topic(
        self,
        topic_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type topic to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/iot-message-broker.html

        :param topic_name: - Identifier for the topicName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "onTopic", [topic_name, account, region, partition]))

    @jsii.member(jsii_name="onTopicfilter")
    def on_topicfilter(
        self,
        topic_filter: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type topicfilter to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/topics.html

        :param topic_filter: - Identifier for the topicFilter.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "onTopicfilter", [topic_filter, account, region, partition]))

    @jsii.member(jsii_name="onTunnel")
    def on_tunnel(
        self,
        tunnel_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type tunnel to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/iot-tunnels.html

        :param tunnel_id: - Identifier for the tunnelId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "onTunnel", [tunnel_id, account, region, partition]))

    @jsii.member(jsii_name="toAcceptCertificateTransfer")
    def to_accept_certificate_transfer(self) -> "Iot":
        '''(experimental) Accepts a pending certificate transfer.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_AcceptCertificateTransfer.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toAcceptCertificateTransfer", []))

    @jsii.member(jsii_name="toAddThingToBillingGroup")
    def to_add_thing_to_billing_group(self) -> "Iot":
        '''(experimental) Adds a thing to the specified billing group.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_AddThingToBillingGroup.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toAddThingToBillingGroup", []))

    @jsii.member(jsii_name="toAddThingToThingGroup")
    def to_add_thing_to_thing_group(self) -> "Iot":
        '''(experimental) Adds a thing to the specified thing group.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_AddThingToThingGroup.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toAddThingToThingGroup", []))

    @jsii.member(jsii_name="toAssociateTargetsWithJob")
    def to_associate_targets_with_job(self) -> "Iot":
        '''(experimental) Associates a group with a continuous job.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_AssociateTargetsWithJob.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toAssociateTargetsWithJob", []))

    @jsii.member(jsii_name="toAttachPolicy")
    def to_attach_policy(self) -> "Iot":
        '''(experimental) Attaches a policy to the specified target.

        Access Level: Permissions management

        https://docs.aws.amazon.com/iot/latest/apireference/API_AttachPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toAttachPolicy", []))

    @jsii.member(jsii_name="toAttachPrincipalPolicy")
    def to_attach_principal_policy(self) -> "Iot":
        '''(experimental) Attaches the specified policy to the specified principal (certificate or other credential).

        Access Level: Permissions management

        https://docs.aws.amazon.com/iot/latest/apireference/API_AttachPrincipalPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toAttachPrincipalPolicy", []))

    @jsii.member(jsii_name="toAttachSecurityProfile")
    def to_attach_security_profile(self) -> "Iot":
        '''(experimental) Associates a Device Defender security profile with a thing group or with this account.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_AttachSecurityProfile.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toAttachSecurityProfile", []))

    @jsii.member(jsii_name="toAttachThingPrincipal")
    def to_attach_thing_principal(self) -> "Iot":
        '''(experimental) Attaches the specified principal to the specified thing.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_AttachThingPrincipal.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toAttachThingPrincipal", []))

    @jsii.member(jsii_name="toCancelAuditMitigationActionsTask")
    def to_cancel_audit_mitigation_actions_task(self) -> "Iot":
        '''(experimental) Cancels a mitigation action task that is in progress.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_CancelAuditMitigationActionsTask.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCancelAuditMitigationActionsTask", []))

    @jsii.member(jsii_name="toCancelAuditTask")
    def to_cancel_audit_task(self) -> "Iot":
        '''(experimental) Cancels an audit that is in progress. The audit can be either scheduled or on-demand.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_CancelAuditTask.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCancelAuditTask", []))

    @jsii.member(jsii_name="toCancelCertificateTransfer")
    def to_cancel_certificate_transfer(self) -> "Iot":
        '''(experimental) Cancels a pending transfer for the specified certificate.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_CancelCertificateTransfer.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCancelCertificateTransfer", []))

    @jsii.member(jsii_name="toCancelJob")
    def to_cancel_job(self) -> "Iot":
        '''(experimental) Cancels a job.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_CancelJob.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCancelJob", []))

    @jsii.member(jsii_name="toCancelJobExecution")
    def to_cancel_job_execution(self) -> "Iot":
        '''(experimental) Cancels a job execution on a particular device.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_CancelJobExecution.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCancelJobExecution", []))

    @jsii.member(jsii_name="toClearDefaultAuthorizer")
    def to_clear_default_authorizer(self) -> "Iot":
        '''(experimental) Clears the default authorizer.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_ClearDefaultAuthorizer.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toClearDefaultAuthorizer", []))

    @jsii.member(jsii_name="toCloseTunnel")
    def to_close_tunnel(self) -> "Iot":
        '''(experimental) Closes a tunnel.

        Access Level: Write

        Possible conditions:

        - .ifDelete()

        https://docs.aws.amazon.com/iot/latest/apireference/API_CloseTunnel.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCloseTunnel", []))

    @jsii.member(jsii_name="toConfirmTopicRuleDestination")
    def to_confirm_topic_rule_destination(self) -> "Iot":
        '''(experimental) Confirms a http url TopicRuleDestinationDestination.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_ConfirmTopicRuleDestination.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toConfirmTopicRuleDestination", []))

    @jsii.member(jsii_name="toConnect")
    def to_connect(self) -> "Iot":
        '''(experimental) Connect as the specified client.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/developerguide/policy-actions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toConnect", []))

    @jsii.member(jsii_name="toCreateAuditSuppression")
    def to_create_audit_suppression(self) -> "Iot":
        '''(experimental) Creates a Device Defender audit suppression.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateAuditSuppression.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateAuditSuppression", []))

    @jsii.member(jsii_name="toCreateAuthorizer")
    def to_create_authorizer(self) -> "Iot":
        '''(experimental) Creates an authorizer.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateAuthorizer.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateAuthorizer", []))

    @jsii.member(jsii_name="toCreateBillingGroup")
    def to_create_billing_group(self) -> "Iot":
        '''(experimental) Creates a billing group.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateBillingGroup.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateBillingGroup", []))

    @jsii.member(jsii_name="toCreateCertificateFromCsr")
    def to_create_certificate_from_csr(self) -> "Iot":
        '''(experimental) Creates an X.509 certificate using the specified certificate signing request.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateCertificateFromCsr.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateCertificateFromCsr", []))

    @jsii.member(jsii_name="toCreateDimension")
    def to_create_dimension(self) -> "Iot":
        '''(experimental) Defines a dimension that can be used to to limit the scope of a metric used in a security profile.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateDimension.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateDimension", []))

    @jsii.member(jsii_name="toCreateDomainConfiguration")
    def to_create_domain_configuration(self) -> "Iot":
        '''(experimental) Creates a domain configuration.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifDomainName()

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateDomainConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateDomainConfiguration", []))

    @jsii.member(jsii_name="toCreateDynamicThingGroup")
    def to_create_dynamic_thing_group(self) -> "Iot":
        '''(experimental) Creates a Dynamic Thing Group.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateDynamicThingGroup.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateDynamicThingGroup", []))

    @jsii.member(jsii_name="toCreateFleetMetric")
    def to_create_fleet_metric(self) -> "Iot":
        '''(experimental) Creates a fleet metric.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/iot-indexing.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateFleetMetric", []))

    @jsii.member(jsii_name="toCreateJob")
    def to_create_job(self) -> "Iot":
        '''(experimental) Creates a job.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateJob.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateJob", []))

    @jsii.member(jsii_name="toCreateKeysAndCertificate")
    def to_create_keys_and_certificate(self) -> "Iot":
        '''(experimental) Creates a 2048 bit RSA key pair and issues an X.509 certificate using the issued public key.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateKeysAndCertificate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateKeysAndCertificate", []))

    @jsii.member(jsii_name="toCreateMitigationAction")
    def to_create_mitigation_action(self) -> "Iot":
        '''(experimental) Defines an action that can be applied to audit findings by using StartAuditMitigationActionsTask.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateMitigationAction.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateMitigationAction", []))

    @jsii.member(jsii_name="toCreateOTAUpdate")
    def to_create_ota_update(self) -> "Iot":
        '''(experimental) Creates an OTA update job.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateOTAUpdate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateOTAUpdate", []))

    @jsii.member(jsii_name="toCreatePolicy")
    def to_create_policy(self) -> "Iot":
        '''(experimental) Creates an AWS IoT policy.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreatePolicy.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreatePolicy", []))

    @jsii.member(jsii_name="toCreatePolicyVersion")
    def to_create_policy_version(self) -> "Iot":
        '''(experimental) Creates a new version of the specified AWS IoT policy.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreatePolicyVersion.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreatePolicyVersion", []))

    @jsii.member(jsii_name="toCreateProvisioningClaim")
    def to_create_provisioning_claim(self) -> "Iot":
        '''(experimental) Creates a provisioning claim.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateProvisioningClaim.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateProvisioningClaim", []))

    @jsii.member(jsii_name="toCreateProvisioningTemplate")
    def to_create_provisioning_template(self) -> "Iot":
        '''(experimental) Creates a fleet provisioning template.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateProvisioningTemplate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateProvisioningTemplate", []))

    @jsii.member(jsii_name="toCreateProvisioningTemplateVersion")
    def to_create_provisioning_template_version(self) -> "Iot":
        '''(experimental) Creates a new version of a fleet provisioning template.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateProvisioningTemplateVersion.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateProvisioningTemplateVersion", []))

    @jsii.member(jsii_name="toCreateRoleAlias")
    def to_create_role_alias(self) -> "Iot":
        '''(experimental) Creates a role alias.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateRoleAlias.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateRoleAlias", []))

    @jsii.member(jsii_name="toCreateScheduledAudit")
    def to_create_scheduled_audit(self) -> "Iot":
        '''(experimental) Creates a scheduled audit that is run at a specified time interval.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateScheduledAudit.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateScheduledAudit", []))

    @jsii.member(jsii_name="toCreateSecurityProfile")
    def to_create_security_profile(self) -> "Iot":
        '''(experimental) Creates a Device Defender security profile.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateSecurityProfile.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateSecurityProfile", []))

    @jsii.member(jsii_name="toCreateStream")
    def to_create_stream(self) -> "Iot":
        '''(experimental) Creates a new AWS IoT stream.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateStream.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateStream", []))

    @jsii.member(jsii_name="toCreateThing")
    def to_create_thing(self) -> "Iot":
        '''(experimental) Creates a thing in the thing registry.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateThing.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateThing", []))

    @jsii.member(jsii_name="toCreateThingGroup")
    def to_create_thing_group(self) -> "Iot":
        '''(experimental) Creates a thing group.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateThingGroup.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateThingGroup", []))

    @jsii.member(jsii_name="toCreateThingType")
    def to_create_thing_type(self) -> "Iot":
        '''(experimental) Creates a new thing type.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateThingType.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateThingType", []))

    @jsii.member(jsii_name="toCreateTopicRule")
    def to_create_topic_rule(self) -> "Iot":
        '''(experimental) Creates a rule.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateTopicRule.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateTopicRule", []))

    @jsii.member(jsii_name="toCreateTopicRuleDestination")
    def to_create_topic_rule_destination(self) -> "Iot":
        '''(experimental) Creates a TopicRuleDestination.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateTopicRuleDestination.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateTopicRuleDestination", []))

    @jsii.member(jsii_name="toDeleteAccountAuditConfiguration")
    def to_delete_account_audit_configuration(self) -> "Iot":
        '''(experimental) Deletes the audit configuration associated with the account.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteAccountAuditConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteAccountAuditConfiguration", []))

    @jsii.member(jsii_name="toDeleteAuditSuppression")
    def to_delete_audit_suppression(self) -> "Iot":
        '''(experimental) Deletes a Device Defender audit suppression.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteAuditSuppression.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteAuditSuppression", []))

    @jsii.member(jsii_name="toDeleteAuthorizer")
    def to_delete_authorizer(self) -> "Iot":
        '''(experimental) Deletes the specified authorizer.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteAuthorizer.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteAuthorizer", []))

    @jsii.member(jsii_name="toDeleteBillingGroup")
    def to_delete_billing_group(self) -> "Iot":
        '''(experimental) Deletes the specified billing group.

        Access Level: Tagging

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteBillingGroup.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteBillingGroup", []))

    @jsii.member(jsii_name="toDeleteCACertificate")
    def to_delete_ca_certificate(self) -> "Iot":
        '''(experimental) Deletes a registered CA certificate.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteCACertificate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteCACertificate", []))

    @jsii.member(jsii_name="toDeleteCertificate")
    def to_delete_certificate(self) -> "Iot":
        '''(experimental) Deletes the specified certificate.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteCertificate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteCertificate", []))

    @jsii.member(jsii_name="toDeleteDimension")
    def to_delete_dimension(self) -> "Iot":
        '''(experimental) Removes the specified dimension from your AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteDimension.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteDimension", []))

    @jsii.member(jsii_name="toDeleteDomainConfiguration")
    def to_delete_domain_configuration(self) -> "Iot":
        '''(experimental) Deletes a domain configuration.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteDomainConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteDomainConfiguration", []))

    @jsii.member(jsii_name="toDeleteDynamicThingGroup")
    def to_delete_dynamic_thing_group(self) -> "Iot":
        '''(experimental) Deletes the specified Dynamic Thing Group.

        Access Level: Tagging

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteDynamicThingGroup.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteDynamicThingGroup", []))

    @jsii.member(jsii_name="toDeleteFleetMetric")
    def to_delete_fleet_metric(self) -> "Iot":
        '''(experimental) Deletes the specified fleet metric.

        Access Level: Tagging

        https://docs.aws.amazon.com/iot/latest/apireference/iot-indexing.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteFleetMetric", []))

    @jsii.member(jsii_name="toDeleteJob")
    def to_delete_job(self) -> "Iot":
        '''(experimental) Deletes a job and its related job executions.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteJob.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteJob", []))

    @jsii.member(jsii_name="toDeleteJobExecution")
    def to_delete_job_execution(self) -> "Iot":
        '''(experimental) Deletes a job execution.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteJobExecution.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteJobExecution", []))

    @jsii.member(jsii_name="toDeleteMitigationAction")
    def to_delete_mitigation_action(self) -> "Iot":
        '''(experimental) Deletes a defined mitigation action from your AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteMitigationAction.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteMitigationAction", []))

    @jsii.member(jsii_name="toDeleteOTAUpdate")
    def to_delete_ota_update(self) -> "Iot":
        '''(experimental) Deletes an OTA update job.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteOTAUpdate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteOTAUpdate", []))

    @jsii.member(jsii_name="toDeletePolicy")
    def to_delete_policy(self) -> "Iot":
        '''(experimental) Deletes the specified policy.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeletePolicy.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeletePolicy", []))

    @jsii.member(jsii_name="toDeletePolicyVersion")
    def to_delete_policy_version(self) -> "Iot":
        '''(experimental) Deletes the specified version of the specified policy.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeletePolicyVersion.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeletePolicyVersion", []))

    @jsii.member(jsii_name="toDeleteProvisioningTemplate")
    def to_delete_provisioning_template(self) -> "Iot":
        '''(experimental) Deletes a fleet provisioning template.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteProvisioningTemplate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteProvisioningTemplate", []))

    @jsii.member(jsii_name="toDeleteProvisioningTemplateVersion")
    def to_delete_provisioning_template_version(self) -> "Iot":
        '''(experimental) Deletes a fleet provisioning template version.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteProvisioningTemplateVersion.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteProvisioningTemplateVersion", []))

    @jsii.member(jsii_name="toDeleteRegistrationCode")
    def to_delete_registration_code(self) -> "Iot":
        '''(experimental) Deletes a CA certificate registration code.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteRegistrationCode.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteRegistrationCode", []))

    @jsii.member(jsii_name="toDeleteRoleAlias")
    def to_delete_role_alias(self) -> "Iot":
        '''(experimental) Deletes the specified role alias.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteRoleAlias.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteRoleAlias", []))

    @jsii.member(jsii_name="toDeleteScheduledAudit")
    def to_delete_scheduled_audit(self) -> "Iot":
        '''(experimental) Deletes a scheduled audit.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteScheduledAudit.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteScheduledAudit", []))

    @jsii.member(jsii_name="toDeleteSecurityProfile")
    def to_delete_security_profile(self) -> "Iot":
        '''(experimental) Deletes a Device Defender security profile.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteSecurityProfile.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteSecurityProfile", []))

    @jsii.member(jsii_name="toDeleteStream")
    def to_delete_stream(self) -> "Iot":
        '''(experimental) Deletes a specified stream.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteStream.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteStream", []))

    @jsii.member(jsii_name="toDeleteThing")
    def to_delete_thing(self) -> "Iot":
        '''(experimental) Deletes the specified thing.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteThing.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteThing", []))

    @jsii.member(jsii_name="toDeleteThingGroup")
    def to_delete_thing_group(self) -> "Iot":
        '''(experimental) Deletes the specified thing group.

        Access Level: Tagging

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteThingGroup.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteThingGroup", []))

    @jsii.member(jsii_name="toDeleteThingShadow")
    def to_delete_thing_shadow(self) -> "Iot":
        '''(experimental) Deletes the specified thing shadow.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/developerguide/policy-actions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteThingShadow", []))

    @jsii.member(jsii_name="toDeleteThingType")
    def to_delete_thing_type(self) -> "Iot":
        '''(experimental) Deletes the specified thing type.

        Access Level: Tagging

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteThingType.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteThingType", []))

    @jsii.member(jsii_name="toDeleteTopicRule")
    def to_delete_topic_rule(self) -> "Iot":
        '''(experimental) Deletes the specified rule.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteTopicRule.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteTopicRule", []))

    @jsii.member(jsii_name="toDeleteTopicRuleDestination")
    def to_delete_topic_rule_destination(self) -> "Iot":
        '''(experimental) Deletes a TopicRuleDestination.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteTopicRuleDestination.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteTopicRuleDestination", []))

    @jsii.member(jsii_name="toDeleteV2LoggingLevel")
    def to_delete_v2_logging_level(self) -> "Iot":
        '''(experimental) Deletes the specified v2 logging level.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteV2LoggingLevel.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteV2LoggingLevel", []))

    @jsii.member(jsii_name="toDeprecateThingType")
    def to_deprecate_thing_type(self) -> "Iot":
        '''(experimental) Deprecates the specified thing type.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeprecateThingType.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeprecateThingType", []))

    @jsii.member(jsii_name="toDescribeAccountAuditConfiguration")
    def to_describe_account_audit_configuration(self) -> "Iot":
        '''(experimental) Gets information about audit configurations for the account.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeAccountAuditConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeAccountAuditConfiguration", []))

    @jsii.member(jsii_name="toDescribeAuditFinding")
    def to_describe_audit_finding(self) -> "Iot":
        '''(experimental) Gets information about a single audit finding.

        Properties include the reason for noncompliance, the severity of the issue, and when the audit that returned the finding was started.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeAuditFinding.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeAuditFinding", []))

    @jsii.member(jsii_name="toDescribeAuditMitigationActionsTask")
    def to_describe_audit_mitigation_actions_task(self) -> "Iot":
        '''(experimental) Gets information about an audit mitigation task that is used to apply mitigation actions to a set of audit findings.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeAuditMitigationActionsTask.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeAuditMitigationActionsTask", []))

    @jsii.member(jsii_name="toDescribeAuditSuppression")
    def to_describe_audit_suppression(self) -> "Iot":
        '''(experimental) Gets information about a Device Defender audit suppression.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeAuditSuppression.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeAuditSuppression", []))

    @jsii.member(jsii_name="toDescribeAuditTask")
    def to_describe_audit_task(self) -> "Iot":
        '''(experimental) Gets information about a Device Defender audit.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeAuditTask.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeAuditTask", []))

    @jsii.member(jsii_name="toDescribeAuthorizer")
    def to_describe_authorizer(self) -> "Iot":
        '''(experimental) Describes an authorizer.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeAuthorizer.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeAuthorizer", []))

    @jsii.member(jsii_name="toDescribeBillingGroup")
    def to_describe_billing_group(self) -> "Iot":
        '''(experimental) Gets information about the specified billing group.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeBillingGroup.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeBillingGroup", []))

    @jsii.member(jsii_name="toDescribeCACertificate")
    def to_describe_ca_certificate(self) -> "Iot":
        '''(experimental) Describes a registered CA certificate.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeCACertificate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeCACertificate", []))

    @jsii.member(jsii_name="toDescribeCertificate")
    def to_describe_certificate(self) -> "Iot":
        '''(experimental) Gets information about the specified certificate.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeCertificate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeCertificate", []))

    @jsii.member(jsii_name="toDescribeDefaultAuthorizer")
    def to_describe_default_authorizer(self) -> "Iot":
        '''(experimental) Describes the default authorizer.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeDefaultAuthorizer.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeDefaultAuthorizer", []))

    @jsii.member(jsii_name="toDescribeDimension")
    def to_describe_dimension(self) -> "Iot":
        '''(experimental) Provides details about a dimension that is defined in your AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeDimension.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeDimension", []))

    @jsii.member(jsii_name="toDescribeDomainConfiguration")
    def to_describe_domain_configuration(self) -> "Iot":
        '''(experimental) Gets information about the domain configuration.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeDomainConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeDomainConfiguration", []))

    @jsii.member(jsii_name="toDescribeEndpoint")
    def to_describe_endpoint(self) -> "Iot":
        '''(experimental) Returns a unique endpoint specific to the AWS account making the call.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeEndpoint", []))

    @jsii.member(jsii_name="toDescribeEventConfigurations")
    def to_describe_event_configurations(self) -> "Iot":
        '''(experimental) Returns account event configurations.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeEventConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeEventConfigurations", []))

    @jsii.member(jsii_name="toDescribeFleetMetric")
    def to_describe_fleet_metric(self) -> "Iot":
        '''(experimental) Gets information about the specified fleet metric.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/iot-indexing.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeFleetMetric", []))

    @jsii.member(jsii_name="toDescribeIndex")
    def to_describe_index(self) -> "Iot":
        '''(experimental) Gets information about the specified index.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeIndex.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeIndex", []))

    @jsii.member(jsii_name="toDescribeJob")
    def to_describe_job(self) -> "Iot":
        '''(experimental) Describes a job.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeJob.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeJob", []))

    @jsii.member(jsii_name="toDescribeJobExecution")
    def to_describe_job_execution(self) -> "Iot":
        '''(experimental) Describes a job execution.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeJobExecution.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeJobExecution", []))

    @jsii.member(jsii_name="toDescribeMitigationAction")
    def to_describe_mitigation_action(self) -> "Iot":
        '''(experimental) Gets information about a mitigation action.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeMitigationAction.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeMitigationAction", []))

    @jsii.member(jsii_name="toDescribeProvisioningTemplate")
    def to_describe_provisioning_template(self) -> "Iot":
        '''(experimental) Returns information about a fleet provisioning template.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeProvisioningTemplate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeProvisioningTemplate", []))

    @jsii.member(jsii_name="toDescribeProvisioningTemplateVersion")
    def to_describe_provisioning_template_version(self) -> "Iot":
        '''(experimental) Returns information about a fleet provisioning template version.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeProvisioningTemplateVersion.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeProvisioningTemplateVersion", []))

    @jsii.member(jsii_name="toDescribeRoleAlias")
    def to_describe_role_alias(self) -> "Iot":
        '''(experimental) Describes a role alias.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeRoleAlias.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeRoleAlias", []))

    @jsii.member(jsii_name="toDescribeScheduledAudit")
    def to_describe_scheduled_audit(self) -> "Iot":
        '''(experimental) Gets information about a scheduled audit.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeScheduledAudit.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeScheduledAudit", []))

    @jsii.member(jsii_name="toDescribeSecurityProfile")
    def to_describe_security_profile(self) -> "Iot":
        '''(experimental) Gets information about a Device Defender security profile.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeSecurityProfile.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeSecurityProfile", []))

    @jsii.member(jsii_name="toDescribeStream")
    def to_describe_stream(self) -> "Iot":
        '''(experimental) Gets information about the specified stream.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeStream.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeStream", []))

    @jsii.member(jsii_name="toDescribeThing")
    def to_describe_thing(self) -> "Iot":
        '''(experimental) Gets information about the specified thing.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeThing.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeThing", []))

    @jsii.member(jsii_name="toDescribeThingGroup")
    def to_describe_thing_group(self) -> "Iot":
        '''(experimental) Gets information about the specified thing group.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeThingGroup.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeThingGroup", []))

    @jsii.member(jsii_name="toDescribeThingRegistrationTask")
    def to_describe_thing_registration_task(self) -> "Iot":
        '''(experimental) Gets information about the bulk thing registration task.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeThingRegistrationTask.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeThingRegistrationTask", []))

    @jsii.member(jsii_name="toDescribeThingType")
    def to_describe_thing_type(self) -> "Iot":
        '''(experimental) Gets information about the specified thing type.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeThingType.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeThingType", []))

    @jsii.member(jsii_name="toDescribeTunnel")
    def to_describe_tunnel(self) -> "Iot":
        '''(experimental) Describes a tunnel.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeTunnel.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeTunnel", []))

    @jsii.member(jsii_name="toDetachPolicy")
    def to_detach_policy(self) -> "Iot":
        '''(experimental) Detaches a policy from the specified target.

        Access Level: Permissions management

        https://docs.aws.amazon.com/iot/latest/apireference/API_DetachPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDetachPolicy", []))

    @jsii.member(jsii_name="toDetachPrincipalPolicy")
    def to_detach_principal_policy(self) -> "Iot":
        '''(experimental) Removes the specified policy from the specified certificate.

        Access Level: Permissions management

        https://docs.aws.amazon.com/iot/latest/apireference/API_DetachPrincipalPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDetachPrincipalPolicy", []))

    @jsii.member(jsii_name="toDetachSecurityProfile")
    def to_detach_security_profile(self) -> "Iot":
        '''(experimental) Disassociates a Device Defender security profile from a thing group or from this account.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DetachSecurityProfile.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDetachSecurityProfile", []))

    @jsii.member(jsii_name="toDetachThingPrincipal")
    def to_detach_thing_principal(self) -> "Iot":
        '''(experimental) Detaches the specified principal from the specified thing.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DetachThingPrincipal.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDetachThingPrincipal", []))

    @jsii.member(jsii_name="toDisableTopicRule")
    def to_disable_topic_rule(self) -> "Iot":
        '''(experimental) Disables the specified rule.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DisableTopicRule.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDisableTopicRule", []))

    @jsii.member(jsii_name="toEnableTopicRule")
    def to_enable_topic_rule(self) -> "Iot":
        '''(experimental) Enables the specified rule.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_EnableTopicRule.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toEnableTopicRule", []))

    @jsii.member(jsii_name="toGetBucketsAggregation")
    def to_get_buckets_aggregation(self) -> "Iot":
        '''(experimental) Get buckets aggregation for IoT fleet index.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/iot-indexing.html.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toGetBucketsAggregation", []))

    @jsii.member(jsii_name="toGetCardinality")
    def to_get_cardinality(self) -> "Iot":
        '''(experimental) Get cardinality for IoT fleet index.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_GetCardinality.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toGetCardinality", []))

    @jsii.member(jsii_name="toGetEffectivePolicies")
    def to_get_effective_policies(self) -> "Iot":
        '''(experimental) Gets effective policies.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_GetEffectivePolicies.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toGetEffectivePolicies", []))

    @jsii.member(jsii_name="toGetIndexingConfiguration")
    def to_get_indexing_configuration(self) -> "Iot":
        '''(experimental) Gets current fleet indexing configuration.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_GetIndexingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toGetIndexingConfiguration", []))

    @jsii.member(jsii_name="toGetJobDocument")
    def to_get_job_document(self) -> "Iot":
        '''(experimental) Gets a job document.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_GetJobDocument.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toGetJobDocument", []))

    @jsii.member(jsii_name="toGetLoggingOptions")
    def to_get_logging_options(self) -> "Iot":
        '''(experimental) Gets the logging options.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_GetLoggingOptions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toGetLoggingOptions", []))

    @jsii.member(jsii_name="toGetOTAUpdate")
    def to_get_ota_update(self) -> "Iot":
        '''(experimental) Gets the information about the OTA update job.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_GetOTAUpdate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toGetOTAUpdate", []))

    @jsii.member(jsii_name="toGetPendingJobExecutions")
    def to_get_pending_job_executions(self) -> "Iot":
        '''(experimental) Gets the list of all jobs for a thing that are not in a terminal state.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_GetPendingJobExecutions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toGetPendingJobExecutions", []))

    @jsii.member(jsii_name="toGetPercentiles")
    def to_get_percentiles(self) -> "Iot":
        '''(experimental) Get percentiles for IoT fleet index.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_GetPercentiles.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toGetPercentiles", []))

    @jsii.member(jsii_name="toGetPolicy")
    def to_get_policy(self) -> "Iot":
        '''(experimental) Gets information about the specified policy with the policy document of the default version.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_GetPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toGetPolicy", []))

    @jsii.member(jsii_name="toGetPolicyVersion")
    def to_get_policy_version(self) -> "Iot":
        '''(experimental) Gets information about the specified policy version.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_GetPolicyVersion.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toGetPolicyVersion", []))

    @jsii.member(jsii_name="toGetRegistrationCode")
    def to_get_registration_code(self) -> "Iot":
        '''(experimental) Gets a registration code used to register a CA certificate with AWS IoT.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_GetRegistrationCode.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toGetRegistrationCode", []))

    @jsii.member(jsii_name="toGetStatistics")
    def to_get_statistics(self) -> "Iot":
        '''(experimental) Get statistics for IoT fleet index.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_GetStatistics.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toGetStatistics", []))

    @jsii.member(jsii_name="toGetThingShadow")
    def to_get_thing_shadow(self) -> "Iot":
        '''(experimental) Gets the thing shadow.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/developerguide/policy-actions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toGetThingShadow", []))

    @jsii.member(jsii_name="toGetTopicRule")
    def to_get_topic_rule(self) -> "Iot":
        '''(experimental) Gets information about the specified rule.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_GetTopicRule.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toGetTopicRule", []))

    @jsii.member(jsii_name="toGetTopicRuleDestination")
    def to_get_topic_rule_destination(self) -> "Iot":
        '''(experimental) Gets a TopicRuleDestination.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_GetTopicRuleDestination.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toGetTopicRuleDestination", []))

    @jsii.member(jsii_name="toGetV2LoggingOptions")
    def to_get_v2_logging_options(self) -> "Iot":
        '''(experimental) Gets v2 logging options.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_GetV2LoggingOptions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toGetV2LoggingOptions", []))

    @jsii.member(jsii_name="toListActiveViolations")
    def to_list_active_violations(self) -> "Iot":
        '''(experimental) Lists the active violations for a given Device Defender security profile or Thing.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListActiveViolations.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListActiveViolations", []))

    @jsii.member(jsii_name="toListAttachedPolicies")
    def to_list_attached_policies(self) -> "Iot":
        '''(experimental) Lists the policies attached to the specified thing group.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListAttachedPolicies.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListAttachedPolicies", []))

    @jsii.member(jsii_name="toListAuditFindings")
    def to_list_audit_findings(self) -> "Iot":
        '''(experimental) Lists the findings (results) of a Device Defender audit or of the audits performed during a specified time period.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListAuditFindings.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListAuditFindings", []))

    @jsii.member(jsii_name="toListAuditMitigationActionsExecutions")
    def to_list_audit_mitigation_actions_executions(self) -> "Iot":
        '''(experimental) Gets the status of audit mitigation action tasks that were executed.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListAuditMitigationActionsExecutions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListAuditMitigationActionsExecutions", []))

    @jsii.member(jsii_name="toListAuditMitigationActionsTasks")
    def to_list_audit_mitigation_actions_tasks(self) -> "Iot":
        '''(experimental) Gets a list of audit mitigation action tasks that match the specified filters.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListAuditMitigationActionsTasks.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListAuditMitigationActionsTasks", []))

    @jsii.member(jsii_name="toListAuditSuppressions")
    def to_list_audit_suppressions(self) -> "Iot":
        '''(experimental) Lists your Device Defender audit suppressions.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListAuditSuppressions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListAuditSuppressions", []))

    @jsii.member(jsii_name="toListAuditTasks")
    def to_list_audit_tasks(self) -> "Iot":
        '''(experimental) Lists the Device Defender audits that have been performed during a given time period.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListAuditTasks.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListAuditTasks", []))

    @jsii.member(jsii_name="toListAuthorizers")
    def to_list_authorizers(self) -> "Iot":
        '''(experimental) Lists the authorizers registered in your account.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListAuthorizers.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListAuthorizers", []))

    @jsii.member(jsii_name="toListBillingGroups")
    def to_list_billing_groups(self) -> "Iot":
        '''(experimental) Lists all billing groups.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListBillingGroups.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListBillingGroups", []))

    @jsii.member(jsii_name="toListCACertificates")
    def to_list_ca_certificates(self) -> "Iot":
        '''(experimental) Lists the CA certificates registered for your AWS account.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListCACertificates.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListCACertificates", []))

    @jsii.member(jsii_name="toListCertificates")
    def to_list_certificates(self) -> "Iot":
        '''(experimental) Lists your certificates.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListCertificates.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListCertificates", []))

    @jsii.member(jsii_name="toListCertificatesByCA")
    def to_list_certificates_by_ca(self) -> "Iot":
        '''(experimental) List the device certificates signed by the specified CA certificate.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListCertificatesByCA.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListCertificatesByCA", []))

    @jsii.member(jsii_name="toListDimensions")
    def to_list_dimensions(self) -> "Iot":
        '''(experimental) Lists the dimensions that are defined for your AWS account.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListDimensions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListDimensions", []))

    @jsii.member(jsii_name="toListDomainConfigurations")
    def to_list_domain_configurations(self) -> "Iot":
        '''(experimental) Lists the domain configuration created by your AWS account.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListDomainConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListDomainConfigurations", []))

    @jsii.member(jsii_name="toListFleetMetrics")
    def to_list_fleet_metrics(self) -> "Iot":
        '''(experimental) Lists the fleet metrics in your account.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/iot-indexing.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListFleetMetrics", []))

    @jsii.member(jsii_name="toListIndices")
    def to_list_indices(self) -> "Iot":
        '''(experimental) Lists all indices for fleet index.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListIndices.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListIndices", []))

    @jsii.member(jsii_name="toListJobExecutionsForJob")
    def to_list_job_executions_for_job(self) -> "Iot":
        '''(experimental) Lists the job executions for a job.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListJobExecutionsForJob.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListJobExecutionsForJob", []))

    @jsii.member(jsii_name="toListJobExecutionsForThing")
    def to_list_job_executions_for_thing(self) -> "Iot":
        '''(experimental) Lists the job executions for the specified thing.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListJobExecutionsForThing.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListJobExecutionsForThing", []))

    @jsii.member(jsii_name="toListJobs")
    def to_list_jobs(self) -> "Iot":
        '''(experimental) Lists jobs.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListJobs.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListJobs", []))

    @jsii.member(jsii_name="toListMitigationActions")
    def to_list_mitigation_actions(self) -> "Iot":
        '''(experimental) Gets a list of all mitigation actions that match the specified filter criteria.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListMitigationActions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListMitigationActions", []))

    @jsii.member(jsii_name="toListNamedShadowsForThing")
    def to_list_named_shadows_for_thing(self) -> "Iot":
        '''(experimental) Lists all named shadows for a given thing.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListNamedShadowsForThing.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListNamedShadowsForThing", []))

    @jsii.member(jsii_name="toListOTAUpdates")
    def to_list_ota_updates(self) -> "Iot":
        '''(experimental) Lists OTA update jobs in the account.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListOTAUpdates.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListOTAUpdates", []))

    @jsii.member(jsii_name="toListOutgoingCertificates")
    def to_list_outgoing_certificates(self) -> "Iot":
        '''(experimental) Lists certificates that are being transfered but not yet accepted.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListOutgoingCertificates.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListOutgoingCertificates", []))

    @jsii.member(jsii_name="toListPolicies")
    def to_list_policies(self) -> "Iot":
        '''(experimental) Lists your policies.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListPolicies.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListPolicies", []))

    @jsii.member(jsii_name="toListPolicyPrincipals")
    def to_list_policy_principals(self) -> "Iot":
        '''(experimental) Lists the principals associated with the specified policy.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListPolicyPrincipals.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListPolicyPrincipals", []))

    @jsii.member(jsii_name="toListPolicyVersions")
    def to_list_policy_versions(self) -> "Iot":
        '''(experimental) Lists the versions of the specified policy, and identifies the default version.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListPolicyVersions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListPolicyVersions", []))

    @jsii.member(jsii_name="toListPrincipalPolicies")
    def to_list_principal_policies(self) -> "Iot":
        '''(experimental) Lists the policies attached to the specified principal.

        If you use an Amazon Cognito identity, the ID needs to be in Amazon Cognito Identity format.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListPrincipalPolicies.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListPrincipalPolicies", []))

    @jsii.member(jsii_name="toListPrincipalThings")
    def to_list_principal_things(self) -> "Iot":
        '''(experimental) Lists the things associated with the specified principal.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListPrincipalThings.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListPrincipalThings", []))

    @jsii.member(jsii_name="toListProvisioningTemplates")
    def to_list_provisioning_templates(self) -> "Iot":
        '''(experimental) Lists the fleet provisioning templates in your AWS account.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListProvisioningTemplates.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListProvisioningTemplates", []))

    @jsii.member(jsii_name="toListProvisioningTemplateVersions")
    def to_list_provisioning_template_versions(self) -> "Iot":
        '''(experimental) A list of fleet provisioning template versions.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListProvisioningTemplateVersions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListProvisioningTemplateVersions", []))

    @jsii.member(jsii_name="toListRoleAliases")
    def to_list_role_aliases(self) -> "Iot":
        '''(experimental) Lists role aliases.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListRoleAliases.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListRoleAliases", []))

    @jsii.member(jsii_name="toListScheduledAudits")
    def to_list_scheduled_audits(self) -> "Iot":
        '''(experimental) Lists all of your scheduled audits.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListScheduledAudits.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListScheduledAudits", []))

    @jsii.member(jsii_name="toListSecurityProfiles")
    def to_list_security_profiles(self) -> "Iot":
        '''(experimental) Lists the Device Defender security profiles you have created.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListSecurityProfiles.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListSecurityProfiles", []))

    @jsii.member(jsii_name="toListSecurityProfilesForTarget")
    def to_list_security_profiles_for_target(self) -> "Iot":
        '''(experimental) Lists the Device Defender security profiles attached to a target.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListSecurityProfilesForTarget.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListSecurityProfilesForTarget", []))

    @jsii.member(jsii_name="toListStreams")
    def to_list_streams(self) -> "Iot":
        '''(experimental) Lists the streams in your account.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListStreams.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListStreams", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Iot":
        '''(experimental) Lists all tags for a given resource.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTargetsForPolicy")
    def to_list_targets_for_policy(self) -> "Iot":
        '''(experimental) List targets for the specified policy.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListTargetsForPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListTargetsForPolicy", []))

    @jsii.member(jsii_name="toListTargetsForSecurityProfile")
    def to_list_targets_for_security_profile(self) -> "Iot":
        '''(experimental) Lists the targets associated with a given Device Defender security profile.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListTargetsForSecurityProfile.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListTargetsForSecurityProfile", []))

    @jsii.member(jsii_name="toListThingGroups")
    def to_list_thing_groups(self) -> "Iot":
        '''(experimental) Lists all thing groups.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListThingGroups.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListThingGroups", []))

    @jsii.member(jsii_name="toListThingGroupsForThing")
    def to_list_thing_groups_for_thing(self) -> "Iot":
        '''(experimental) List thing groups to which the specified thing belongs.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListThingGroupsForThing.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListThingGroupsForThing", []))

    @jsii.member(jsii_name="toListThingPrincipals")
    def to_list_thing_principals(self) -> "Iot":
        '''(experimental) Lists the principals associated with the specified thing.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListThingPrincipals.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListThingPrincipals", []))

    @jsii.member(jsii_name="toListThingRegistrationTaskReports")
    def to_list_thing_registration_task_reports(self) -> "Iot":
        '''(experimental) Lists information about bulk thing registration tasks.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListThingRegistrationTaskReports.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListThingRegistrationTaskReports", []))

    @jsii.member(jsii_name="toListThingRegistrationTasks")
    def to_list_thing_registration_tasks(self) -> "Iot":
        '''(experimental) Lists bulk thing registration tasks.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListThingRegistrationTasks.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListThingRegistrationTasks", []))

    @jsii.member(jsii_name="toListThings")
    def to_list_things(self) -> "Iot":
        '''(experimental) Lists all things.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListThings.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListThings", []))

    @jsii.member(jsii_name="toListThingsInBillingGroup")
    def to_list_things_in_billing_group(self) -> "Iot":
        '''(experimental) Lists all things in the specified billing group.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListThingsInBillingGroup.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListThingsInBillingGroup", []))

    @jsii.member(jsii_name="toListThingsInThingGroup")
    def to_list_things_in_thing_group(self) -> "Iot":
        '''(experimental) Lists all things in the specified thing group.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListThingsInThingGroup.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListThingsInThingGroup", []))

    @jsii.member(jsii_name="toListThingTypes")
    def to_list_thing_types(self) -> "Iot":
        '''(experimental) Lists all thing types.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListThingTypes.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListThingTypes", []))

    @jsii.member(jsii_name="toListTopicRuleDestinations")
    def to_list_topic_rule_destinations(self) -> "Iot":
        '''(experimental) Lists all TopicRuleDestinations.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListTopicRuleDestinations.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListTopicRuleDestinations", []))

    @jsii.member(jsii_name="toListTopicRules")
    def to_list_topic_rules(self) -> "Iot":
        '''(experimental) Lists the rules for the specific topic.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListTopicRules.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListTopicRules", []))

    @jsii.member(jsii_name="toListTunnels")
    def to_list_tunnels(self) -> "Iot":
        '''(experimental) Lists tunnels.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListTunnels.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListTunnels", []))

    @jsii.member(jsii_name="toListV2LoggingLevels")
    def to_list_v2_logging_levels(self) -> "Iot":
        '''(experimental) Lists the v2 logging levels.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListV2LoggingLevels.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListV2LoggingLevels", []))

    @jsii.member(jsii_name="toListViolationEvents")
    def to_list_violation_events(self) -> "Iot":
        '''(experimental) Lists the Device Defender security profile violations discovered during the given time period.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListViolationEvents.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListViolationEvents", []))

    @jsii.member(jsii_name="toOpenTunnel")
    def to_open_tunnel(self) -> "Iot":
        '''(experimental) Opens a tunnel.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifThingGroupArn()
        - .ifTunnelDestinationService()

        https://docs.aws.amazon.com/iot/latest/apireference/API_OpenTunnel.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toOpenTunnel", []))

    @jsii.member(jsii_name="toPublish")
    def to_publish(self) -> "Iot":
        '''(experimental) Publish to the specified topic.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/developerguide/policy-actions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toPublish", []))

    @jsii.member(jsii_name="toReceive")
    def to_receive(self) -> "Iot":
        '''(experimental) Receive from the specified topic.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/developerguide/policy-actions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toReceive", []))

    @jsii.member(jsii_name="toRegisterCACertificate")
    def to_register_ca_certificate(self) -> "Iot":
        '''(experimental) Registers a CA certificate with AWS IoT.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/iot/latest/apireference/API_RegisterCACertificate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toRegisterCACertificate", []))

    @jsii.member(jsii_name="toRegisterCertificate")
    def to_register_certificate(self) -> "Iot":
        '''(experimental) Registers a device certificate with AWS IoT.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_RegisterCertificate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toRegisterCertificate", []))

    @jsii.member(jsii_name="toRegisterCertificateWithoutCA")
    def to_register_certificate_without_ca(self) -> "Iot":
        '''(experimental) Registers a device certificate with AWS IoT without a registered CA (certificate authority).

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_RegisterCertificateWithoutCA.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toRegisterCertificateWithoutCA", []))

    @jsii.member(jsii_name="toRegisterThing")
    def to_register_thing(self) -> "Iot":
        '''(experimental) Registers your thing.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_RegisterThing.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toRegisterThing", []))

    @jsii.member(jsii_name="toRejectCertificateTransfer")
    def to_reject_certificate_transfer(self) -> "Iot":
        '''(experimental) Rejects a pending certificate transfer.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_RejectCertificateTransfer.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toRejectCertificateTransfer", []))

    @jsii.member(jsii_name="toRemoveThingFromBillingGroup")
    def to_remove_thing_from_billing_group(self) -> "Iot":
        '''(experimental) Removes thing from the specified billing group.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_RemoveThingFromBillingGroup.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toRemoveThingFromBillingGroup", []))

    @jsii.member(jsii_name="toRemoveThingFromThingGroup")
    def to_remove_thing_from_thing_group(self) -> "Iot":
        '''(experimental) Removes thing from the specified thing group.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_RemoveThingFromThingGroup.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toRemoveThingFromThingGroup", []))

    @jsii.member(jsii_name="toReplaceTopicRule")
    def to_replace_topic_rule(self) -> "Iot":
        '''(experimental) Replaces the specified rule.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_ReplaceTopicRule.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toReplaceTopicRule", []))

    @jsii.member(jsii_name="toSearchIndex")
    def to_search_index(self) -> "Iot":
        '''(experimental) Search IoT fleet index.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_SearchIndex.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toSearchIndex", []))

    @jsii.member(jsii_name="toSetDefaultAuthorizer")
    def to_set_default_authorizer(self) -> "Iot":
        '''(experimental) Sets the default authorizer. This will be used if a websocket connection is made without specifying an authorizer.

        Access Level: Permissions management

        https://docs.aws.amazon.com/iot/latest/apireference/API_SetDefaultAuthorizer.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toSetDefaultAuthorizer", []))

    @jsii.member(jsii_name="toSetDefaultPolicyVersion")
    def to_set_default_policy_version(self) -> "Iot":
        '''(experimental) Sets the specified version of the specified policy as the policy's default (operative) version.

        Access Level: Permissions management

        https://docs.aws.amazon.com/iot/latest/apireference/API_SetDefaultPolicyVersion.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toSetDefaultPolicyVersion", []))

    @jsii.member(jsii_name="toSetLoggingOptions")
    def to_set_logging_options(self) -> "Iot":
        '''(experimental) Sets the logging options.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_SetLoggingOptions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toSetLoggingOptions", []))

    @jsii.member(jsii_name="toSetV2LoggingLevel")
    def to_set_v2_logging_level(self) -> "Iot":
        '''(experimental) Sets the v2 logging level.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_SetV2LoggingLevel.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toSetV2LoggingLevel", []))

    @jsii.member(jsii_name="toSetV2LoggingOptions")
    def to_set_v2_logging_options(self) -> "Iot":
        '''(experimental) Sets the v2 logging options.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_SetV2LoggingOptions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toSetV2LoggingOptions", []))

    @jsii.member(jsii_name="toStartAuditMitigationActionsTask")
    def to_start_audit_mitigation_actions_task(self) -> "Iot":
        '''(experimental) Starts a task that applies a set of mitigation actions to the specified target.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_StartAuditMitigationActionsTask.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toStartAuditMitigationActionsTask", []))

    @jsii.member(jsii_name="toStartNextPendingJobExecution")
    def to_start_next_pending_job_execution(self) -> "Iot":
        '''(experimental) Gets and starts the next pending job execution for a thing.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_StartNextPendingJobExecution.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toStartNextPendingJobExecution", []))

    @jsii.member(jsii_name="toStartOnDemandAuditTask")
    def to_start_on_demand_audit_task(self) -> "Iot":
        '''(experimental) Starts an on-demand Device Defender audit.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_StartOnDemandAuditTask.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toStartOnDemandAuditTask", []))

    @jsii.member(jsii_name="toStartThingRegistrationTask")
    def to_start_thing_registration_task(self) -> "Iot":
        '''(experimental) Starts a bulk thing registration task.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_StartThingRegistrationTask.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toStartThingRegistrationTask", []))

    @jsii.member(jsii_name="toStopThingRegistrationTask")
    def to_stop_thing_registration_task(self) -> "Iot":
        '''(experimental) Stops a bulk thing registration task.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_StopThingRegistrationTask.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toStopThingRegistrationTask", []))

    @jsii.member(jsii_name="toSubscribe")
    def to_subscribe(self) -> "Iot":
        '''(experimental) Subscribe to the specified TopicFilter.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/developerguide/policy-actions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toSubscribe", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Iot":
        '''(experimental) Tag a specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTestAuthorization")
    def to_test_authorization(self) -> "Iot":
        '''(experimental) Test the policies evaluation for group policies.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_TestAuthorization.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toTestAuthorization", []))

    @jsii.member(jsii_name="toTestInvokeAuthorizer")
    def to_test_invoke_authorizer(self) -> "Iot":
        '''(experimental) Invoke the specified custom authorizer for testing purposes.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_TestInvokeAuthorizer.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toTestInvokeAuthorizer", []))

    @jsii.member(jsii_name="toTransferCertificate")
    def to_transfer_certificate(self) -> "Iot":
        '''(experimental) Transfers the specified certificate to the specified AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_TransferCertificate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toTransferCertificate", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Iot":
        '''(experimental) Untag a specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAccountAuditConfiguration")
    def to_update_account_audit_configuration(self) -> "Iot":
        '''(experimental) Configures or reconfigures the Device Defender audit settings for this account.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateAccountAuditConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateAccountAuditConfiguration", []))

    @jsii.member(jsii_name="toUpdateAuditSuppression")
    def to_update_audit_suppression(self) -> "Iot":
        '''(experimental) Updates a Device Defender audit suppression.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateAuditSuppression.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateAuditSuppression", []))

    @jsii.member(jsii_name="toUpdateAuthorizer")
    def to_update_authorizer(self) -> "Iot":
        '''(experimental) Updates an authorizer.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateAuthorizer.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateAuthorizer", []))

    @jsii.member(jsii_name="toUpdateBillingGroup")
    def to_update_billing_group(self) -> "Iot":
        '''(experimental) Updates information associated with the specified billing group.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateBillingGroup.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateBillingGroup", []))

    @jsii.member(jsii_name="toUpdateCACertificate")
    def to_update_ca_certificate(self) -> "Iot":
        '''(experimental) Updates a registered CA certificate.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateCACertificate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateCACertificate", []))

    @jsii.member(jsii_name="toUpdateCertificate")
    def to_update_certificate(self) -> "Iot":
        '''(experimental) Updates the status of the specified certificate. This operation is idempotent.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateCertificate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateCertificate", []))

    @jsii.member(jsii_name="toUpdateDimension")
    def to_update_dimension(self) -> "Iot":
        '''(experimental) Updates the definition for a dimension.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateDimension.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateDimension", []))

    @jsii.member(jsii_name="toUpdateDomainConfiguration")
    def to_update_domain_configuration(self) -> "Iot":
        '''(experimental) Updates a domain configuration.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateDomainConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateDomainConfiguration", []))

    @jsii.member(jsii_name="toUpdateDynamicThingGroup")
    def to_update_dynamic_thing_group(self) -> "Iot":
        '''(experimental) Updates a Dynamic Thing Group.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateDynamicThingGroup.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateDynamicThingGroup", []))

    @jsii.member(jsii_name="toUpdateEventConfigurations")
    def to_update_event_configurations(self) -> "Iot":
        '''(experimental) Updates event configurations.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateEventConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateEventConfigurations", []))

    @jsii.member(jsii_name="toUpdateFleetMetric")
    def to_update_fleet_metric(self) -> "Iot":
        '''(experimental) Updates a fleet metric.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/iot-indexing.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateFleetMetric", []))

    @jsii.member(jsii_name="toUpdateIndexingConfiguration")
    def to_update_indexing_configuration(self) -> "Iot":
        '''(experimental) Updates fleet indexing configuration.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateIndexingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateIndexingConfiguration", []))

    @jsii.member(jsii_name="toUpdateJob")
    def to_update_job(self) -> "Iot":
        '''(experimental) Updates a job.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateJob.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateJob", []))

    @jsii.member(jsii_name="toUpdateJobExecution")
    def to_update_job_execution(self) -> "Iot":
        '''(experimental) Updates a job execution.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateJobExecution.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateJobExecution", []))

    @jsii.member(jsii_name="toUpdateMitigationAction")
    def to_update_mitigation_action(self) -> "Iot":
        '''(experimental) Updates the definition for the specified mitigation action.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateMitigationAction.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateMitigationAction", []))

    @jsii.member(jsii_name="toUpdateProvisioningTemplate")
    def to_update_provisioning_template(self) -> "Iot":
        '''(experimental) Updates a fleet provisioning template.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateProvisioningTemplate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateProvisioningTemplate", []))

    @jsii.member(jsii_name="toUpdateRoleAlias")
    def to_update_role_alias(self) -> "Iot":
        '''(experimental) Updates the role alias.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateRoleAlias.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateRoleAlias", []))

    @jsii.member(jsii_name="toUpdateScheduledAudit")
    def to_update_scheduled_audit(self) -> "Iot":
        '''(experimental) Updates a scheduled audit, including what checks are performed and how often the audit takes place.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateScheduledAudit.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateScheduledAudit", []))

    @jsii.member(jsii_name="toUpdateSecurityProfile")
    def to_update_security_profile(self) -> "Iot":
        '''(experimental) Updates a Device Defender security profile.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateSecurityProfile.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateSecurityProfile", []))

    @jsii.member(jsii_name="toUpdateStream")
    def to_update_stream(self) -> "Iot":
        '''(experimental) Updates the data for a stream.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateStream.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateStream", []))

    @jsii.member(jsii_name="toUpdateThing")
    def to_update_thing(self) -> "Iot":
        '''(experimental) Updates information associated with the specified thing.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateThing.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateThing", []))

    @jsii.member(jsii_name="toUpdateThingGroup")
    def to_update_thing_group(self) -> "Iot":
        '''(experimental) Updates information associated with the specified thing group.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateThingGroup.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateThingGroup", []))

    @jsii.member(jsii_name="toUpdateThingGroupsForThing")
    def to_update_thing_groups_for_thing(self) -> "Iot":
        '''(experimental) Updates the thing groups to which the thing belongs.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateThingGroupsForThing.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateThingGroupsForThing", []))

    @jsii.member(jsii_name="toUpdateThingShadow")
    def to_update_thing_shadow(self) -> "Iot":
        '''(experimental) Updates the thing shadow.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/developerguide/policy-actions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateThingShadow", []))

    @jsii.member(jsii_name="toUpdateTopicRuleDestination")
    def to_update_topic_rule_destination(self) -> "Iot":
        '''(experimental) Updates a TopicRuleDestination.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateTopicRuleDestination.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateTopicRuleDestination", []))

    @jsii.member(jsii_name="toValidateSecurityProfileBehaviors")
    def to_validate_security_profile_behaviors(self) -> "Iot":
        '''(experimental) Validates a Device Defender security profile behaviors specification.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_ValidateSecurityProfileBehaviors.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toValidateSecurityProfileBehaviors", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Iot1click(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Iot1click",
):
    '''(experimental) Statement provider for service `iot1click <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot1-click.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `iot1click <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot1-click.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Iot1click, self, [sid])

    @jsii.member(jsii_name="onDevice")
    def on_device(
        self,
        device_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot1click":
        '''(experimental) Adds a resource of type device to the statement.

        https://docs.aws.amazon.com/iot-1-click/1.0/devices-apireference/resources.html

        :param device_id: - Identifier for the deviceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "onDevice", [device_id, account, region, partition]))

    @jsii.member(jsii_name="onProject")
    def on_project(
        self,
        project_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot1click":
        '''(experimental) Adds a resource of type project to the statement.

        https://docs.aws.amazon.com/iot-1-click/latest/projects-apireference/API_Operations.html

        :param project_name: - Identifier for the projectName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "onProject", [project_name, account, region, partition]))

    @jsii.member(jsii_name="toAssociateDeviceWithPlacement")
    def to_associate_device_with_placement(self) -> "Iot1click":
        '''(experimental) Grants permission to associate a device to a placement.

        Access Level: Write

        https://docs.aws.amazon.com/iot-1-click/latest/projects-apireference/API_AssociateDeviceWithPlacement.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toAssociateDeviceWithPlacement", []))

    @jsii.member(jsii_name="toClaimDevicesByClaimCode")
    def to_claim_devices_by_claim_code(self) -> "Iot1click":
        '''(experimental) Grants permission to claim a batch of devices with a claim code.

        Access Level: Read

        https://docs.aws.amazon.com/iot-1-click/1.0/devices-apireference/claims-claimcode.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toClaimDevicesByClaimCode", []))

    @jsii.member(jsii_name="toCreatePlacement")
    def to_create_placement(self) -> "Iot1click":
        '''(experimental) Grants permission to create a new placement in a project.

        Access Level: Write

        https://docs.aws.amazon.com/iot-1-click/latest/projects-apireference/API_CreatePlacement.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toCreatePlacement", []))

    @jsii.member(jsii_name="toCreateProject")
    def to_create_project(self) -> "Iot1click":
        '''(experimental) Grants permission to create a new project.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-1-click/latest/projects-apireference/API_CreateProject.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toCreateProject", []))

    @jsii.member(jsii_name="toDeletePlacement")
    def to_delete_placement(self) -> "Iot1click":
        '''(experimental) Grants permission to delete a placement from a project.

        Access Level: Write

        https://docs.aws.amazon.com/iot-1-click/latest/projects-apireference/API_DeletePlacement.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toDeletePlacement", []))

    @jsii.member(jsii_name="toDeleteProject")
    def to_delete_project(self) -> "Iot1click":
        '''(experimental) Grants permission to delete a project.

        Access Level: Write

        https://docs.aws.amazon.com/iot-1-click/latest/projects-apireference/API_DeleteProject.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toDeleteProject", []))

    @jsii.member(jsii_name="toDescribeDevice")
    def to_describe_device(self) -> "Iot1click":
        '''(experimental) Grants permission to describe a device.

        Access Level: Read

        https://docs.aws.amazon.com/iot-1-click/1.0/devices-apireference/devices-deviceid.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toDescribeDevice", []))

    @jsii.member(jsii_name="toDescribePlacement")
    def to_describe_placement(self) -> "Iot1click":
        '''(experimental) Grants permission to describe a placement.

        Access Level: Read

        https://docs.aws.amazon.com/iot-1-click/latest/projects-apireference/API_DescribePlacement.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toDescribePlacement", []))

    @jsii.member(jsii_name="toDescribeProject")
    def to_describe_project(self) -> "Iot1click":
        '''(experimental) Grants permission to describe a project.

        Access Level: Read

        https://docs.aws.amazon.com/iot-1-click/latest/projects-apireference/API_DescribeProject.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toDescribeProject", []))

    @jsii.member(jsii_name="toDisassociateDeviceFromPlacement")
    def to_disassociate_device_from_placement(self) -> "Iot1click":
        '''(experimental) Grants permission to disassociate a device from a placement.

        Access Level: Write

        https://docs.aws.amazon.com/iot-1-click/latest/projects-apireference/API_DissacociateDeviceFromPlacement.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toDisassociateDeviceFromPlacement", []))

    @jsii.member(jsii_name="toFinalizeDeviceClaim")
    def to_finalize_device_claim(self) -> "Iot1click":
        '''(experimental) Grants permission to finalize a device claim.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-1-click/1.0/devices-apireference/devices-deviceid-finalize-claim.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toFinalizeDeviceClaim", []))

    @jsii.member(jsii_name="toGetDeviceMethods")
    def to_get_device_methods(self) -> "Iot1click":
        '''(experimental) Grants permission to get available methods of a device.

        Access Level: Read

        https://docs.aws.amazon.com/iot-1-click/1.0/devices-apireference/devices-deviceid-methods.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toGetDeviceMethods", []))

    @jsii.member(jsii_name="toGetDevicesInPlacement")
    def to_get_devices_in_placement(self) -> "Iot1click":
        '''(experimental) Grants permission to get devices associated to a placement.

        Access Level: Read

        https://docs.aws.amazon.com/iot-1-click/latest/projects-apireference/API_GetDevicesInPlacement.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toGetDevicesInPlacement", []))

    @jsii.member(jsii_name="toInitiateDeviceClaim")
    def to_initiate_device_claim(self) -> "Iot1click":
        '''(experimental) Grants permission to initialize a device claim.

        Access Level: Read

        https://docs.aws.amazon.com/iot-1-click/1.0/devices-apireference/devices-deviceid-initiate-claim.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toInitiateDeviceClaim", []))

    @jsii.member(jsii_name="toInvokeDeviceMethod")
    def to_invoke_device_method(self) -> "Iot1click":
        '''(experimental) Grants permission to invoke a device method.

        Access Level: Write

        https://docs.aws.amazon.com/iot-1-click/1.0/devices-apireference/devices-deviceid-methods.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toInvokeDeviceMethod", []))

    @jsii.member(jsii_name="toListDeviceEvents")
    def to_list_device_events(self) -> "Iot1click":
        '''(experimental) Grants permission to list past events published by a device.

        Access Level: Read

        https://docs.aws.amazon.com/iot-1-click/1.0/devices-apireference/devices-deviceid-events.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toListDeviceEvents", []))

    @jsii.member(jsii_name="toListDevices")
    def to_list_devices(self) -> "Iot1click":
        '''(experimental) Grants permission to list all devices.

        Access Level: List

        https://docs.aws.amazon.com/iot-1-click/1.0/devices-apireference/devices.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toListDevices", []))

    @jsii.member(jsii_name="toListPlacements")
    def to_list_placements(self) -> "Iot1click":
        '''(experimental) Grants permission to list placements in a project.

        Access Level: Read

        https://docs.aws.amazon.com/iot-1-click/latest/projects-apireference/API_ListPlacements.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toListPlacements", []))

    @jsii.member(jsii_name="toListProjects")
    def to_list_projects(self) -> "Iot1click":
        '''(experimental) Grants permission to list all projects.

        Access Level: List

        https://docs.aws.amazon.com/iot-1-click/latest/projects-apireference/API_ListProjects.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toListProjects", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Iot1click":
        '''(experimental) Grants permission to lists the tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/iot-1-click/latest/projects-apireference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Iot1click":
        '''(experimental) Grants permission to add or modify the tags of a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-1-click/latest/projects-apireference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUnclaimDevice")
    def to_unclaim_device(self) -> "Iot1click":
        '''(experimental) Grants permission to unclaim a device.

        Access Level: Read

        https://docs.aws.amazon.com/iot-1-click/1.0/devices-apireference/devices-deviceid-unclaim.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toUnclaimDevice", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Iot1click":
        '''(experimental) Grants permission to remove the given tags (metadata) from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-1-click/latest/projects-apireference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateDeviceState")
    def to_update_device_state(self) -> "Iot1click":
        '''(experimental) Grants permission to update device state.

        Access Level: Write

        https://docs.aws.amazon.com/iot-1-click/1.0/devices-apireference/devices-deviceid-state.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toUpdateDeviceState", []))

    @jsii.member(jsii_name="toUpdatePlacement")
    def to_update_placement(self) -> "Iot1click":
        '''(experimental) Grants permission to update a placement.

        Access Level: Write

        https://docs.aws.amazon.com/iot-1-click/latest/projects-apireference/API_UpdatePlacement.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toUpdatePlacement", []))

    @jsii.member(jsii_name="toUpdateProject")
    def to_update_project(self) -> "Iot1click":
        '''(experimental) Update a project.

        Access Level: Write

        https://docs.aws.amazon.com/iot-1-click/latest/projects-apireference/API_UpdateProject.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toUpdateProject", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class IotDeviceTester(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.IotDeviceTester",
):
    '''(experimental) Statement provider for service `iot-device-tester <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotdevicetester.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `iot-device-tester <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotdevicetester.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(IotDeviceTester, self, [sid])

    @jsii.member(jsii_name="toCheckVersion")
    def to_check_version(self) -> "IotDeviceTester":
        '''(experimental) Grants permission for IoT Device Tester to check if a given set of product, test suite and device tester version are compatible.

        Access Level: Read

        https://docs.aws.amazon.com/freertos/latest/userguide/dev-tester-prereqs.html

        :stability: experimental
        '''
        return typing.cast("IotDeviceTester", jsii.invoke(self, "toCheckVersion", []))

    @jsii.member(jsii_name="toDownloadTestSuite")
    def to_download_test_suite(self) -> "IotDeviceTester":
        '''(experimental) Grants permission for IoT Device Tester to download compatible test suite versions.

        Access Level: Read

        https://docs.aws.amazon.com/freertos/latest/userguide/dev-tester-prereqs.html

        :stability: experimental
        '''
        return typing.cast("IotDeviceTester", jsii.invoke(self, "toDownloadTestSuite", []))

    @jsii.member(jsii_name="toLatestIdt")
    def to_latest_idt(self) -> "IotDeviceTester":
        '''(experimental) Grants permission for IoT Device Tester to get information on latest version of device tester available.

        Access Level: Read

        https://docs.aws.amazon.com/freertos/latest/userguide/dev-tester-prereqs.html

        :stability: experimental
        '''
        return typing.cast("IotDeviceTester", jsii.invoke(self, "toLatestIdt", []))

    @jsii.member(jsii_name="toSendMetrics")
    def to_send_metrics(self) -> "IotDeviceTester":
        '''(experimental) Grants permissions for IoT Device Tester to send usage metrics on your behalf.

        Access Level: Write

        https://docs.aws.amazon.com/freertos/latest/userguide/dev-tester-prereqs.html

        :stability: experimental
        '''
        return typing.cast("IotDeviceTester", jsii.invoke(self, "toSendMetrics", []))

    @jsii.member(jsii_name="toSupportedVersion")
    def to_supported_version(self) -> "IotDeviceTester":
        '''(experimental) Grants permission for IoT Device Tester to get list of supported products and test suite versions.

        Access Level: Read

        https://docs.aws.amazon.com/freertos/latest/userguide/dev-tester-prereqs.html

        :stability: experimental
        '''
        return typing.cast("IotDeviceTester", jsii.invoke(self, "toSupportedVersion", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Iotanalytics(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Iotanalytics",
):
    '''(experimental) Statement provider for service `iotanalytics <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotanalytics.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `iotanalytics <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotanalytics.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Iotanalytics, self, [sid])

    @jsii.member(jsii_name="ifResourceTag")
    def if_resource_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iotanalytics":
        '''(experimental) The preface string for a tag key and value pair attached to an IoT Analytics resource.

        Applies to resource types:

        - channel
        - dataset
        - datastore
        - pipeline

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "ifResourceTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="onChannel")
    def on_channel(
        self,
        channel_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotanalytics":
        '''(experimental) Adds a resource of type channel to the statement.

        https://docs.aws.amazon.com/iotanalytics/latest/userguide/welcome.html#aws-iot-analytics-how

        :param channel_name: - Identifier for the channelName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsTagKeys() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "onChannel", [channel_name, account, region, partition]))

    @jsii.member(jsii_name="onDataset")
    def on_dataset(
        self,
        dataset_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotanalytics":
        '''(experimental) Adds a resource of type dataset to the statement.

        https://docs.aws.amazon.com/iotanalytics/latest/userguide/welcome.html#aws-iot-analytics-how

        :param dataset_name: - Identifier for the datasetName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsTagKeys() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "onDataset", [dataset_name, account, region, partition]))

    @jsii.member(jsii_name="onDatastore")
    def on_datastore(
        self,
        datastore_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotanalytics":
        '''(experimental) Adds a resource of type datastore to the statement.

        https://docs.aws.amazon.com/iotanalytics/latest/userguide/welcome.html#aws-iot-analytics-how

        :param datastore_name: - Identifier for the datastoreName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsTagKeys() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "onDatastore", [datastore_name, account, region, partition]))

    @jsii.member(jsii_name="onPipeline")
    def on_pipeline(
        self,
        pipeline_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotanalytics":
        '''(experimental) Adds a resource of type pipeline to the statement.

        https://docs.aws.amazon.com/iotanalytics/latest/userguide/welcome.html#aws-iot-analytics-how

        :param pipeline_name: - Identifier for the pipelineName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsRequestTag() - .ifAwsTagKeys() - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "onPipeline", [pipeline_name, account, region, partition]))

    @jsii.member(jsii_name="toBatchPutMessage")
    def to_batch_put_message(self) -> "Iotanalytics":
        '''(experimental) Puts a batch of messages into the specified channel.

        Access Level: Write

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_BatchPutMessage.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toBatchPutMessage", []))

    @jsii.member(jsii_name="toCancelPipelineReprocessing")
    def to_cancel_pipeline_reprocessing(self) -> "Iotanalytics":
        '''(experimental) Cancels reprocessing for the specified pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_CancelPipelineReprocessing.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toCancelPipelineReprocessing", []))

    @jsii.member(jsii_name="toCreateChannel")
    def to_create_channel(self) -> "Iotanalytics":
        '''(experimental) Creates a channel.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_CreateChannel.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toCreateChannel", []))

    @jsii.member(jsii_name="toCreateDataset")
    def to_create_dataset(self) -> "Iotanalytics":
        '''(experimental) Creates a dataset.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_CreateDataset.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toCreateDataset", []))

    @jsii.member(jsii_name="toCreateDatasetContent")
    def to_create_dataset_content(self) -> "Iotanalytics":
        '''(experimental) Generates content of the specified dataset (by executing the dataset actions).

        Access Level: Write

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_CreateDatasetContent.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toCreateDatasetContent", []))

    @jsii.member(jsii_name="toCreateDatastore")
    def to_create_datastore(self) -> "Iotanalytics":
        '''(experimental) Creates a datastore.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_CreateDatastore.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toCreateDatastore", []))

    @jsii.member(jsii_name="toCreatePipeline")
    def to_create_pipeline(self) -> "Iotanalytics":
        '''(experimental) Creates a pipeline.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_CreatePipeline.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toCreatePipeline", []))

    @jsii.member(jsii_name="toDeleteChannel")
    def to_delete_channel(self) -> "Iotanalytics":
        '''(experimental) Deletes the specified channel.

        Access Level: Write

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_DeleteChannel.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toDeleteChannel", []))

    @jsii.member(jsii_name="toDeleteDataset")
    def to_delete_dataset(self) -> "Iotanalytics":
        '''(experimental) Deletes the specified dataset.

        Access Level: Write

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_DeleteDataset.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toDeleteDataset", []))

    @jsii.member(jsii_name="toDeleteDatasetContent")
    def to_delete_dataset_content(self) -> "Iotanalytics":
        '''(experimental) Deletes the content of the specified dataset.

        Access Level: Write

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_DeleteDatasetContent.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toDeleteDatasetContent", []))

    @jsii.member(jsii_name="toDeleteDatastore")
    def to_delete_datastore(self) -> "Iotanalytics":
        '''(experimental) Deletes the specified datastore.

        Access Level: Write

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_DeleteDatastore.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toDeleteDatastore", []))

    @jsii.member(jsii_name="toDeletePipeline")
    def to_delete_pipeline(self) -> "Iotanalytics":
        '''(experimental) Deletes the specified pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_DeletePipeline.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toDeletePipeline", []))

    @jsii.member(jsii_name="toDescribeChannel")
    def to_describe_channel(self) -> "Iotanalytics":
        '''(experimental) Describes the specified channel.

        Access Level: Read

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_DescribeChannel.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toDescribeChannel", []))

    @jsii.member(jsii_name="toDescribeDataset")
    def to_describe_dataset(self) -> "Iotanalytics":
        '''(experimental) Describes the specified dataset.

        Access Level: Read

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_DescribeDataset.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toDescribeDataset", []))

    @jsii.member(jsii_name="toDescribeDatastore")
    def to_describe_datastore(self) -> "Iotanalytics":
        '''(experimental) Describes the specified datastore.

        Access Level: Read

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_DescribeDatastore.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toDescribeDatastore", []))

    @jsii.member(jsii_name="toDescribeLoggingOptions")
    def to_describe_logging_options(self) -> "Iotanalytics":
        '''(experimental) Describes logging options for the the account.

        Access Level: Read

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_DescribeLoggingOptions.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toDescribeLoggingOptions", []))

    @jsii.member(jsii_name="toDescribePipeline")
    def to_describe_pipeline(self) -> "Iotanalytics":
        '''(experimental) Describes the specified pipeline.

        Access Level: Read

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_DescribePipeline.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toDescribePipeline", []))

    @jsii.member(jsii_name="toGetDatasetContent")
    def to_get_dataset_content(self) -> "Iotanalytics":
        '''(experimental) Gets the content of the specified dataset.

        Access Level: Read

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_GetDatasetContent.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toGetDatasetContent", []))

    @jsii.member(jsii_name="toListChannels")
    def to_list_channels(self) -> "Iotanalytics":
        '''(experimental) Lists the channels for the account.

        Access Level: List

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_ListChannels.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toListChannels", []))

    @jsii.member(jsii_name="toListDatasets")
    def to_list_datasets(self) -> "Iotanalytics":
        '''(experimental) Lists the datasets for the account.

        Access Level: List

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_ListDatasets.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toListDatasets", []))

    @jsii.member(jsii_name="toListDatastores")
    def to_list_datastores(self) -> "Iotanalytics":
        '''(experimental) Lists the datastores for the account.

        Access Level: List

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_ListDatastores.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toListDatastores", []))

    @jsii.member(jsii_name="toListPipelines")
    def to_list_pipelines(self) -> "Iotanalytics":
        '''(experimental) Lists the pipelines for the account.

        Access Level: List

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_ListPipelines.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toListPipelines", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Iotanalytics":
        '''(experimental) Lists the tags (metadata) which you have assigned to the resource.

        Access Level: Read

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutLoggingOptions")
    def to_put_logging_options(self) -> "Iotanalytics":
        '''(experimental) Puts logging options for the the account.

        Access Level: Write

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_PutLoggingOptions.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toPutLoggingOptions", []))

    @jsii.member(jsii_name="toRunPipelineActivity")
    def to_run_pipeline_activity(self) -> "Iotanalytics":
        '''(experimental) Runs the specified pipeline activity.

        Access Level: Read

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_RunPipelineActivity.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toRunPipelineActivity", []))

    @jsii.member(jsii_name="toSampleChannelData")
    def to_sample_channel_data(self) -> "Iotanalytics":
        '''(experimental) Samples the specified channel's data.

        Access Level: Read

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_SampleChannelData.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toSampleChannelData", []))

    @jsii.member(jsii_name="toStartPipelineReprocessing")
    def to_start_pipeline_reprocessing(self) -> "Iotanalytics":
        '''(experimental) Starts reprocessing for the specified pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_StartPipelineReprocessing.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toStartPipelineReprocessing", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Iotanalytics":
        '''(experimental) Adds to or modifies the tags of the given resource.

        Tags are metadata which can be used to manage a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Iotanalytics":
        '''(experimental) Removes the given tags (metadata) from the resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateChannel")
    def to_update_channel(self) -> "Iotanalytics":
        '''(experimental) Updates the specified channel.

        Access Level: Write

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_UpdateChannel.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toUpdateChannel", []))

    @jsii.member(jsii_name="toUpdateDataset")
    def to_update_dataset(self) -> "Iotanalytics":
        '''(experimental) Updates the specified dataset.

        Access Level: Write

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_UpdateDataset.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toUpdateDataset", []))

    @jsii.member(jsii_name="toUpdateDatastore")
    def to_update_datastore(self) -> "Iotanalytics":
        '''(experimental) Updates the specified datastore.

        Access Level: Write

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_UpdateDatastore.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toUpdateDatastore", []))

    @jsii.member(jsii_name="toUpdatePipeline")
    def to_update_pipeline(self) -> "Iotanalytics":
        '''(experimental) Updates the specified pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_UpdatePipeline.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toUpdatePipeline", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Iotdeviceadvisor(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Iotdeviceadvisor",
):
    '''(experimental) Statement provider for service `iotdeviceadvisor <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotcoredeviceadvisor.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `iotdeviceadvisor <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotcoredeviceadvisor.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Iotdeviceadvisor, self, [sid])

    @jsii.member(jsii_name="onSuitedefinition")
    def on_suitedefinition(
        self,
        suite_definition_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotdeviceadvisor":
        '''(experimental) Adds a resource of type suitedefinition to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/device-advisor-workflow.html#device-advisor-workflow-create-suite-definition

        :param suite_definition_id: - Identifier for the suiteDefinitionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iotdeviceadvisor", jsii.invoke(self, "onSuitedefinition", [suite_definition_id, account, region, partition]))

    @jsii.member(jsii_name="onSuiterun")
    def on_suiterun(
        self,
        suite_definition_id: builtins.str,
        suite_run_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotdeviceadvisor":
        '''(experimental) Adds a resource of type suiterun to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/device-advisor-workflow.html#device-advisor-workflow-start-suite-run

        :param suite_definition_id: - Identifier for the suiteDefinitionId.
        :param suite_run_id: - Identifier for the suiteRunId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iotdeviceadvisor", jsii.invoke(self, "onSuiterun", [suite_definition_id, suite_run_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateSuiteDefinition")
    def to_create_suite_definition(self) -> "Iotdeviceadvisor":
        '''(experimental) Grants permission to create a suite definition.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/developerguide/device-advisor-iot-commands.html#api-iot-CreateSuiteDefinition

        :stability: experimental
        '''
        return typing.cast("Iotdeviceadvisor", jsii.invoke(self, "toCreateSuiteDefinition", []))

    @jsii.member(jsii_name="toDeleteSuiteDefinition")
    def to_delete_suite_definition(self) -> "Iotdeviceadvisor":
        '''(experimental) Grants permission to delete a suite definition.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/developerguide/device-advisor-iot-commands.html#api-iot-DeleteSuiteDefinition

        :stability: experimental
        '''
        return typing.cast("Iotdeviceadvisor", jsii.invoke(self, "toDeleteSuiteDefinition", []))

    @jsii.member(jsii_name="toGetSuiteDefinition")
    def to_get_suite_definition(self) -> "Iotdeviceadvisor":
        '''(experimental) Grants permission to get a suite definition.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/developerguide/device-advisor-iot-commands.html#api-iot-GetSuiteDefinition

        :stability: experimental
        '''
        return typing.cast("Iotdeviceadvisor", jsii.invoke(self, "toGetSuiteDefinition", []))

    @jsii.member(jsii_name="toGetSuiteRun")
    def to_get_suite_run(self) -> "Iotdeviceadvisor":
        '''(experimental) Grants permission to get a suite run.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/developerguide/device-advisor-iot-commands.html#api-iot-GetSuiteRun

        :stability: experimental
        '''
        return typing.cast("Iotdeviceadvisor", jsii.invoke(self, "toGetSuiteRun", []))

    @jsii.member(jsii_name="toGetSuiteRunReport")
    def to_get_suite_run_report(self) -> "Iotdeviceadvisor":
        '''(experimental) Grants permission to get the qualification report for a suite run.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/developerguide/device-advisor-iot-commands.html#api-iot-GetSuiteRunReport

        :stability: experimental
        '''
        return typing.cast("Iotdeviceadvisor", jsii.invoke(self, "toGetSuiteRunReport", []))

    @jsii.member(jsii_name="toListSuiteDefinitions")
    def to_list_suite_definitions(self) -> "Iotdeviceadvisor":
        '''(experimental) Grants permission to list suite definitions.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/developerguide/device-advisor-iot-commands.html#api-iot-ListSuiteDefinitions

        :stability: experimental
        '''
        return typing.cast("Iotdeviceadvisor", jsii.invoke(self, "toListSuiteDefinitions", []))

    @jsii.member(jsii_name="toListSuiteRuns")
    def to_list_suite_runs(self) -> "Iotdeviceadvisor":
        '''(experimental) Grants permission to list suite runs.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/developerguide/device-advisor-iot-commands.html#api-iot-ListSuiteRuns

        :stability: experimental
        '''
        return typing.cast("Iotdeviceadvisor", jsii.invoke(self, "toListSuiteRuns", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Iotdeviceadvisor":
        '''(experimental) Grants permission to list the tags (metadata) assigned to a resource.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/developerguide/device-advisor-iot-commands.html#api-iot-ListTagsForResource

        :stability: experimental
        '''
        return typing.cast("Iotdeviceadvisor", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTestCases")
    def to_list_test_cases(self) -> "Iotdeviceadvisor":
        '''(experimental) Grants permission to list the test cases provided by IoT Device Advisor.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/developerguide/device-advisor-iot-commands.html#api-iot-ListTestCases

        :stability: experimental
        '''
        return typing.cast("Iotdeviceadvisor", jsii.invoke(self, "toListTestCases", []))

    @jsii.member(jsii_name="toStartSuiteRun")
    def to_start_suite_run(self) -> "Iotdeviceadvisor":
        '''(experimental) Grants permission to start a suite run.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/developerguide/device-advisor-iot-commands.html#api-iot-StartSuiteRun

        :stability: experimental
        '''
        return typing.cast("Iotdeviceadvisor", jsii.invoke(self, "toStartSuiteRun", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Iotdeviceadvisor":
        '''(experimental) Grants permission to add to or modify the tags of the given resource.

        Tags are metadata which can be used to manage a resource

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/developerguide/device-advisor-iot-commands.html#api-iot-TagResource

        :stability: experimental
        '''
        return typing.cast("Iotdeviceadvisor", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Iotdeviceadvisor":
        '''(experimental) Grants permission to remove the given tags (metadata) from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/developerguide/device-advisor-iot-commands.html#api-iot-UntagResource

        :stability: experimental
        '''
        return typing.cast("Iotdeviceadvisor", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateSuiteDefinition")
    def to_update_suite_definition(self) -> "Iotdeviceadvisor":
        '''(experimental) Grants permission to update a suite definition.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/developerguide/device-advisor-iot-commands.html#api-iot-UpdateSuiteDefinition

        :stability: experimental
        '''
        return typing.cast("Iotdeviceadvisor", jsii.invoke(self, "toUpdateSuiteDefinition", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Iotevents(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Iotevents",
):
    '''(experimental) Statement provider for service `iotevents <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotevents.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `iotevents <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotevents.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Iotevents, self, [sid])

    @jsii.member(jsii_name="ifKeyValue")
    def if_key_value(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iotevents":
        '''(experimental) Filters access by the instanceId (key-value) of the message.

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "ifKeyValue", [value, operator]))

    @jsii.member(jsii_name="onAlarmModel")
    def on_alarm_model(
        self,
        alarm_model_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotevents":
        '''(experimental) Adds a resource of type alarmModel to the statement.

        https://docs.aws.amazon.com/iotevents/latest/developerguide/iotevents-getting-started.html

        :param alarm_model_name: - Identifier for the alarmModelName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "onAlarmModel", [alarm_model_name, account, region, partition]))

    @jsii.member(jsii_name="onDetectorModel")
    def on_detector_model(
        self,
        detector_model_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotevents":
        '''(experimental) Adds a resource of type detectorModel to the statement.

        https://docs.aws.amazon.com/iotevents/latest/developerguide/iotevents-getting-started.html

        :param detector_model_name: - Identifier for the detectorModelName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "onDetectorModel", [detector_model_name, account, region, partition]))

    @jsii.member(jsii_name="onInput")
    def on_input(
        self,
        input_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotevents":
        '''(experimental) Adds a resource of type input to the statement.

        https://docs.aws.amazon.com/iotevents/latest/developerguide/iotevents-getting-started.html

        :param input_name: - Identifier for the inputName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "onInput", [input_name, account, region, partition]))

    @jsii.member(jsii_name="toBatchAcknowledgeAlarm")
    def to_batch_acknowledge_alarm(self) -> "Iotevents":
        '''(experimental) Grants permission to send one or more acknowledge action requests to AWS IoT Events.

        Access Level: Write

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_iotevents-data_BatchAcknowledgeAlarm.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toBatchAcknowledgeAlarm", []))

    @jsii.member(jsii_name="toBatchDisableAlarm")
    def to_batch_disable_alarm(self) -> "Iotevents":
        '''(experimental) Grants permission to disable one or more alarm instances.

        Access Level: Write

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_iotevents-data_BatchDisableAlarm.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toBatchDisableAlarm", []))

    @jsii.member(jsii_name="toBatchEnableAlarm")
    def to_batch_enable_alarm(self) -> "Iotevents":
        '''(experimental) Grants permission to enable one or more alarm instances.

        Access Level: Write

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_iotevents-data_BatchEnableAlarm.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toBatchEnableAlarm", []))

    @jsii.member(jsii_name="toBatchPutMessage")
    def to_batch_put_message(self) -> "Iotevents":
        '''(experimental) Grants permission to send a set of messages to the AWS IoT Events system.

        Access Level: Write

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_iotevents-data_BatchPutMessage.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toBatchPutMessage", []))

    @jsii.member(jsii_name="toBatchResetAlarm")
    def to_batch_reset_alarm(self) -> "Iotevents":
        '''(experimental) Grants permission to reset one or more alarm instances.

        Access Level: Write

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_iotevents-data_BatchResetAlarm.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toBatchResetAlarm", []))

    @jsii.member(jsii_name="toBatchSnoozeAlarm")
    def to_batch_snooze_alarm(self) -> "Iotevents":
        '''(experimental) Grants permission to change one or more alarm instances to the snooze mode.

        Access Level: Write

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_iotevents-data_BatchSnoozeAlarm.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toBatchSnoozeAlarm", []))

    @jsii.member(jsii_name="toBatchUpdateDetector")
    def to_batch_update_detector(self) -> "Iotevents":
        '''(experimental) Grants permission to update a detector instance within the AWS IoT Events system.

        Access Level: Write

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_iotevents-data_BatchUpdateDetector.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toBatchUpdateDetector", []))

    @jsii.member(jsii_name="toCreateAlarmModel")
    def to_create_alarm_model(self) -> "Iotevents":
        '''(experimental) Grants permission to create an alarm model to monitor an AWS IoT Events input attribute or an AWS IoT SiteWise asset property.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_CreateAlarmModel.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toCreateAlarmModel", []))

    @jsii.member(jsii_name="toCreateDetectorModel")
    def to_create_detector_model(self) -> "Iotevents":
        '''(experimental) Grants permission to create a detector model to monitor an AWS IoT Events input attribute.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_CreateDetectorModel.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toCreateDetectorModel", []))

    @jsii.member(jsii_name="toCreateInput")
    def to_create_input(self) -> "Iotevents":
        '''(experimental) Grants permission to create an Input in IotEvents.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_CreateInput.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toCreateInput", []))

    @jsii.member(jsii_name="toDeleteAlarmModel")
    def to_delete_alarm_model(self) -> "Iotevents":
        '''(experimental) Grants permission to delete an alarm model.

        Access Level: Write

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_DeleteAlarmModel.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toDeleteAlarmModel", []))

    @jsii.member(jsii_name="toDeleteDetectorModel")
    def to_delete_detector_model(self) -> "Iotevents":
        '''(experimental) Grants permission to delete a detector model.

        Access Level: Write

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_DeleteDetectorModel.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toDeleteDetectorModel", []))

    @jsii.member(jsii_name="toDeleteInput")
    def to_delete_input(self) -> "Iotevents":
        '''(experimental) Grants permission to delete an input.

        Access Level: Write

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_DeleteInput.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toDeleteInput", []))

    @jsii.member(jsii_name="toDescribeAlarm")
    def to_describe_alarm(self) -> "Iotevents":
        '''(experimental) Grants permission to retrieve information about an alarm instance.

        Access Level: Read

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_iotevents-data_DescribeAlarm.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toDescribeAlarm", []))

    @jsii.member(jsii_name="toDescribeAlarmModel")
    def to_describe_alarm_model(self) -> "Iotevents":
        '''(experimental) Grants permission to retrieve information about an alarm model.

        Access Level: Read

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_DescribeAlarmModel.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toDescribeAlarmModel", []))

    @jsii.member(jsii_name="toDescribeDetector")
    def to_describe_detector(self) -> "Iotevents":
        '''(experimental) Grants permission to retriev information about a detector instance.

        Access Level: Read

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_iotevents-data_DescribeDetector.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toDescribeDetector", []))

    @jsii.member(jsii_name="toDescribeDetectorModel")
    def to_describe_detector_model(self) -> "Iotevents":
        '''(experimental) Grants permission to retrieve information about a detector model.

        Access Level: Read

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_DescribeDetectorModel.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toDescribeDetectorModel", []))

    @jsii.member(jsii_name="toDescribeInput")
    def to_describe_input(self) -> "Iotevents":
        '''(experimental) Grants permission to retrieve an information about Input.

        Access Level: Read

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_DescribeInput.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toDescribeInput", []))

    @jsii.member(jsii_name="toDescribeLoggingOptions")
    def to_describe_logging_options(self) -> "Iotevents":
        '''(experimental) Grants permission to retrieve the current settings of the AWS IoT Events logging options.

        Access Level: Read

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_DescribeLoggingOptions.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toDescribeLoggingOptions", []))

    @jsii.member(jsii_name="toListAlarmModels")
    def to_list_alarm_models(self) -> "Iotevents":
        '''(experimental) Grants permission to list the alarm models that you created.

        Access Level: List

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_ListAlarmModels.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toListAlarmModels", []))

    @jsii.member(jsii_name="toListAlarmModelVersions")
    def to_list_alarm_model_versions(self) -> "Iotevents":
        '''(experimental) Grants permission to list all the versions of an alarm model.

        Access Level: List

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_ListAlarmModelVersions.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toListAlarmModelVersions", []))

    @jsii.member(jsii_name="toListAlarms")
    def to_list_alarms(self) -> "Iotevents":
        '''(experimental) Grants permission to retrieve information about all alarm instances per alarmModel.

        Access Level: List

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_iotevents-data_ListAlarms.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toListAlarms", []))

    @jsii.member(jsii_name="toListDetectorModels")
    def to_list_detector_models(self) -> "Iotevents":
        '''(experimental) Grants permission to list the detector models that you created.

        Access Level: List

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_ListDetectorModels.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toListDetectorModels", []))

    @jsii.member(jsii_name="toListDetectorModelVersions")
    def to_list_detector_model_versions(self) -> "Iotevents":
        '''(experimental) Grants permission to list all the versions of a detector model.

        Access Level: List

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_ListDetectorModelVersions.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toListDetectorModelVersions", []))

    @jsii.member(jsii_name="toListDetectors")
    def to_list_detectors(self) -> "Iotevents":
        '''(experimental) Grants permission to retrieve information about all detector instances per detectormodel.

        Access Level: List

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_iotevents-data_ListDetectors.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toListDetectors", []))

    @jsii.member(jsii_name="toListInputs")
    def to_list_inputs(self) -> "Iotevents":
        '''(experimental) Grants permission to lists the inputs you have created.

        Access Level: List

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_ListInputs.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toListInputs", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Iotevents":
        '''(experimental) Grants permission to list the tags (metadata) which you have assigned to the resource.

        Access Level: Read

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutLoggingOptions")
    def to_put_logging_options(self) -> "Iotevents":
        '''(experimental) Grants permission to set or update the AWS IoT Events logging options.

        Access Level: Write

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_PutLoggingOptions.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toPutLoggingOptions", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Iotevents":
        '''(experimental) Grants permission to adds to or modifies the tags of the given resource.Tags are metadata which can be used to manage a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Iotevents":
        '''(experimental) Grants permission to remove the given tags (metadata) from the resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAlarmModel")
    def to_update_alarm_model(self) -> "Iotevents":
        '''(experimental) Grants permission to update an alarm model.

        Access Level: Write

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_UpdateAlarmModel.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toUpdateAlarmModel", []))

    @jsii.member(jsii_name="toUpdateDetectorModel")
    def to_update_detector_model(self) -> "Iotevents":
        '''(experimental) Grants permission to update a detector model.

        Access Level: Write

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_UpdateDetectorModel.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toUpdateDetectorModel", []))

    @jsii.member(jsii_name="toUpdateInput")
    def to_update_input(self) -> "Iotevents":
        '''(experimental) Grants permission to update an input.

        Access Level: Write

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_UpdateInput.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toUpdateInput", []))

    @jsii.member(jsii_name="toUpdateInputRouting")
    def to_update_input_routing(self) -> "Iotevents":
        '''(experimental) Grants permission to update input routing.

        Access Level: Write

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_UpdateInputRouting.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toUpdateInputRouting", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Iotfleethub(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Iotfleethub",
):
    '''(experimental) Statement provider for service `iotfleethub <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotfleethubfordevicemanagement.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `iotfleethub <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotfleethubfordevicemanagement.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Iotfleethub, self, [sid])

    @jsii.member(jsii_name="onApplication")
    def on_application(
        self,
        application_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotfleethub":
        '''(experimental) Adds a resource of type application to the statement.

        https://docs.aws.amazon.com/iot/latest/apireference/API_iotfleethub_ApplicationSummary.html

        :param application_id: - Identifier for the applicationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iotfleethub", jsii.invoke(self, "onApplication", [application_id, account, partition]))

    @jsii.member(jsii_name="toCreateApplication")
    def to_create_application(self) -> "Iotfleethub":
        '''(experimental) Grants permission to create an application.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - sso:CreateManagedApplicationInstance
        - sso:DescribeRegisteredRegions

        https://docs.aws.amazon.com/iot/latest/apireference/API_iotfleethub_CreateApplication.html

        :stability: experimental
        '''
        return typing.cast("Iotfleethub", jsii.invoke(self, "toCreateApplication", []))

    @jsii.member(jsii_name="toDeleteApplication")
    def to_delete_application(self) -> "Iotfleethub":
        '''(experimental) Grants permission to delete an application.

        Access Level: Write

        Dependent actions:

        - sso:DeleteManagedApplicationInstance

        https://docs.aws.amazon.com/iot/latest/apireference/API_iotfleethub_DeleteApplication.html

        :stability: experimental
        '''
        return typing.cast("Iotfleethub", jsii.invoke(self, "toDeleteApplication", []))

    @jsii.member(jsii_name="toDescribeApplication")
    def to_describe_application(self) -> "Iotfleethub":
        '''(experimental) Grants permission to describe an application.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_iotfleethub_DescribeApplication.html

        :stability: experimental
        '''
        return typing.cast("Iotfleethub", jsii.invoke(self, "toDescribeApplication", []))

    @jsii.member(jsii_name="toListApplications")
    def to_list_applications(self) -> "Iotfleethub":
        '''(experimental) Grants permission to list all applications.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_iotfleethub_ListApplications.html

        :stability: experimental
        '''
        return typing.cast("Iotfleethub", jsii.invoke(self, "toListApplications", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Iotfleethub":
        '''(experimental) Grants permission to list all tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_iotfleethub_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Iotfleethub", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Iotfleethub":
        '''(experimental) Grants permission to tag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/iot/latest/apireference/API_iotfleethub_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Iotfleethub", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Iotfleethub":
        '''(experimental) Grants permission to untag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_iotfleethub_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Iotfleethub", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateApplication")
    def to_update_application(self) -> "Iotfleethub":
        '''(experimental) Grants permission to update an application.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_iotfleethub_UpdateApplication.html

        :stability: experimental
        '''
        return typing.cast("Iotfleethub", jsii.invoke(self, "toUpdateApplication", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Iotsitewise(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Iotsitewise",
):
    '''(experimental) Statement provider for service `iotsitewise <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotsitewise.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `iotsitewise <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotsitewise.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Iotsitewise, self, [sid])

    @jsii.member(jsii_name="ifAssetHierarchyPath")
    def if_asset_hierarchy_path(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iotsitewise":
        '''(experimental) Filters access by an asset hierarchy path, which is the string of asset IDs in the asset's hierarchy, each separated by a forward slash.

        https://docs.aws.amazon.com/iot-sitewise/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "ifAssetHierarchyPath", [value, operator]))

    @jsii.member(jsii_name="ifChildAssetId")
    def if_child_asset_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iotsitewise":
        '''(experimental) Filters access by the ID of a child asset being associated to a parent asset.

        https://docs.aws.amazon.com/iot-sitewise/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "ifChildAssetId", [value, operator]))

    @jsii.member(jsii_name="ifGroup")
    def if_group(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iotsitewise":
        '''(experimental) Filters access by the ID of an AWS Single Sign-On group.

        https://docs.aws.amazon.com/iot-sitewise/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "ifGroup", [value, operator]))

    @jsii.member(jsii_name="ifIam")
    def if_iam(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iotsitewise":
        '''(experimental) Filters access by the ID of an AWS IAM identity.

        https://docs.aws.amazon.com/iot-sitewise/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "ifIam", [value, operator]))

    @jsii.member(jsii_name="ifPortal")
    def if_portal(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iotsitewise":
        '''(experimental) Filters access by the ID of a portal.

        https://docs.aws.amazon.com/iot-sitewise/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "ifPortal", [value, operator]))

    @jsii.member(jsii_name="ifProject")
    def if_project(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iotsitewise":
        '''(experimental) Filters access by the ID of a project.

        https://docs.aws.amazon.com/iot-sitewise/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "ifProject", [value, operator]))

    @jsii.member(jsii_name="ifPropertyId")
    def if_property_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iotsitewise":
        '''(experimental) Filters access by the ID of an asset property.

        https://docs.aws.amazon.com/iot-sitewise/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "ifPropertyId", [value, operator]))

    @jsii.member(jsii_name="ifUser")
    def if_user(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iotsitewise":
        '''(experimental) Filters access by the ID of an AWS Single Sign-On user.

        https://docs.aws.amazon.com/iot-sitewise/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "ifUser", [value, operator]))

    @jsii.member(jsii_name="onAccessPolicy")
    def on_access_policy(
        self,
        access_policy_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotsitewise":
        '''(experimental) Adds a resource of type access-policy to the statement.

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_CreateAccessPolicy.html

        :param access_policy_id: - Identifier for the accessPolicyId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "onAccessPolicy", [access_policy_id, account, region, partition]))

    @jsii.member(jsii_name="onAsset")
    def on_asset(
        self,
        asset_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotsitewise":
        '''(experimental) Adds a resource of type asset to the statement.

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_CreateAsset.html

        :param asset_id: - Identifier for the assetId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "onAsset", [asset_id, account, region, partition]))

    @jsii.member(jsii_name="onAssetModel")
    def on_asset_model(
        self,
        asset_model_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotsitewise":
        '''(experimental) Adds a resource of type asset-model to the statement.

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_CreateAssetModel.html

        :param asset_model_id: - Identifier for the assetModelId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "onAssetModel", [asset_model_id, account, region, partition]))

    @jsii.member(jsii_name="onDashboard")
    def on_dashboard(
        self,
        dashboard_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotsitewise":
        '''(experimental) Adds a resource of type dashboard to the statement.

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_CreateDashboard.html

        :param dashboard_id: - Identifier for the dashboardId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "onDashboard", [dashboard_id, account, region, partition]))

    @jsii.member(jsii_name="onGateway")
    def on_gateway(
        self,
        gateway_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotsitewise":
        '''(experimental) Adds a resource of type gateway to the statement.

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_CreateGateway.html

        :param gateway_id: - Identifier for the gatewayId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "onGateway", [gateway_id, account, region, partition]))

    @jsii.member(jsii_name="onPortal")
    def on_portal(
        self,
        portal_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotsitewise":
        '''(experimental) Adds a resource of type portal to the statement.

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_CreatePortal.html

        :param portal_id: - Identifier for the portalId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "onPortal", [portal_id, account, region, partition]))

    @jsii.member(jsii_name="onProject")
    def on_project(
        self,
        project_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotsitewise":
        '''(experimental) Adds a resource of type project to the statement.

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_CreateProject.html

        :param project_id: - Identifier for the projectId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "onProject", [project_id, account, region, partition]))

    @jsii.member(jsii_name="toAssociateAssets")
    def to_associate_assets(self) -> "Iotsitewise":
        '''(experimental) Grants permission to associate a child asset to a parent asset by a hierarchy.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_AssociateAssets.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toAssociateAssets", []))

    @jsii.member(jsii_name="toBatchAssociateProjectAssets")
    def to_batch_associate_project_assets(self) -> "Iotsitewise":
        '''(experimental) Grants permission to associate assets to a project.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_BatchAssociateProjectAssets.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toBatchAssociateProjectAssets", []))

    @jsii.member(jsii_name="toBatchDisassociateProjectAssets")
    def to_batch_disassociate_project_assets(self) -> "Iotsitewise":
        '''(experimental) Grants permission to disassociate assets from a project.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_BatchDisassociateProjectAssets.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toBatchDisassociateProjectAssets", []))

    @jsii.member(jsii_name="toBatchPutAssetPropertyValue")
    def to_batch_put_asset_property_value(self) -> "Iotsitewise":
        '''(experimental) Grants permission to put property values for asset properties.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_BatchPutAssetPropertyValue.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toBatchPutAssetPropertyValue", []))

    @jsii.member(jsii_name="toCreateAccessPolicy")
    def to_create_access_policy(self) -> "Iotsitewise":
        '''(experimental) Grants permission to create an access policy for a portal or a project.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_CreateAccessPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toCreateAccessPolicy", []))

    @jsii.member(jsii_name="toCreateAsset")
    def to_create_asset(self) -> "Iotsitewise":
        '''(experimental) Grants permission to create an asset from an asset model.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_CreateAsset.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toCreateAsset", []))

    @jsii.member(jsii_name="toCreateAssetModel")
    def to_create_asset_model(self) -> "Iotsitewise":
        '''(experimental) Grants permission to create an asset model.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_CreateAssetModel.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toCreateAssetModel", []))

    @jsii.member(jsii_name="toCreateDashboard")
    def to_create_dashboard(self) -> "Iotsitewise":
        '''(experimental) Grants permission to create a dashboard in a project.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_CreateDashboard.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toCreateDashboard", []))

    @jsii.member(jsii_name="toCreateGateway")
    def to_create_gateway(self) -> "Iotsitewise":
        '''(experimental) Grants permission to create a gateway.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_CreateGateway.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toCreateGateway", []))

    @jsii.member(jsii_name="toCreatePortal")
    def to_create_portal(self) -> "Iotsitewise":
        '''(experimental) Grants permission to create a portal.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - sso:CreateManagedApplicationInstance
        - sso:DescribeRegisteredRegions

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_CreatePortal.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toCreatePortal", []))

    @jsii.member(jsii_name="toCreateProject")
    def to_create_project(self) -> "Iotsitewise":
        '''(experimental) Grants permission to create a project in a portal.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_CreateProject.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toCreateProject", []))

    @jsii.member(jsii_name="toDeleteAccessPolicy")
    def to_delete_access_policy(self) -> "Iotsitewise":
        '''(experimental) Grants permission to delete an access policy.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DeleteAccessPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDeleteAccessPolicy", []))

    @jsii.member(jsii_name="toDeleteAsset")
    def to_delete_asset(self) -> "Iotsitewise":
        '''(experimental) Grants permission to delete an asset.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DeleteAsset.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDeleteAsset", []))

    @jsii.member(jsii_name="toDeleteAssetModel")
    def to_delete_asset_model(self) -> "Iotsitewise":
        '''(experimental) Grants permission to delete an asset model.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DeleteAssetModel.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDeleteAssetModel", []))

    @jsii.member(jsii_name="toDeleteDashboard")
    def to_delete_dashboard(self) -> "Iotsitewise":
        '''(experimental) Grants permission to delete a dashboard.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DeleteDashboard.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDeleteDashboard", []))

    @jsii.member(jsii_name="toDeleteGateway")
    def to_delete_gateway(self) -> "Iotsitewise":
        '''(experimental) Grants permission to delete a gateway.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DeleteGateway.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDeleteGateway", []))

    @jsii.member(jsii_name="toDeletePortal")
    def to_delete_portal(self) -> "Iotsitewise":
        '''(experimental) Grants permission to delete a portal.

        Access Level: Write

        Dependent actions:

        - sso:DeleteManagedApplicationInstance

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DeletePortal.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDeletePortal", []))

    @jsii.member(jsii_name="toDeleteProject")
    def to_delete_project(self) -> "Iotsitewise":
        '''(experimental) Grants permission to delete a project.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DeleteProject.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDeleteProject", []))

    @jsii.member(jsii_name="toDescribeAccessPolicy")
    def to_describe_access_policy(self) -> "Iotsitewise":
        '''(experimental) Grants permission to describe an access policy.

        Access Level: Read

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DescribeAccessPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDescribeAccessPolicy", []))

    @jsii.member(jsii_name="toDescribeAsset")
    def to_describe_asset(self) -> "Iotsitewise":
        '''(experimental) Grants permission to describe an asset.

        Access Level: Read

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DescribeAsset.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDescribeAsset", []))

    @jsii.member(jsii_name="toDescribeAssetModel")
    def to_describe_asset_model(self) -> "Iotsitewise":
        '''(experimental) Grants permission to describe an asset model.

        Access Level: Read

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DescribeAssetModel.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDescribeAssetModel", []))

    @jsii.member(jsii_name="toDescribeAssetProperty")
    def to_describe_asset_property(self) -> "Iotsitewise":
        '''(experimental) Grants permission to describe an asset property.

        Access Level: Read

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DescribeAssetProperty.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDescribeAssetProperty", []))

    @jsii.member(jsii_name="toDescribeDashboard")
    def to_describe_dashboard(self) -> "Iotsitewise":
        '''(experimental) Grants permission to describe a dashboard.

        Access Level: Read

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DescribeDashboard.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDescribeDashboard", []))

    @jsii.member(jsii_name="toDescribeGateway")
    def to_describe_gateway(self) -> "Iotsitewise":
        '''(experimental) Grants permission to describe a gateway.

        Access Level: Read

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DescribeGateway.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDescribeGateway", []))

    @jsii.member(jsii_name="toDescribeGatewayCapabilityConfiguration")
    def to_describe_gateway_capability_configuration(self) -> "Iotsitewise":
        '''(experimental) Grants permission to describe a capability configuration for a gateway.

        Access Level: Read

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DescribeGatewayCapabilityConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDescribeGatewayCapabilityConfiguration", []))

    @jsii.member(jsii_name="toDescribeLoggingOptions")
    def to_describe_logging_options(self) -> "Iotsitewise":
        '''(experimental) Grants permission to describe logging options for the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DescribeLoggingOptions.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDescribeLoggingOptions", []))

    @jsii.member(jsii_name="toDescribePortal")
    def to_describe_portal(self) -> "Iotsitewise":
        '''(experimental) Grants permission to describe a portal.

        Access Level: Read

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DescribePortal.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDescribePortal", []))

    @jsii.member(jsii_name="toDescribeProject")
    def to_describe_project(self) -> "Iotsitewise":
        '''(experimental) Grants permission to describe a project.

        Access Level: Read

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DescribeProject.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDescribeProject", []))

    @jsii.member(jsii_name="toDisassociateAssets")
    def to_disassociate_assets(self) -> "Iotsitewise":
        '''(experimental) Grants permission to disassociate a child asset from a parent asset by a hierarchy.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DisassociateAssets.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDisassociateAssets", []))

    @jsii.member(jsii_name="toGetAssetPropertyAggregates")
    def to_get_asset_property_aggregates(self) -> "Iotsitewise":
        '''(experimental) Grants permission to retrieve computed aggregates for an asset property.

        Access Level: Read

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_GetAssetPropertyAggregates.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toGetAssetPropertyAggregates", []))

    @jsii.member(jsii_name="toGetAssetPropertyValue")
    def to_get_asset_property_value(self) -> "Iotsitewise":
        '''(experimental) Grants permission to retrieve the latest value for an asset property.

        Access Level: Read

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_GetAssetPropertyValue.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toGetAssetPropertyValue", []))

    @jsii.member(jsii_name="toGetAssetPropertyValueHistory")
    def to_get_asset_property_value_history(self) -> "Iotsitewise":
        '''(experimental) Grants permission to retrieve the value history for an asset property.

        Access Level: Read

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_GetAssetPropertyValueHistory.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toGetAssetPropertyValueHistory", []))

    @jsii.member(jsii_name="toListAccessPolicies")
    def to_list_access_policies(self) -> "Iotsitewise":
        '''(experimental) Grants permission to list all access policies for an identity or a resource.

        Access Level: List

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_ListAccessPolicies.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toListAccessPolicies", []))

    @jsii.member(jsii_name="toListAssetModels")
    def to_list_asset_models(self) -> "Iotsitewise":
        '''(experimental) Grants permission to list all asset models.

        Access Level: List

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_ListAssetModels.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toListAssetModels", []))

    @jsii.member(jsii_name="toListAssetRelationships")
    def to_list_asset_relationships(self) -> "Iotsitewise":
        '''(experimental) Grants permission to list the asset relationship graph for an asset.

        Access Level: List

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_ListAssetRelationships.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toListAssetRelationships", []))

    @jsii.member(jsii_name="toListAssets")
    def to_list_assets(self) -> "Iotsitewise":
        '''(experimental) Grants permission to list all assets.

        Access Level: List

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_ListAssets.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toListAssets", []))

    @jsii.member(jsii_name="toListAssociatedAssets")
    def to_list_associated_assets(self) -> "Iotsitewise":
        '''(experimental) Grants permission to list all assets associated to an asset by a hierarchy.

        Access Level: List

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_ListAssociatedAssets.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toListAssociatedAssets", []))

    @jsii.member(jsii_name="toListDashboards")
    def to_list_dashboards(self) -> "Iotsitewise":
        '''(experimental) Grants permission to list all dashboards in a project.

        Access Level: List

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_ListDashboards.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toListDashboards", []))

    @jsii.member(jsii_name="toListGateways")
    def to_list_gateways(self) -> "Iotsitewise":
        '''(experimental) Grants permission to list all gateways.

        Access Level: List

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_ListGateways.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toListGateways", []))

    @jsii.member(jsii_name="toListPortals")
    def to_list_portals(self) -> "Iotsitewise":
        '''(experimental) Grants permission to list all portals.

        Access Level: List

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_ListPortals.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toListPortals", []))

    @jsii.member(jsii_name="toListProjectAssets")
    def to_list_project_assets(self) -> "Iotsitewise":
        '''(experimental) Grants permission to list all assets associated with a project.

        Access Level: List

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_ListProjectAssets.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toListProjectAssets", []))

    @jsii.member(jsii_name="toListProjects")
    def to_list_projects(self) -> "Iotsitewise":
        '''(experimental) Grants permission to list all projects in a portal.

        Access Level: List

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_ListProjects.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toListProjects", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Iotsitewise":
        '''(experimental) Grants permission to list all tags for a resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutLoggingOptions")
    def to_put_logging_options(self) -> "Iotsitewise":
        '''(experimental) Grants permission to set logging options for the AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_PutLoggingOptions.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toPutLoggingOptions", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Iotsitewise":
        '''(experimental) Grants permission to tag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Iotsitewise":
        '''(experimental) Grants permission to untag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAccessPolicy")
    def to_update_access_policy(self) -> "Iotsitewise":
        '''(experimental) Grants permission to update an access policy.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_UpdateAccessPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toUpdateAccessPolicy", []))

    @jsii.member(jsii_name="toUpdateAsset")
    def to_update_asset(self) -> "Iotsitewise":
        '''(experimental) Grants permission to update an asset.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_UpdateAsset.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toUpdateAsset", []))

    @jsii.member(jsii_name="toUpdateAssetModel")
    def to_update_asset_model(self) -> "Iotsitewise":
        '''(experimental) Grants permission to update an asset model.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_UpdateAssetModel.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toUpdateAssetModel", []))

    @jsii.member(jsii_name="toUpdateAssetProperty")
    def to_update_asset_property(self) -> "Iotsitewise":
        '''(experimental) Grants permission to update an asset property.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_UpdateAssetProperty.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toUpdateAssetProperty", []))

    @jsii.member(jsii_name="toUpdateDashboard")
    def to_update_dashboard(self) -> "Iotsitewise":
        '''(experimental) Grants permission to update a dashboard.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_UpdateDashboard.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toUpdateDashboard", []))

    @jsii.member(jsii_name="toUpdateGateway")
    def to_update_gateway(self) -> "Iotsitewise":
        '''(experimental) Grants permission to update a gateway.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_UpdateGateway.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toUpdateGateway", []))

    @jsii.member(jsii_name="toUpdateGatewayCapabilityConfiguration")
    def to_update_gateway_capability_configuration(self) -> "Iotsitewise":
        '''(experimental) Grants permission to update a capability configuration for a gateway.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_UpdateGatewayCapabilityConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toUpdateGatewayCapabilityConfiguration", []))

    @jsii.member(jsii_name="toUpdatePortal")
    def to_update_portal(self) -> "Iotsitewise":
        '''(experimental) Grants permission to update a portal.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_UpdatePortal.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toUpdatePortal", []))

    @jsii.member(jsii_name="toUpdateProject")
    def to_update_project(self) -> "Iotsitewise":
        '''(experimental) Grants permission to update a project.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_UpdateProject.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toUpdateProject", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Iotthingsgraph(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Iotthingsgraph",
):
    '''(experimental) Statement provider for service `iotthingsgraph <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotthingsgraph.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `iotthingsgraph <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotthingsgraph.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Iotthingsgraph, self, [sid])

    @jsii.member(jsii_name="onSystem")
    def on_system(
        self,
        namespace_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotthingsgraph":
        '''(experimental) Adds a resource of type System to the statement.

        https://docs.aws.amazon.com/thingsgraph/latest/ug/iot-tg-models-tdm-iot-system.html

        :param namespace_path: - Identifier for the namespacePath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "onSystem", [namespace_path, account, region, partition]))

    @jsii.member(jsii_name="onSystemInstance")
    def on_system_instance(
        self,
        namespace_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotthingsgraph":
        '''(experimental) Adds a resource of type SystemInstance to the statement.

        https://docs.aws.amazon.com/thingsgraph/latest/ug/iot-tg-models-tdm-iot-sdc-deployconfig.html

        :param namespace_path: - Identifier for the namespacePath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "onSystemInstance", [namespace_path, account, region, partition]))

    @jsii.member(jsii_name="onWorkflow")
    def on_workflow(
        self,
        namespace_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotthingsgraph":
        '''(experimental) Adds a resource of type Workflow to the statement.

        https://docs.aws.amazon.com/thingsgraph/latest/ug/iot-tg-models-tdm-iot-workflow.html

        :param namespace_path: - Identifier for the namespacePath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "onWorkflow", [namespace_path, account, region, partition]))

    @jsii.member(jsii_name="toAssociateEntityToThing")
    def to_associate_entity_to_thing(self) -> "Iotthingsgraph":
        '''(experimental) Associates a device with a concrete thing that is in the user's registry.

        A thing can be associated with only one device at a time. If you associate a thing with a new device id, its previous association will be removed.

        Access Level: Write

        Dependent actions:

        - iot:DescribeThing
        - iot:DescribeThingGroup

        https://docs.aws.amazon.com/thingsgraph/latest/APIReference/{APIReferenceDocPage}API_AssociateEntityToThing.html

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "toAssociateEntityToThing", []))

    @jsii.member(jsii_name="toCreateFlowTemplate")
    def to_create_flow_template(self) -> "Iotthingsgraph":
        '''(experimental) Creates a workflow template.

        Workflows can be created only in the user's namespace. (The public namespace contains only entities.) The workflow can contain only entities in the specified namespace. The workflow is validated against the entities in the latest version of the user's namespace unless another namespace version is specified in the request.

        Access Level: Write

        https://docs.aws.amazon.com/thingsgraph/latest/APIReference/{APIReferenceDocPage}API_CreateFlowTemplate.html

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "toCreateFlowTemplate", []))

    @jsii.member(jsii_name="toCreateSystemInstance")
    def to_create_system_instance(self) -> "Iotthingsgraph":
        '''(experimental) Creates an instance of a system with specified configurations and Things.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/thingsgraph/latest/APIReference/{APIReferenceDocPage}API_CreateSystemInstance.html

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "toCreateSystemInstance", []))

    @jsii.member(jsii_name="toCreateSystemTemplate")
    def to_create_system_template(self) -> "Iotthingsgraph":
        '''(experimental) Creates a system.

        The system is validated against the entities in the latest version of the user's namespace unless another namespace version is specified in the request.

        Access Level: Write

        https://docs.aws.amazon.com/thingsgraph/latest/APIReference/{APIReferenceDocPage}API_CreateSystemTemplate.html

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "toCreateSystemTemplate", []))

    @jsii.member(jsii_name="toDeleteFlowTemplate")
    def to_delete_flow_template(self) -> "Iotthingsgraph":
        '''(experimental) Deletes a workflow.

        Any new system or system instance that contains this workflow will fail to update or deploy. Existing system instances that contain the workflow will continue to run (since they use a snapshot of the workflow taken at the time of deploying the system instance).

        Access Level: Write

        https://docs.aws.amazon.com/thingsgraph/latest/APIReference/{APIReferenceDocPage}API_DeleteFlowTemplate.html

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "toDeleteFlowTemplate", []))

    @jsii.member(jsii_name="toDeleteNamespace")
    def to_delete_namespace(self) -> "Iotthingsgraph":
        '''(experimental) Deletes the specified namespace.

        This action deletes all of the entities in the namespace. Delete the systems and flows in the namespace before performing this action.

        Access Level: Write

        https://docs.aws.amazon.com/thingsgraph/latest/APIReference/{APIReferenceDocPage}API_DeleteNamespace.html

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "toDeleteNamespace", []))

    @jsii.member(jsii_name="toDeleteSystemInstance")
    def to_delete_system_instance(self) -> "Iotthingsgraph":
        '''(experimental) Deletes a system instance.

        Only instances that have never been deployed, or that have been undeployed from the target can be deleted. Users can create a new system instance that has the same ID as a deleted system instance.

        Access Level: Write

        https://docs.aws.amazon.com/thingsgraph/latest/APIReference/{APIReferenceDocPage}API_DeleteSystemInstance.html

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "toDeleteSystemInstance", []))

    @jsii.member(jsii_name="toDeleteSystemTemplate")
    def to_delete_system_template(self) -> "Iotthingsgraph":
        '''(experimental) Deletes a system.

        New system instances can't contain the system after its deletion. Existing system instances that contain the system will continue to work because they use a snapshot of the system that is taken when it is deployed.

        Access Level: Write

        https://docs.aws.amazon.com/thingsgraph/latest/APIReference/{APIReferenceDocPage}API_DeleteSystemTemplate.html

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "toDeleteSystemTemplate", []))

    @jsii.member(jsii_name="toDeploySystemInstance")
    def to_deploy_system_instance(self) -> "Iotthingsgraph":
        '''(experimental) Deploys the system instance to the target specified in CreateSystemInstance.

        Access Level: Write

        https://docs.aws.amazon.com/thingsgraph/latest/APIReference/{APIReferenceDocPage}API_DeploySystemInstance.html

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "toDeploySystemInstance", []))

    @jsii.member(jsii_name="toDeprecateFlowTemplate")
    def to_deprecate_flow_template(self) -> "Iotthingsgraph":
        '''(experimental) Deprecates the specified workflow.

        This action marks the workflow for deletion. Deprecated flows can't be deployed, but existing system instances that use the flow will continue to run.

        Access Level: Write

        https://docs.aws.amazon.com/thingsgraph/latest/APIReference/{APIReferenceDocPage}API_DeprecateFlowTemplate.html

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "toDeprecateFlowTemplate", []))

    @jsii.member(jsii_name="toDeprecateSystemTemplate")
    def to_deprecate_system_template(self) -> "Iotthingsgraph":
        '''(experimental) Deprecates the specified system.

        Access Level: Write

        https://docs.aws.amazon.com/thingsgraph/latest/APIReference/{APIReferenceDocPage}API_DeprecateSystemTemplate.html

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "toDeprecateSystemTemplate", []))

    @jsii.member(jsii_name="toDescribeNamespace")
    def to_describe_namespace(self) -> "Iotthingsgraph":
        '''(experimental) Gets the latest version of the user's namespace and the public version that it is tracking.

        Access Level: Read

        https://docs.aws.amazon.com/thingsgraph/latest/APIReference/{APIReferenceDocPage}API_DescribeNamespace.html

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "toDescribeNamespace", []))

    @jsii.member(jsii_name="toDissociateEntityFromThing")
    def to_dissociate_entity_from_thing(self) -> "Iotthingsgraph":
        '''(experimental) Dissociates a device entity from a concrete thing.

        The action takes only the type of the entity that you need to dissociate because only one entity of a particular type can be associated with a thing.

        Access Level: Write

        Dependent actions:

        - iot:DescribeThing
        - iot:DescribeThingGroup

        https://docs.aws.amazon.com/thingsgraph/latest/APIReference/{APIReferenceDocPage}API_DissociateEntityFromThing.html

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "toDissociateEntityFromThing", []))

    @jsii.member(jsii_name="toGetEntities")
    def to_get_entities(self) -> "Iotthingsgraph":
        '''(experimental) Gets descriptions of the specified entities. Uses the latest version of the user's namespace by default.

        Access Level: Read

        https://docs.aws.amazon.com/thingsgraph/latest/APIReference/{APIReferenceDocPage}API_GetEntities.html

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "toGetEntities", []))

    @jsii.member(jsii_name="toGetFlowTemplate")
    def to_get_flow_template(self) -> "Iotthingsgraph":
        '''(experimental) Gets the latest version of the DefinitionDocument and FlowTemplateSummary for the specified workflow.

        Access Level: Read

        https://docs.aws.amazon.com/thingsgraph/latest/APIReference/{APIReferenceDocPage}API_GetFlowTemplate.html

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "toGetFlowTemplate", []))

    @jsii.member(jsii_name="toGetFlowTemplateRevisions")
    def to_get_flow_template_revisions(self) -> "Iotthingsgraph":
        '''(experimental) Gets revisions of the specified workflow.

        Only the last 100 revisions are stored. If the workflow has been deprecated, this action will return revisions that occurred before the deprecation. This action won't work for workflows that have been deleted.

        Access Level: Read

        https://docs.aws.amazon.com/thingsgraph/latest/APIReference/{APIReferenceDocPage}API_GetFlowTemplateRevisions.html

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "toGetFlowTemplateRevisions", []))

    @jsii.member(jsii_name="toGetNamespaceDeletionStatus")
    def to_get_namespace_deletion_status(self) -> "Iotthingsgraph":
        '''(experimental) Gets the status of a namespace deletion task.

        Access Level: Read

        https://docs.aws.amazon.com/thingsgraph/latest/APIReference/{APIReferenceDocPage}API_GetNamespaceDeletionStatus.html

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "toGetNamespaceDeletionStatus", []))

    @jsii.member(jsii_name="toGetSystemInstance")
    def to_get_system_instance(self) -> "Iotthingsgraph":
        '''(experimental) Gets a system instance.

        Access Level: Read

        https://docs.aws.amazon.com/thingsgraph/latest/APIReference/{APIReferenceDocPage}API_GetSystemInstance.html

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "toGetSystemInstance", []))

    @jsii.member(jsii_name="toGetSystemTemplate")
    def to_get_system_template(self) -> "Iotthingsgraph":
        '''(experimental) Gets a system.

        Access Level: Read

        https://docs.aws.amazon.com/thingsgraph/latest/APIReference/{APIReferenceDocPage}API_GetSystemTemplate.html

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "toGetSystemTemplate", []))

    @jsii.member(jsii_name="toGetSystemTemplateRevisions")
    def to_get_system_template_revisions(self) -> "Iotthingsgraph":
        '''(experimental) Gets revisions made to the specified system template.

        Only the previous 100 revisions are stored. If the system has been deprecated, this action will return the revisions that occurred before its deprecation. This action won't work with systems that have been deleted.

        Access Level: Read

        https://docs.aws.amazon.com/thingsgraph/latest/APIReference/{APIReferenceDocPage}API_GetSystemTemplateRevisions.html

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "toGetSystemTemplateRevisions", []))

    @jsii.member(jsii_name="toGetUploadStatus")
    def to_get_upload_status(self) -> "Iotthingsgraph":
        '''(experimental) Gets the status of the specified upload.

        Access Level: Read

        https://docs.aws.amazon.com/thingsgraph/latest/APIReference/{APIReferenceDocPage}API_GetUploadStatus.html

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "toGetUploadStatus", []))

    @jsii.member(jsii_name="toListFlowExecutionMessages")
    def to_list_flow_execution_messages(self) -> "Iotthingsgraph":
        '''(experimental) Lists details of a single workflow execution.

        Access Level: List

        https://docs.aws.amazon.com/thingsgraph/latest/APIReference/{APIReferenceDocPage}API_ListFlowExecutionMessages.html

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "toListFlowExecutionMessages", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Iotthingsgraph":
        '''(experimental) Lists all tags for a given resource.

        Access Level: List

        https://docs.aws.amazon.com/thingsgraph/latest/APIReference/{APIReferenceDocPage}API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toSearchEntities")
    def to_search_entities(self) -> "Iotthingsgraph":
        '''(experimental) Searches for entities of the specified type.

        You can search for entities in your namespace and the public namespace that you're tracking.

        Access Level: Read

        https://docs.aws.amazon.com/thingsgraph/latest/APIReference/{APIReferenceDocPage}API_SearchEntities.html

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "toSearchEntities", []))

    @jsii.member(jsii_name="toSearchFlowExecutions")
    def to_search_flow_executions(self) -> "Iotthingsgraph":
        '''(experimental) Searches for workflow executions of a system instance.

        Access Level: Read

        https://docs.aws.amazon.com/thingsgraph/latest/APIReference/{APIReferenceDocPage}API_SearchFlowExecutions.html

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "toSearchFlowExecutions", []))

    @jsii.member(jsii_name="toSearchFlowTemplates")
    def to_search_flow_templates(self) -> "Iotthingsgraph":
        '''(experimental) Searches for summary information about workflows.

        Access Level: Read

        https://docs.aws.amazon.com/thingsgraph/latest/APIReference/{APIReferenceDocPage}API_SearchFlowTemplates.html

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "toSearchFlowTemplates", []))

    @jsii.member(jsii_name="toSearchSystemInstances")
    def to_search_system_instances(self) -> "Iotthingsgraph":
        '''(experimental) Searches for system instances in the user's account.

        Access Level: Read

        https://docs.aws.amazon.com/thingsgraph/latest/APIReference/{APIReferenceDocPage}API_SearchSystemInstances.html

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "toSearchSystemInstances", []))

    @jsii.member(jsii_name="toSearchSystemTemplates")
    def to_search_system_templates(self) -> "Iotthingsgraph":
        '''(experimental) Searches for summary information about systems in the user's account.

        You can filter by the ID of a workflow to return only systems that use the specified workflow.

        Access Level: Read

        https://docs.aws.amazon.com/thingsgraph/latest/APIReference/{APIReferenceDocPage}API_SearchSystemTemplates.html

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "toSearchSystemTemplates", []))

    @jsii.member(jsii_name="toSearchThings")
    def to_search_things(self) -> "Iotthingsgraph":
        '''(experimental) Searches for things associated with the specified entity. You can search by both device and device model.

        Access Level: Read

        https://docs.aws.amazon.com/thingsgraph/latest/APIReference/{APIReferenceDocPage}API_SearchThings.html

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "toSearchThings", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Iotthingsgraph":
        '''(experimental) Tag a specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/thingsgraph/latest/APIReference/{APIReferenceDocPage}API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUndeploySystemInstance")
    def to_undeploy_system_instance(self) -> "Iotthingsgraph":
        '''(experimental) Removes the system instance and associated triggers from the target.

        Access Level: Write

        https://docs.aws.amazon.com/thingsgraph/latest/APIReference/{APIReferenceDocPage}API_UndeploySystemInstance.html

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "toUndeploySystemInstance", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Iotthingsgraph":
        '''(experimental) Untag a specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/thingsgraph/latest/APIReference/{APIReferenceDocPage}API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateFlowTemplate")
    def to_update_flow_template(self) -> "Iotthingsgraph":
        '''(experimental) Updates the specified workflow.

        All deployed systems and system instances that use the workflow will see the changes in the flow when it is redeployed. The workflow can contain only entities in the specified namespace.

        Access Level: Write

        https://docs.aws.amazon.com/thingsgraph/latest/APIReference/{APIReferenceDocPage}API_UpdateFlowTemplate.html

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "toUpdateFlowTemplate", []))

    @jsii.member(jsii_name="toUpdateSystemTemplate")
    def to_update_system_template(self) -> "Iotthingsgraph":
        '''(experimental) Updates the specified system.

        You don't need to run this action after updating a workflow. Any system instance that uses the system will see the changes in the system when it is redeployed.

        Access Level: Write

        https://docs.aws.amazon.com/thingsgraph/latest/APIReference/{APIReferenceDocPage}API_UpdateSystemTemplate.html

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "toUpdateSystemTemplate", []))

    @jsii.member(jsii_name="toUploadEntityDefinitions")
    def to_upload_entity_definitions(self) -> "Iotthingsgraph":
        '''(experimental) Asynchronously uploads one or more entity definitions to the user's namespace.

        Access Level: Write

        https://docs.aws.amazon.com/thingsgraph/latest/APIReference/{APIReferenceDocPage}API_UploadEntityDefinitions.html

        :stability: experimental
        '''
        return typing.cast("Iotthingsgraph", jsii.invoke(self, "toUploadEntityDefinitions", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Iotwireless(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Iotwireless",
):
    '''(experimental) Statement provider for service `iotwireless <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotcoreforlorawan.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `iotwireless <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotcoreforlorawan.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Iotwireless, self, [sid])

    @jsii.member(jsii_name="onCert")
    def on_cert(
        self,
        certificate: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotwireless":
        '''(experimental) Adds a resource of type cert to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/x509-client-certs.html

        :param certificate: - Identifier for the certificate.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "onCert", [certificate, account, region, partition]))

    @jsii.member(jsii_name="onDestination")
    def on_destination(
        self,
        destination_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotwireless":
        '''(experimental) Adds a resource of type Destination to the statement.

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_CreateDestination.html

        :param destination_name: - Identifier for the destinationName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "onDestination", [destination_name, account, region, partition]))

    @jsii.member(jsii_name="onDeviceProfile")
    def on_device_profile(
        self,
        device_profile_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotwireless":
        '''(experimental) Adds a resource of type DeviceProfile to the statement.

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_CreateDeviceProfile.html

        :param device_profile_id: - Identifier for the deviceProfileId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "onDeviceProfile", [device_profile_id, account, region, partition]))

    @jsii.member(jsii_name="onServiceProfile")
    def on_service_profile(
        self,
        service_profile_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotwireless":
        '''(experimental) Adds a resource of type ServiceProfile to the statement.

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_CreateServiceProfile.html

        :param service_profile_id: - Identifier for the serviceProfileId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "onServiceProfile", [service_profile_id, account, region, partition]))

    @jsii.member(jsii_name="onSidewalkAccount")
    def on_sidewalk_account(
        self,
        sidewalk_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotwireless":
        '''(experimental) Adds a resource of type SidewalkAccount to the statement.

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_AssociateAwsAccountWithPartnerAccount.html

        :param sidewalk_id: - Identifier for the sidewalkId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "onSidewalkAccount", [sidewalk_id, account, region, partition]))

    @jsii.member(jsii_name="onThing")
    def on_thing(
        self,
        thing_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotwireless":
        '''(experimental) Adds a resource of type thing to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/thing-registry.html

        :param thing_name: - Identifier for the thingName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "onThing", [thing_name, account, region, partition]))

    @jsii.member(jsii_name="onWirelessDevice")
    def on_wireless_device(
        self,
        wireless_device_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotwireless":
        '''(experimental) Adds a resource of type WirelessDevice to the statement.

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_CreateWirelessDevice.html

        :param wireless_device_id: - Identifier for the wirelessDeviceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "onWirelessDevice", [wireless_device_id, account, region, partition]))

    @jsii.member(jsii_name="onWirelessGateway")
    def on_wireless_gateway(
        self,
        wireless_gateway_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotwireless":
        '''(experimental) Adds a resource of type WirelessGateway to the statement.

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_CreateWirelessGateway.html

        :param wireless_gateway_id: - Identifier for the wirelessGatewayId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "onWirelessGateway", [wireless_gateway_id, account, region, partition]))

    @jsii.member(jsii_name="onWirelessGatewayTaskDefinition")
    def on_wireless_gateway_task_definition(
        self,
        wireless_gateway_task_definition_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotwireless":
        '''(experimental) Adds a resource of type WirelessGatewayTaskDefinition to the statement.

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_CreateWirelessGatewayTaskDefinition.html

        :param wireless_gateway_task_definition_id: - Identifier for the wirelessGatewayTaskDefinitionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "onWirelessGatewayTaskDefinition", [wireless_gateway_task_definition_id, account, region, partition]))

    @jsii.member(jsii_name="toAssociateAwsAccountWithPartnerAccount")
    def to_associate_aws_account_with_partner_account(self) -> "Iotwireless":
        '''(experimental) Grants permission to link partner accounts with Aws account.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_AssociateAwsAccountWithPartnerAccount.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toAssociateAwsAccountWithPartnerAccount", []))

    @jsii.member(jsii_name="toAssociateWirelessDeviceWithThing")
    def to_associate_wireless_device_with_thing(self) -> "Iotwireless":
        '''(experimental) Grants permission to associate the wireless device with AWS IoT thing for a given wirelessDeviceId.

        Access Level: Write

        Dependent actions:

        - iot:DescribeThing

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_AssociateWirelessDeviceWithThing.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toAssociateWirelessDeviceWithThing", []))

    @jsii.member(jsii_name="toAssociateWirelessGatewayWithCertificate")
    def to_associate_wireless_gateway_with_certificate(self) -> "Iotwireless":
        '''(experimental) Grants permission to associate a WirelessGateway with the IoT Core Identity certificate.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_AssociateWirelessGatewayWithCertificate.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toAssociateWirelessGatewayWithCertificate", []))

    @jsii.member(jsii_name="toAssociateWirelessGatewayWithThing")
    def to_associate_wireless_gateway_with_thing(self) -> "Iotwireless":
        '''(experimental) Grants permission to associate the wireless gateway with AWS IoT thing for a given wirelessGatewayId.

        Access Level: Write

        Dependent actions:

        - iot:DescribeThing

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_AssociateWirelessGatewayWithThing.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toAssociateWirelessGatewayWithThing", []))

    @jsii.member(jsii_name="toCreateDestination")
    def to_create_destination(self) -> "Iotwireless":
        '''(experimental) Grants permission to create a Destination resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_CreateDestination.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toCreateDestination", []))

    @jsii.member(jsii_name="toCreateDeviceProfile")
    def to_create_device_profile(self) -> "Iotwireless":
        '''(experimental) Grants permission to create a DeviceProfile resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_CreateDeviceProfile.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toCreateDeviceProfile", []))

    @jsii.member(jsii_name="toCreateServiceProfile")
    def to_create_service_profile(self) -> "Iotwireless":
        '''(experimental) Grants permission to create a ServiceProfile resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_CreateServiceProfile.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toCreateServiceProfile", []))

    @jsii.member(jsii_name="toCreateWirelessDevice")
    def to_create_wireless_device(self) -> "Iotwireless":
        '''(experimental) Grants permission to create a WirelessDevice resource with given Destination.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_CreateWirelessDevice.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toCreateWirelessDevice", []))

    @jsii.member(jsii_name="toCreateWirelessGateway")
    def to_create_wireless_gateway(self) -> "Iotwireless":
        '''(experimental) Grants permission to create a WirelessGateway resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_CreateWirelessGateway.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toCreateWirelessGateway", []))

    @jsii.member(jsii_name="toCreateWirelessGatewayTask")
    def to_create_wireless_gateway_task(self) -> "Iotwireless":
        '''(experimental) Grants permission to create a task for a given WirelessGateway.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_CreateWirelessGatewayTask.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toCreateWirelessGatewayTask", []))

    @jsii.member(jsii_name="toCreateWirelessGatewayTaskDefinition")
    def to_create_wireless_gateway_task_definition(self) -> "Iotwireless":
        '''(experimental) Grants permission to create a WirelessGateway task definition.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_CreateWirelessGatewayTaskDefinition.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toCreateWirelessGatewayTaskDefinition", []))

    @jsii.member(jsii_name="toDeleteDestination")
    def to_delete_destination(self) -> "Iotwireless":
        '''(experimental) Grants permission to delete a Destination.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_DeleteDestination.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toDeleteDestination", []))

    @jsii.member(jsii_name="toDeleteDeviceProfile")
    def to_delete_device_profile(self) -> "Iotwireless":
        '''(experimental) Grants permission to delete a DeviceProfile.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_DeleteDeviceProfile.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toDeleteDeviceProfile", []))

    @jsii.member(jsii_name="toDeleteServiceProfile")
    def to_delete_service_profile(self) -> "Iotwireless":
        '''(experimental) Grants permission to delete a ServiceProfile.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_DeleteServiceProfile.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toDeleteServiceProfile", []))

    @jsii.member(jsii_name="toDeleteWirelessDevice")
    def to_delete_wireless_device(self) -> "Iotwireless":
        '''(experimental) Grants permission to delete a WirelessDevice.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_DeleteWirelessDevice.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toDeleteWirelessDevice", []))

    @jsii.member(jsii_name="toDeleteWirelessGateway")
    def to_delete_wireless_gateway(self) -> "Iotwireless":
        '''(experimental) Grants permission to delete a WirelessGateway.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_DeleteWirelessGateway.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toDeleteWirelessGateway", []))

    @jsii.member(jsii_name="toDeleteWirelessGatewayTask")
    def to_delete_wireless_gateway_task(self) -> "Iotwireless":
        '''(experimental) Grants permission to delete task for a given WirelessGateway.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_DeleteWirelessGatewayTask.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toDeleteWirelessGatewayTask", []))

    @jsii.member(jsii_name="toDeleteWirelessGatewayTaskDefinition")
    def to_delete_wireless_gateway_task_definition(self) -> "Iotwireless":
        '''(experimental) Grants permission to delete a WirelessGateway task definition.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_DeleteWirelessGatewayTaskDefinition.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toDeleteWirelessGatewayTaskDefinition", []))

    @jsii.member(jsii_name="toDisassociateAwsAccountFromPartnerAccount")
    def to_disassociate_aws_account_from_partner_account(self) -> "Iotwireless":
        '''(experimental) Grants permission to disassociate an AWS account from a partner account.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_DisassociateAwsAccountFromPartnerAccount.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toDisassociateAwsAccountFromPartnerAccount", []))

    @jsii.member(jsii_name="toDisassociateWirelessDeviceFromThing")
    def to_disassociate_wireless_device_from_thing(self) -> "Iotwireless":
        '''(experimental) Grants permission to disassociate a wireless device from a AWS IoT thing.

        Access Level: Write

        Dependent actions:

        - iot:DescribeThing

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_DisassociateWirelessDeviceFromThing.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toDisassociateWirelessDeviceFromThing", []))

    @jsii.member(jsii_name="toDisassociateWirelessGatewayFromCertificate")
    def to_disassociate_wireless_gateway_from_certificate(self) -> "Iotwireless":
        '''(experimental) Grants permission to disassociate a WirelessGateway from a IoT Core Identity certificate.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_DisassociateWirelessGatewayFromCertificate.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toDisassociateWirelessGatewayFromCertificate", []))

    @jsii.member(jsii_name="toDisassociateWirelessGatewayFromThing")
    def to_disassociate_wireless_gateway_from_thing(self) -> "Iotwireless":
        '''(experimental) Grants permission to disassociate a WirelessGateway from a IoT Core thing.

        Access Level: Write

        Dependent actions:

        - iot:DescribeThing

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_DisassociateWirelessGatewayFromThing.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toDisassociateWirelessGatewayFromThing", []))

    @jsii.member(jsii_name="toGetDestination")
    def to_get_destination(self) -> "Iotwireless":
        '''(experimental) Grants permission to get the Destination.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetDestination.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetDestination", []))

    @jsii.member(jsii_name="toGetDeviceProfile")
    def to_get_device_profile(self) -> "Iotwireless":
        '''(experimental) Grants permission to get the DeviceProfile.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetDeviceProfile.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetDeviceProfile", []))

    @jsii.member(jsii_name="toGetPartnerAccount")
    def to_get_partner_account(self) -> "Iotwireless":
        '''(experimental) Grants permission to get the associated PartnerAccount.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetPartnerAccount.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetPartnerAccount", []))

    @jsii.member(jsii_name="toGetServiceEndpoint")
    def to_get_service_endpoint(self) -> "Iotwireless":
        '''(experimental) Grants permission to retrieve the customer account specific endpoint for CUPS protocol connection or LoRaWAN Network Server (LNS) protocol connection, and optionally server trust certificate in PEM format.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetServiceEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetServiceEndpoint", []))

    @jsii.member(jsii_name="toGetServiceProfile")
    def to_get_service_profile(self) -> "Iotwireless":
        '''(experimental) Grants permission to get the ServiceProfile.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetServiceProfile.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetServiceProfile", []))

    @jsii.member(jsii_name="toGetWirelessDevice")
    def to_get_wireless_device(self) -> "Iotwireless":
        '''(experimental) Grants permission to get the WirelessDevice.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetWirelessDevice.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetWirelessDevice", []))

    @jsii.member(jsii_name="toGetWirelessDeviceStatistics")
    def to_get_wireless_device_statistics(self) -> "Iotwireless":
        '''(experimental) Grants permission to get statistics info for a given WirelessDevice.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetWirelessDeviceStatistics.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetWirelessDeviceStatistics", []))

    @jsii.member(jsii_name="toGetWirelessGateway")
    def to_get_wireless_gateway(self) -> "Iotwireless":
        '''(experimental) Grants permission to get the WirelessGateway.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetWirelessGateway.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetWirelessGateway", []))

    @jsii.member(jsii_name="toGetWirelessGatewayCertificate")
    def to_get_wireless_gateway_certificate(self) -> "Iotwireless":
        '''(experimental) Grants permission to get the IoT Core Identity certificate id associated with the WirelessGateway.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetWirelessGatewayCertificate.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetWirelessGatewayCertificate", []))

    @jsii.member(jsii_name="toGetWirelessGatewayFirmwareInformation")
    def to_get_wireless_gateway_firmware_information(self) -> "Iotwireless":
        '''(experimental) Grants permission to get Current firmware version and other information for the WirelessGateway.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetWirelessGatewayFirmwareInformation.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetWirelessGatewayFirmwareInformation", []))

    @jsii.member(jsii_name="toGetWirelessGatewayStatistics")
    def to_get_wireless_gateway_statistics(self) -> "Iotwireless":
        '''(experimental) Grants permission to get statistics info for a given WirelessGateway.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetWirelessGatewayStatistics.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetWirelessGatewayStatistics", []))

    @jsii.member(jsii_name="toGetWirelessGatewayTask")
    def to_get_wireless_gateway_task(self) -> "Iotwireless":
        '''(experimental) Grants permission to get the task for a given WirelessGateway.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetWirelessGatewayTask.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetWirelessGatewayTask", []))

    @jsii.member(jsii_name="toGetWirelessGatewayTaskDefinition")
    def to_get_wireless_gateway_task_definition(self) -> "Iotwireless":
        '''(experimental) Grants permission to get the given WirelessGateway task definition.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetWirelessGatewayTaskDefinition.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetWirelessGatewayTaskDefinition", []))

    @jsii.member(jsii_name="toListDestinations")
    def to_list_destinations(self) -> "Iotwireless":
        '''(experimental) List information of available Destinations based on the AWS account.

        Access Level: List

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_ListDestinations.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toListDestinations", []))

    @jsii.member(jsii_name="toListDeviceProfiles")
    def to_list_device_profiles(self) -> "Iotwireless":
        '''(experimental) Grants permission to list information of available DeviceProfiles based on the AWS account.

        Access Level: List

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_ListDeviceProfiles.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toListDeviceProfiles", []))

    @jsii.member(jsii_name="toListPartnerAccounts")
    def to_list_partner_accounts(self) -> "Iotwireless":
        '''(experimental) Grants permission to list the available partner accounts.

        Access Level: List

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_ListPartnerAccounts.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toListPartnerAccounts", []))

    @jsii.member(jsii_name="toListServiceProfiles")
    def to_list_service_profiles(self) -> "Iotwireless":
        '''(experimental) Grants permission to list information of available ServiceProfiles based on the AWS account.

        Access Level: List

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_ListServiceProfiles.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toListServiceProfiles", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Iotwireless":
        '''(experimental) Grants permission to list all tags for a given resource.

        Access Level: List

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListWirelessDevices")
    def to_list_wireless_devices(self) -> "Iotwireless":
        '''(experimental) Grants permission to list information of available WirelessDevices based on the AWS account.

        Access Level: List

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_ListWirelessDevices.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toListWirelessDevices", []))

    @jsii.member(jsii_name="toListWirelessGateways")
    def to_list_wireless_gateways(self) -> "Iotwireless":
        '''(experimental) Grants permission to list information of available WirelessGateways based on the AWS account.

        Access Level: List

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_ListWirelessGateways.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toListWirelessGateways", []))

    @jsii.member(jsii_name="toListWirelessGatewayTaskDefinitions")
    def to_list_wireless_gateway_task_definitions(self) -> "Iotwireless":
        '''(experimental) Grants permission to list information of available WirelessGateway task definitions based on the AWS account.

        Access Level: List

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_ListWirelessGatewayTaskDefinitions.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toListWirelessGatewayTaskDefinitions", []))

    @jsii.member(jsii_name="toSendDataToWirelessDevice")
    def to_send_data_to_wireless_device(self) -> "Iotwireless":
        '''(experimental) Grants permission to send the decrypted application data frame to the target device.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_SendDataToWirelessDevice.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toSendDataToWirelessDevice", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Iotwireless":
        '''(experimental) Grants permission to tag a given resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTestWirelessDevice")
    def to_test_wireless_device(self) -> "Iotwireless":
        '''(experimental) Grants permission to simulate a provisioned device to send an uplink data with payload of 'Hello'.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_TestWirelessDevice.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toTestWirelessDevice", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Iotwireless":
        '''(experimental) Grants permission to remove the given tags from the resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateDestination")
    def to_update_destination(self) -> "Iotwireless":
        '''(experimental) Grants permission to update a Destination resource.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_UpdateDestination.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toUpdateDestination", []))

    @jsii.member(jsii_name="toUpdatePartnerAccount")
    def to_update_partner_account(self) -> "Iotwireless":
        '''(experimental) Grants permission to update a partner account.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_UpdatePartnerAccount.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toUpdatePartnerAccount", []))

    @jsii.member(jsii_name="toUpdateWirelessDevice")
    def to_update_wireless_device(self) -> "Iotwireless":
        '''(experimental) Grants permission to update a WirelessDevice resource.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_UpdateWirelessDevice.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toUpdateWirelessDevice", []))

    @jsii.member(jsii_name="toUpdateWirelessGateway")
    def to_update_wireless_gateway(self) -> "Iotwireless":
        '''(experimental) Grants permission to update a WirelessGateway resource.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_UpdateWirelessGateway.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toUpdateWirelessGateway", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Iq(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Iq"):
    '''(experimental) Statement provider for service `iq <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiq.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `iq <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiq.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Iq, self, [sid])

    @jsii.member(jsii_name="toCreateProject")
    def to_create_project(self) -> "Iq":
        '''(experimental) Grants permission to submit new project requests.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toCreateProject", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class IqPermission(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.IqPermission",
):
    '''(experimental) Statement provider for service `iq-permission <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiqpermissions.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `iq-permission <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiqpermissions.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(IqPermission, self, [sid])

    @jsii.member(jsii_name="toApproveAccessGrant")
    def to_approve_access_grant(self) -> "IqPermission":
        '''(experimental) Grants permission to approve an access grant.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("IqPermission", jsii.invoke(self, "toApproveAccessGrant", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Ivs(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Ivs"):
    '''(experimental) Statement provider for service `ivs <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoninteractivevideoservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `ivs <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoninteractivevideoservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Ivs, self, [sid])

    @jsii.member(jsii_name="onChannel")
    def on_channel(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ivs":
        '''(experimental) Adds a resource of type Channel to the statement.

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_Channel.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "onChannel", [resource_id, account, partition]))

    @jsii.member(jsii_name="onPlaybackKeyPair")
    def on_playback_key_pair(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ivs":
        '''(experimental) Adds a resource of type Playback-Key-Pair to the statement.

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_PlaybackKeyPair.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "onPlaybackKeyPair", [resource_id, account, partition]))

    @jsii.member(jsii_name="onRecordingConfiguration")
    def on_recording_configuration(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ivs":
        '''(experimental) Adds a resource of type Recording-Configuration to the statement.

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_RecordingConfiguration.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "onRecordingConfiguration", [resource_id, account, partition]))

    @jsii.member(jsii_name="onStreamKey")
    def on_stream_key(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ivs":
        '''(experimental) Adds a resource of type Stream-Key to the statement.

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_StreamKey.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "onStreamKey", [resource_id, account, partition]))

    @jsii.member(jsii_name="toBatchGetChannel")
    def to_batch_get_channel(self) -> "Ivs":
        '''(experimental) Grants permission to get multiple channels simultaneously by channel ARN.

        Access Level: Read

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_BatchGetChannel.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toBatchGetChannel", []))

    @jsii.member(jsii_name="toBatchGetStreamKey")
    def to_batch_get_stream_key(self) -> "Ivs":
        '''(experimental) Grants permission to get multiple stream keys simultaneously by stream key ARN.

        Access Level: Read

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_BatchGetStreamKey.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toBatchGetStreamKey", []))

    @jsii.member(jsii_name="toCreateChannel")
    def to_create_channel(self) -> "Ivs":
        '''(experimental) Grants permission to create a new channel and an associated stream key.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_CreateChannel.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toCreateChannel", []))

    @jsii.member(jsii_name="toCreateRecordingConfiguration")
    def to_create_recording_configuration(self) -> "Ivs":
        '''(experimental) Grants permission to create a a new recording configuration.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_CreateRecordingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toCreateRecordingConfiguration", []))

    @jsii.member(jsii_name="toCreateStreamKey")
    def to_create_stream_key(self) -> "Ivs":
        '''(experimental) Grants permission to create a stream key.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_CreateStreamKey.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toCreateStreamKey", []))

    @jsii.member(jsii_name="toDeleteChannel")
    def to_delete_channel(self) -> "Ivs":
        '''(experimental) Grants permission to delete a channel and channel's stream keys.

        Access Level: Write

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_DeleteChannel.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toDeleteChannel", []))

    @jsii.member(jsii_name="toDeletePlaybackKeyPair")
    def to_delete_playback_key_pair(self) -> "Ivs":
        '''(experimental) Grants permission to delete the playback key pair for a specified ARN.

        Access Level: Write

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_DeletePlaybackKeyPair.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toDeletePlaybackKeyPair", []))

    @jsii.member(jsii_name="toDeleteRecordingConfiguration")
    def to_delete_recording_configuration(self) -> "Ivs":
        '''(experimental) Grants permission to delete a recording configuration for the specified ARN.

        Access Level: Write

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_DeleteRecordingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toDeleteRecordingConfiguration", []))

    @jsii.member(jsii_name="toDeleteStreamKey")
    def to_delete_stream_key(self) -> "Ivs":
        '''(experimental) Grants permission to delete the stream key for a specified ARN.

        Access Level: Write

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_DeleteStreamKey.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toDeleteStreamKey", []))

    @jsii.member(jsii_name="toGetChannel")
    def to_get_channel(self) -> "Ivs":
        '''(experimental) Grants permission to get the channel configuration for a specified channel ARN.

        Access Level: Read

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_GetChannel.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toGetChannel", []))

    @jsii.member(jsii_name="toGetPlaybackKeyPair")
    def to_get_playback_key_pair(self) -> "Ivs":
        '''(experimental) Grants permission to get the playback keypair information for a specified ARN.

        Access Level: Read

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_GetPlaybackKeyPair.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toGetPlaybackKeyPair", []))

    @jsii.member(jsii_name="toGetRecordingConfiguration")
    def to_get_recording_configuration(self) -> "Ivs":
        '''(experimental) Grants permission to get the recording configuration for the specified ARN.

        Access Level: Read

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_GetRecordingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toGetRecordingConfiguration", []))

    @jsii.member(jsii_name="toGetStream")
    def to_get_stream(self) -> "Ivs":
        '''(experimental) Grants permission to get information about the active (live) stream on a specified channel.

        Access Level: Read

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_GetStream.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toGetStream", []))

    @jsii.member(jsii_name="toGetStreamKey")
    def to_get_stream_key(self) -> "Ivs":
        '''(experimental) Grants permission to get stream-key information for a specified ARN.

        Access Level: Read

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_GetStreamKey.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toGetStreamKey", []))

    @jsii.member(jsii_name="toImportPlaybackKeyPair")
    def to_import_playback_key_pair(self) -> "Ivs":
        '''(experimental) Grants permission to import the public key.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_ImportPlaybackKeyPair.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toImportPlaybackKeyPair", []))

    @jsii.member(jsii_name="toListChannels")
    def to_list_channels(self) -> "Ivs":
        '''(experimental) Grants permission to get summary information about channels.

        Access Level: List

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_ListChannels.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toListChannels", []))

    @jsii.member(jsii_name="toListPlaybackKeyPairs")
    def to_list_playback_key_pairs(self) -> "Ivs":
        '''(experimental) Grants permission to get summary information about playback key pairs.

        Access Level: List

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_ListPlaybackKeyPairs.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toListPlaybackKeyPairs", []))

    @jsii.member(jsii_name="toListRecordingConfigurations")
    def to_list_recording_configurations(self) -> "Ivs":
        '''(experimental) Grants permission to get summary information about recording configurations.

        Access Level: List

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_ListRecordingConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toListRecordingConfigurations", []))

    @jsii.member(jsii_name="toListStreamKeys")
    def to_list_stream_keys(self) -> "Ivs":
        '''(experimental) Grants permission to get summary information about stream keys.

        Access Level: List

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_ListStreamKeys.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toListStreamKeys", []))

    @jsii.member(jsii_name="toListStreams")
    def to_list_streams(self) -> "Ivs":
        '''(experimental) Grants permission to get summary information about live streams.

        Access Level: List

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_ListStreams.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toListStreams", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Ivs":
        '''(experimental) Grants permission to get information about the tags for a specified ARN.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutMetadata")
    def to_put_metadata(self) -> "Ivs":
        '''(experimental) Grants permission to insert metadata into an RTMP stream for a specified channel.

        Access Level: Write

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_PutMetadata.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toPutMetadata", []))

    @jsii.member(jsii_name="toStopStream")
    def to_stop_stream(self) -> "Ivs":
        '''(experimental) Grants permission to disconnect a streamer on a specified channel.

        Access Level: Write

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_StopStream.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toStopStream", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Ivs":
        '''(experimental) Grants permission to add or update tags for a resource with a specified ARN.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Ivs":
        '''(experimental) Grants permission to remove tags for a resource with a specified ARN.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateChannel")
    def to_update_channel(self) -> "Ivs":
        '''(experimental) Grants permission to update a channel's configuration.

        Access Level: Write

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_UpdateChannel.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toUpdateChannel", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Kafka(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Kafka"):
    '''(experimental) Statement provider for service `kafka <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmanagedstreamingforapachekafka.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `kafka <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmanagedstreamingforapachekafka.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Kafka, self, [sid])

    @jsii.member(jsii_name="onCluster")
    def on_cluster(
        self,
        cluster_name: builtins.str,
        u_uid: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Kafka":
        '''(experimental) Adds a resource of type cluster to the statement.

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters-clusterarn.html

        :param cluster_name: - Identifier for the clusterName.
        :param u_uid: - Identifier for the uUID.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "onCluster", [cluster_name, u_uid, account, region, partition]))

    @jsii.member(jsii_name="toBatchAssociateScramSecret")
    def to_batch_associate_scram_secret(self) -> "Kafka":
        '''(experimental) Grants permission to associate one or more Scram Secrets with an Amazon MSK cluster.

        Access Level: Write

        Dependent actions:

        - kms:CreateGrant
        - kms:RetireGrant

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters-clusterarn-scram-secrets.html#BatchAssociateScramSecret

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toBatchAssociateScramSecret", []))

    @jsii.member(jsii_name="toBatchDisassociateScramSecret")
    def to_batch_disassociate_scram_secret(self) -> "Kafka":
        '''(experimental) Grants permission to disassociate one or more Scram Secrets from an Amazon MSK cluster.

        Access Level: Write

        Dependent actions:

        - kms:RetireGrant

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters-clusterarn-scram-secrets.html#BatchDisassociateScramSecret

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toBatchDisassociateScramSecret", []))

    @jsii.member(jsii_name="toCreateCluster")
    def to_create_cluster(self) -> "Kafka":
        '''(experimental) Grants permission to create an MSK cluster.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - ec2:DescribeSecurityGroups
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs
        - iam:AttachRolePolicy
        - iam:CreateServiceLinkedRole
        - iam:PutRolePolicy
        - kms:CreateGrant
        - kms:DescribeKey

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters.html#CreateCluster

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toCreateCluster", []))

    @jsii.member(jsii_name="toCreateConfiguration")
    def to_create_configuration(self) -> "Kafka":
        '''(experimental) Grants permission to create an MSK configuration.

        Access Level: Write

        https://docs.aws.amazon.com/msk/1.0/apireference/configurations.html#CreateConfiguration

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toCreateConfiguration", []))

    @jsii.member(jsii_name="toDeleteCluster")
    def to_delete_cluster(self) -> "Kafka":
        '''(experimental) Grants permission to delete an MSK cluster.

        Access Level: Write

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters-clusterarn.html#DeleteCluster

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toDeleteCluster", []))

    @jsii.member(jsii_name="toDeleteConfiguration")
    def to_delete_configuration(self) -> "Kafka":
        '''(experimental) Grants permission to delete the specified MSK configuration.

        Access Level: Write

        https://docs.aws.amazon.com/msk/1.0/apireference/configurations-arn.html#DeleteConfiguration

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toDeleteConfiguration", []))

    @jsii.member(jsii_name="toDescribeCluster")
    def to_describe_cluster(self) -> "Kafka":
        '''(experimental) Grants permission to describe an MSK cluster.

        Access Level: Read

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters-clusterarn.html#DescribeCluster

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toDescribeCluster", []))

    @jsii.member(jsii_name="toDescribeClusterOperation")
    def to_describe_cluster_operation(self) -> "Kafka":
        '''(experimental) Grants permission to describe the cluster operation that is specified by the given ARN.

        Access Level: Read

        https://docs.aws.amazon.com/msk/1.0/apireference/operations-clusteroperationarn.html#DescribeClusterOperation

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toDescribeClusterOperation", []))

    @jsii.member(jsii_name="toDescribeConfiguration")
    def to_describe_configuration(self) -> "Kafka":
        '''(experimental) Grants permission to describe an MSK configuration.

        Access Level: Read

        https://docs.aws.amazon.com/msk/1.0/apireference/configurations-configurationarn.html#DescribeConfiguration

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toDescribeConfiguration", []))

    @jsii.member(jsii_name="toDescribeConfigurationRevision")
    def to_describe_configuration_revision(self) -> "Kafka":
        '''(experimental) Grants permission to describe an MSK configuration revision.

        Access Level: Read

        https://docs.aws.amazon.com/msk/1.0/apireference/configurations-configurationarn-revision.html#DescribeConfigurationRevision

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toDescribeConfigurationRevision", []))

    @jsii.member(jsii_name="toGetBootstrapBrokers")
    def to_get_bootstrap_brokers(self) -> "Kafka":
        '''(experimental) Grants permission to get connection details for the brokers in an MSK cluster.

        Access Level: Read

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters-clusterarn-bootstrap-brokers.html#GetBootstrapBrokers

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toGetBootstrapBrokers", []))

    @jsii.member(jsii_name="toGetCompatibleKafkaVersions")
    def to_get_compatible_kafka_versions(self) -> "Kafka":
        '''(experimental) Grants permission to get a list of the Apache Kafka versions to which you can update an MSK cluster.

        Access Level: List

        https://docs.aws.amazon.com/msk/1.0/apireference/compatible-kafka-versions.html#GetCompatibleKafkaVersions

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toGetCompatibleKafkaVersions", []))

    @jsii.member(jsii_name="toListClusterOperations")
    def to_list_cluster_operations(self) -> "Kafka":
        '''(experimental) Grants permission to return a list of all the operations that have been performed on the specified MSK cluster.

        Access Level: List

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters-clusterarn-operations.html#ListClusterOperations

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toListClusterOperations", []))

    @jsii.member(jsii_name="toListClusters")
    def to_list_clusters(self) -> "Kafka":
        '''(experimental) Grants permission to list all MSK clusters in this account.

        Access Level: List

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters.html#ListClusters

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toListClusters", []))

    @jsii.member(jsii_name="toListConfigurationRevisions")
    def to_list_configuration_revisions(self) -> "Kafka":
        '''(experimental) Grants permission to list all revisions for an MSK configuration in this account.

        Access Level: List

        https://docs.aws.amazon.com/msk/1.0/apireference/configurations-arn-revisions.html#ListConfigurationRevisions

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toListConfigurationRevisions", []))

    @jsii.member(jsii_name="toListConfigurations")
    def to_list_configurations(self) -> "Kafka":
        '''(experimental) Grants permission to list all MSK configurations in this account.

        Access Level: List

        https://docs.aws.amazon.com/msk/1.0/apireference/configurations.html#CreateConfiguration

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toListConfigurations", []))

    @jsii.member(jsii_name="toListKafkaVersions")
    def to_list_kafka_versions(self) -> "Kafka":
        '''(experimental) Grants permission to list all Apache Kafka versions supported by Amazon MSK.

        Access Level: List

        https://docs.aws.amazon.com/msk/1.0/apireference/kafka-versions.html#ListKafkaVersions

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toListKafkaVersions", []))

    @jsii.member(jsii_name="toListNodes")
    def to_list_nodes(self) -> "Kafka":
        '''(experimental) Grants permission to list brokers in an MSK cluster.

        Access Level: List

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters-clusterarn-nodes.html#ListNodes

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toListNodes", []))

    @jsii.member(jsii_name="toListScramSecrets")
    def to_list_scram_secrets(self) -> "Kafka":
        '''(experimental) Grants permission to list the Scram Secrets associated with an Amazon MSK cluster.

        Access Level: List

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters-clusterarn-scram-secrets.html#ListScramSecrets

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toListScramSecrets", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Kafka":
        '''(experimental) Grants permission to list tags of an MSK resource.

        Access Level: List

        https://docs.aws.amazon.com/msk/1.0/apireference/tags-resourcearn.html#ListTagsForResource

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toRebootBroker")
    def to_reboot_broker(self) -> "Kafka":
        '''(experimental) Grants permission to reboot broker.

        Access Level: Write

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters-clusterarn-reboot-broker.html#RebootBroker

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toRebootBroker", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Kafka":
        '''(experimental) Grants permission to tag an MSK resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/msk/1.0/apireference/tags-resourcearn.html#TagResource

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Kafka":
        '''(experimental) Grants permission to remove tags from an MSK resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/msk/1.0/apireference/tags-resourcearn.html#UntagResource

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateBrokerCount")
    def to_update_broker_count(self) -> "Kafka":
        '''(experimental) Grants permission to update the number of brokers of the MSK cluster.

        Access Level: Write

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters-clusterarn-nodes-count.html#UpdateBrokerCount

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toUpdateBrokerCount", []))

    @jsii.member(jsii_name="toUpdateBrokerStorage")
    def to_update_broker_storage(self) -> "Kafka":
        '''(experimental) Grants permission to update the storage size of the brokers of the MSK cluster.

        Access Level: Write

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters-clusterarn-nodes-storage.html#UpdateBrokerStorage

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toUpdateBrokerStorage", []))

    @jsii.member(jsii_name="toUpdateBrokerType")
    def to_update_broker_type(self) -> "Kafka":
        '''(experimental) Grants permission to update the broker type of an Amazon MSK cluster.

        Access Level: Write

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters-clusterarn-nodes-type.html#UpdateBrokerType

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toUpdateBrokerType", []))

    @jsii.member(jsii_name="toUpdateClusterConfiguration")
    def to_update_cluster_configuration(self) -> "Kafka":
        '''(experimental) Grants permission to update the configuration of the MSK cluster.

        Access Level: Write

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters-clusterarn-configuration.html#UpdateClusterConfiguration

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toUpdateClusterConfiguration", []))

    @jsii.member(jsii_name="toUpdateClusterKafkaVersion")
    def to_update_cluster_kafka_version(self) -> "Kafka":
        '''(experimental) Grants permission to update the MSK cluster to the specified Apache Kafka version.

        Access Level: Write

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters-clusterarn-version.html#UpdateClusterKafkaVersion

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toUpdateClusterKafkaVersion", []))

    @jsii.member(jsii_name="toUpdateConfiguration")
    def to_update_configuration(self) -> "Kafka":
        '''(experimental) Grants permission to create a new revision of the MSK configuration.

        Access Level: Write

        https://docs.aws.amazon.com/msk/1.0/apireference/configurations-arn.html#updateconfiguration

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toUpdateConfiguration", []))

    @jsii.member(jsii_name="toUpdateMonitoring")
    def to_update_monitoring(self) -> "Kafka":
        '''(experimental) Grants permission to update the monitoring settings for the MSK cluster.

        Access Level: Write

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters-clusterarn-monitoring.html#UpdateMonitoring

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toUpdateMonitoring", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Kendra(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Kendra"):
    '''(experimental) Statement provider for service `kendra <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonkendra.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `kendra <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonkendra.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Kendra, self, [sid])

    @jsii.member(jsii_name="onDataSource")
    def on_data_source(
        self,
        index_id: builtins.str,
        data_source_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Kendra":
        '''(experimental) Adds a resource of type data-source to the statement.

        https://docs.aws.amazon.com/kendra/latest/dg/data-source.html

        :param index_id: - Identifier for the indexId.
        :param data_source_id: - Identifier for the dataSourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "onDataSource", [index_id, data_source_id, account, region, partition]))

    @jsii.member(jsii_name="onFaq")
    def on_faq(
        self,
        index_id: builtins.str,
        faq_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Kendra":
        '''(experimental) Adds a resource of type faq to the statement.

        https://docs.aws.amazon.com/kendra/latest/dg/faq.html

        :param index_id: - Identifier for the indexId.
        :param faq_id: - Identifier for the faqId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "onFaq", [index_id, faq_id, account, region, partition]))

    @jsii.member(jsii_name="onIndex")
    def on_index(
        self,
        index_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Kendra":
        '''(experimental) Adds a resource of type index to the statement.

        https://docs.aws.amazon.com/kendra/latest/dg/index.html

        :param index_id: - Identifier for the indexId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "onIndex", [index_id, account, region, partition]))

    @jsii.member(jsii_name="onThesaurus")
    def on_thesaurus(
        self,
        index_id: builtins.str,
        thesaurus_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Kendra":
        '''(experimental) Adds a resource of type thesaurus to the statement.

        https://docs.aws.amazon.com/kendra/latest/dg/thesaurus.html

        :param index_id: - Identifier for the indexId.
        :param thesaurus_id: - Identifier for the thesaurusId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "onThesaurus", [index_id, thesaurus_id, account, region, partition]))

    @jsii.member(jsii_name="toBatchDeleteDocument")
    def to_batch_delete_document(self) -> "Kendra":
        '''(experimental) Grant permission to batch delete document.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_BatchDeleteDocument.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toBatchDeleteDocument", []))

    @jsii.member(jsii_name="toBatchPutDocument")
    def to_batch_put_document(self) -> "Kendra":
        '''(experimental) Grant permission to batch put document.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_BatchPutDocument.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toBatchPutDocument", []))

    @jsii.member(jsii_name="toCreateDataSource")
    def to_create_data_source(self) -> "Kendra":
        '''(experimental) Grant permission to create a data source.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kendra/latest/dg/API_CreateDataSource.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toCreateDataSource", []))

    @jsii.member(jsii_name="toCreateFaq")
    def to_create_faq(self) -> "Kendra":
        '''(experimental) Grant permission to create an Faq.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kendra/latest/dg/API_CreateFaq.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toCreateFaq", []))

    @jsii.member(jsii_name="toCreateIndex")
    def to_create_index(self) -> "Kendra":
        '''(experimental) Grant permission to create an Index.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kendra/latest/dg/API_CreateIndex.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toCreateIndex", []))

    @jsii.member(jsii_name="toCreateThesaurus")
    def to_create_thesaurus(self) -> "Kendra":
        '''(experimental) Grant permission to create a Thesaurus.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kendra/latest/dg/API_CreateThesaurus.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toCreateThesaurus", []))

    @jsii.member(jsii_name="toDeleteDataSource")
    def to_delete_data_source(self) -> "Kendra":
        '''(experimental) Grant permission to delete a data source.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_DeleteDataSource.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toDeleteDataSource", []))

    @jsii.member(jsii_name="toDeleteFaq")
    def to_delete_faq(self) -> "Kendra":
        '''(experimental) Grant permission to delete an Faq.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_DeleteFaq.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toDeleteFaq", []))

    @jsii.member(jsii_name="toDeleteIndex")
    def to_delete_index(self) -> "Kendra":
        '''(experimental) Grant permission to delete an Index.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_DeleteIndex.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toDeleteIndex", []))

    @jsii.member(jsii_name="toDeleteThesaurus")
    def to_delete_thesaurus(self) -> "Kendra":
        '''(experimental) Grant permission to delete a Thesaurus.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_DeleteThesaurus.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toDeleteThesaurus", []))

    @jsii.member(jsii_name="toDescribeDataSource")
    def to_describe_data_source(self) -> "Kendra":
        '''(experimental) Grant permission to describe a data source.

        Access Level: Read

        https://docs.aws.amazon.com/kendra/latest/dg/API_DescribeDataSource.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toDescribeDataSource", []))

    @jsii.member(jsii_name="toDescribeFaq")
    def to_describe_faq(self) -> "Kendra":
        '''(experimental) Grant permission to describe an Faq.

        Access Level: Read

        https://docs.aws.amazon.com/kendra/latest/dg/API_DescribeFaq.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toDescribeFaq", []))

    @jsii.member(jsii_name="toDescribeIndex")
    def to_describe_index(self) -> "Kendra":
        '''(experimental) Grant permission to describe an Index.

        Access Level: Read

        https://docs.aws.amazon.com/kendra/latest/dg/API_DescribeIndex.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toDescribeIndex", []))

    @jsii.member(jsii_name="toDescribeThesaurus")
    def to_describe_thesaurus(self) -> "Kendra":
        '''(experimental) Grant permission to describe a Thesaurus.

        Access Level: Read

        https://docs.aws.amazon.com/kendra/latest/dg/API_DescribeThesaurus.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toDescribeThesaurus", []))

    @jsii.member(jsii_name="toListDataSources")
    def to_list_data_sources(self) -> "Kendra":
        '''(experimental) Grant permission to list the data sources.

        Access Level: List

        https://docs.aws.amazon.com/kendra/latest/dg/API_ListDataSources.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toListDataSources", []))

    @jsii.member(jsii_name="toListDataSourceSyncJobs")
    def to_list_data_source_sync_jobs(self) -> "Kendra":
        '''(experimental) Grant permission to get Data Source sync job history.

        Access Level: List

        https://docs.aws.amazon.com/kendra/latest/dg/API_ListDataSourceSyncJobs.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toListDataSourceSyncJobs", []))

    @jsii.member(jsii_name="toListFaqs")
    def to_list_faqs(self) -> "Kendra":
        '''(experimental) Grant permission to list the Faqs.

        Access Level: List

        https://docs.aws.amazon.com/kendra/latest/dg/API_ListFaqs.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toListFaqs", []))

    @jsii.member(jsii_name="toListIndices")
    def to_list_indices(self) -> "Kendra":
        '''(experimental) Grant permission to list the indexes.

        Access Level: List

        https://docs.aws.amazon.com/kendra/latest/dg/API_ListIndices.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toListIndices", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Kendra":
        '''(experimental) Grant permission to list tags for a resource.

        Access Level: List

        https://docs.aws.amazon.com/kendra/latest/dg/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListThesauri")
    def to_list_thesauri(self) -> "Kendra":
        '''(experimental) Grant permission to list the Thesauri.

        Access Level: List

        https://docs.aws.amazon.com/kendra/latest/dg/API_ListThesauri.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toListThesauri", []))

    @jsii.member(jsii_name="toQuery")
    def to_query(self) -> "Kendra":
        '''(experimental) Grant permission to query documents and faqs.

        Access Level: Read

        https://docs.aws.amazon.com/kendra/latest/dg/API_Query.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toQuery", []))

    @jsii.member(jsii_name="toStartDataSourceSyncJob")
    def to_start_data_source_sync_job(self) -> "Kendra":
        '''(experimental) Grant permission to start Data Source sync job.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_StartDataSourceSyncJob.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toStartDataSourceSyncJob", []))

    @jsii.member(jsii_name="toStopDataSourceSyncJob")
    def to_stop_data_source_sync_job(self) -> "Kendra":
        '''(experimental) Grant permission to stop Data Source sync job.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_StopDataSourceSyncJob.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toStopDataSourceSyncJob", []))

    @jsii.member(jsii_name="toSubmitFeedback")
    def to_submit_feedback(self) -> "Kendra":
        '''(experimental) Grant permission to send feedback about a query results.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_SubmitFeedback.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toSubmitFeedback", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Kendra":
        '''(experimental) Grant permission to tag a resource with given key value pairs.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kendra/latest/dg/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Kendra":
        '''(experimental) Grant permission to remove the tag with the given key from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kendra/latest/dg/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateDataSource")
    def to_update_data_source(self) -> "Kendra":
        '''(experimental) Grant permission to update a data source.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_UpdateDataSource.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toUpdateDataSource", []))

    @jsii.member(jsii_name="toUpdateIndex")
    def to_update_index(self) -> "Kendra":
        '''(experimental) Grant permission to update an Index.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_UpdateIndex.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toUpdateIndex", []))

    @jsii.member(jsii_name="toUpdateThesaurus")
    def to_update_thesaurus(self) -> "Kendra":
        '''(experimental) Grant permission to update a thesaurus.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_UpdateThesaurus.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toUpdateThesaurus", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Kinesis(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Kinesis"):
    '''(experimental) Statement provider for service `kinesis <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonkinesis.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `kinesis <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonkinesis.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Kinesis, self, [sid])

    @jsii.member(jsii_name="onConsumer")
    def on_consumer(
        self,
        stream_type: builtins.str,
        stream_name: builtins.str,
        consumer_name: builtins.str,
        consumer_creation_timpstamp: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Kinesis":
        '''(experimental) Adds a resource of type consumer to the statement.

        https://docs.aws.amazon.com/kinesis/latest/dev/amazon-kinesis-consumers.html

        :param stream_type: - Identifier for the streamType.
        :param stream_name: - Identifier for the streamName.
        :param consumer_name: - Identifier for the consumerName.
        :param consumer_creation_timpstamp: - Identifier for the consumerCreationTimpstamp.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "onConsumer", [stream_type, stream_name, consumer_name, consumer_creation_timpstamp, account, region, partition]))

    @jsii.member(jsii_name="onKmsKey")
    def on_kms_key(
        self,
        key_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Kinesis":
        '''(experimental) Adds a resource of type kmsKey to the statement.

        https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#master_keys

        :param key_id: - Identifier for the keyId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "onKmsKey", [key_id, account, region, partition]))

    @jsii.member(jsii_name="onStream")
    def on_stream(
        self,
        stream_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Kinesis":
        '''(experimental) Adds a resource of type stream to the statement.

        https://docs.aws.amazon.com/kinesis/latest/dev/amazon-kinesis-streams.html

        :param stream_name: - Identifier for the streamName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "onStream", [stream_name, account, region, partition]))

    @jsii.member(jsii_name="toAddTagsToStream")
    def to_add_tags_to_stream(self) -> "Kinesis":
        '''(experimental) Adds or updates tags for the specified Amazon Kinesis stream. Each stream can have up to 10 tags.

        Access Level: Tagging

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_AddTagsToStream.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toAddTagsToStream", []))

    @jsii.member(jsii_name="toCreateStream")
    def to_create_stream(self) -> "Kinesis":
        '''(experimental) Creates a Amazon Kinesis stream.

        Access Level: Write

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_CreateStream.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toCreateStream", []))

    @jsii.member(jsii_name="toDecreaseStreamRetentionPeriod")
    def to_decrease_stream_retention_period(self) -> "Kinesis":
        '''(experimental) Decreases the stream's retention period, which is the length of time data records are accessible after they are added to the stream.

        Access Level: Write

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_DecreaseStreamRetentionPeriod.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toDecreaseStreamRetentionPeriod", []))

    @jsii.member(jsii_name="toDeleteStream")
    def to_delete_stream(self) -> "Kinesis":
        '''(experimental) Deletes a stream and all its shards and data.

        Access Level: Write

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_DeleteStream.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toDeleteStream", []))

    @jsii.member(jsii_name="toDeregisterStreamConsumer")
    def to_deregister_stream_consumer(self) -> "Kinesis":
        '''(experimental) Deregisters a stream consumer with a Kinesis data stream.

        Access Level: Write

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_DeregisterStreamConsumer.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toDeregisterStreamConsumer", []))

    @jsii.member(jsii_name="toDescribeLimits")
    def to_describe_limits(self) -> "Kinesis":
        '''(experimental) Describes the shard limits and usage for the account.

        Access Level: Read

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_DescribeLimits.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toDescribeLimits", []))

    @jsii.member(jsii_name="toDescribeStream")
    def to_describe_stream(self) -> "Kinesis":
        '''(experimental) Describes the specified stream.

        Access Level: Read

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_DescribeStream.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toDescribeStream", []))

    @jsii.member(jsii_name="toDescribeStreamConsumer")
    def to_describe_stream_consumer(self) -> "Kinesis":
        '''(experimental) Gets the description of a registered stream consumer.

        Access Level: Read

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_DescribeStreamConsumer.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toDescribeStreamConsumer", []))

    @jsii.member(jsii_name="toDescribeStreamSummary")
    def to_describe_stream_summary(self) -> "Kinesis":
        '''(experimental) Provides a summarized description of the specified Kinesis data stream without the shard list.

        Access Level: Read

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_DescribeStreamSummary.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toDescribeStreamSummary", []))

    @jsii.member(jsii_name="toDisableEnhancedMonitoring")
    def to_disable_enhanced_monitoring(self) -> "Kinesis":
        '''(experimental) Disables enhanced monitoring.

        Access Level: Write

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_DisableEnhancedMonitoring.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toDisableEnhancedMonitoring", []))

    @jsii.member(jsii_name="toEnableEnhancedMonitoring")
    def to_enable_enhanced_monitoring(self) -> "Kinesis":
        '''(experimental) API_EnableEnhancedMonitoring.html.

        Access Level: Write

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_EnableEnhancedMonitoring.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toEnableEnhancedMonitoring", []))

    @jsii.member(jsii_name="toGetRecords")
    def to_get_records(self) -> "Kinesis":
        '''(experimental) Gets data records from a shard.

        Access Level: Read

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_GetRecords.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toGetRecords", []))

    @jsii.member(jsii_name="toGetShardIterator")
    def to_get_shard_iterator(self) -> "Kinesis":
        '''(experimental) Gets a shard iterator. A shard iterator expires five minutes after it is returned to the requester.

        Access Level: Read

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_GetShardIterator.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toGetShardIterator", []))

    @jsii.member(jsii_name="toIncreaseStreamRetentionPeriod")
    def to_increase_stream_retention_period(self) -> "Kinesis":
        '''(experimental) Increases the stream's retention period, which is the length of time data records are accessible after they are added to the stream.

        Access Level: Write

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_IncreaseStreamRetentionPeriod.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toIncreaseStreamRetentionPeriod", []))

    @jsii.member(jsii_name="toListShards")
    def to_list_shards(self) -> "Kinesis":
        '''(experimental) Lists the shards in a stream and provides information about each shard.

        Access Level: List

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_ListShards.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toListShards", []))

    @jsii.member(jsii_name="toListStreamConsumers")
    def to_list_stream_consumers(self) -> "Kinesis":
        '''(experimental) Lists the stream consumers registered to receive data from a Kinesis stream using enhanced fan-out, and provides information about each consumer.

        Access Level: List

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_ListStreamConsumers.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toListStreamConsumers", []))

    @jsii.member(jsii_name="toListStreams")
    def to_list_streams(self) -> "Kinesis":
        '''(experimental) Lists your streams.

        Access Level: List

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_ListStreams.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toListStreams", []))

    @jsii.member(jsii_name="toListTagsForStream")
    def to_list_tags_for_stream(self) -> "Kinesis":
        '''(experimental) Lists the tags for the specified Amazon Kinesis stream.

        Access Level: Read

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_ListTagsForStream.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toListTagsForStream", []))

    @jsii.member(jsii_name="toMergeShards")
    def to_merge_shards(self) -> "Kinesis":
        '''(experimental) Merges two adjacent shards in a stream and combines them into a single shard to reduce the stream's capacity to ingest and transport data.

        Access Level: Write

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_MergeShards.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toMergeShards", []))

    @jsii.member(jsii_name="toPutRecord")
    def to_put_record(self) -> "Kinesis":
        '''(experimental) Writes a single data record from a producer into an Amazon Kinesis stream.

        Access Level: Write

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_PutRecord.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toPutRecord", []))

    @jsii.member(jsii_name="toPutRecords")
    def to_put_records(self) -> "Kinesis":
        '''(experimental) Writes multiple data records from a producer into an Amazon Kinesis stream in a single call (also referred to as a PutRecords request).

        Access Level: Write

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_PutRecords.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toPutRecords", []))

    @jsii.member(jsii_name="toRegisterStreamConsumer")
    def to_register_stream_consumer(self) -> "Kinesis":
        '''(experimental) Registers a stream consumer with a Kinesis data stream.

        Access Level: Write

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_RegisterStreamConsumer.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toRegisterStreamConsumer", []))

    @jsii.member(jsii_name="toRemoveTagsFromStream")
    def to_remove_tags_from_stream(self) -> "Kinesis":
        '''(experimental) Description for SplitShard.

        Access Level: Tagging

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_RemoveTagsFromStream.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toRemoveTagsFromStream", []))

    @jsii.member(jsii_name="toSplitShard")
    def to_split_shard(self) -> "Kinesis":
        '''(experimental) Description for SplitShard.

        Access Level: Write

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_SplitShard.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toSplitShard", []))

    @jsii.member(jsii_name="toStartStreamEncryption")
    def to_start_stream_encryption(self) -> "Kinesis":
        '''(experimental) Grants permission to enable or update server-side encryption using an AWS KMS key for a specified stream.

        Access Level: Write

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_StartStreamEncryption.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toStartStreamEncryption", []))

    @jsii.member(jsii_name="toStopStreamEncryption")
    def to_stop_stream_encryption(self) -> "Kinesis":
        '''(experimental) Grants permission to disable server-side encryption for a specified stream.

        Access Level: Write

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_StopStreamEncryption.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toStopStreamEncryption", []))

    @jsii.member(jsii_name="toSubscribeToShard")
    def to_subscribe_to_shard(self) -> "Kinesis":
        '''(experimental) Listening to a specific shard with enhanced fan-out.

        Access Level: Read

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_SubscribeToShard.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toSubscribeToShard", []))

    @jsii.member(jsii_name="toUpdateShardCount")
    def to_update_shard_count(self) -> "Kinesis":
        '''(experimental) Updates the shard count of the specified stream to the specified number of shards.

        Access Level: Write

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_UpdateShardCount.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toUpdateShardCount", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Kinesisanalytics(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Kinesisanalytics",
):
    '''(experimental) Statement provider for service `kinesisanalytics <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonkinesisanalytics.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `kinesisanalytics <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonkinesisanalytics.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Kinesisanalytics, self, [sid])

    @jsii.member(jsii_name="onApplication")
    def on_application(
        self,
        application_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Kinesisanalytics":
        '''(experimental) Adds a resource of type application to the statement.

        https://docs.aws.amazon.com/kinesisanalytics/latest/dev/how-it-works.html

        :param application_name: - Identifier for the applicationName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Kinesisanalytics", jsii.invoke(self, "onApplication", [application_name, account, region, partition]))

    @jsii.member(jsii_name="toAddApplicationInput")
    def to_add_application_input(self) -> "Kinesisanalytics":
        '''(experimental) Adds input to the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/dev/API_AddApplicationInput.html

        :stability: experimental
        '''
        return typing.cast("Kinesisanalytics", jsii.invoke(self, "toAddApplicationInput", []))

    @jsii.member(jsii_name="toAddApplicationOutput")
    def to_add_application_output(self) -> "Kinesisanalytics":
        '''(experimental) Adds output to the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/dev/API_AddApplicationOutput.html

        :stability: experimental
        '''
        return typing.cast("Kinesisanalytics", jsii.invoke(self, "toAddApplicationOutput", []))

    @jsii.member(jsii_name="toAddApplicationReferenceDataSource")
    def to_add_application_reference_data_source(self) -> "Kinesisanalytics":
        '''(experimental) Adds reference data source to the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/dev/API_AddApplicationReferenceDataSource.html

        :stability: experimental
        '''
        return typing.cast("Kinesisanalytics", jsii.invoke(self, "toAddApplicationReferenceDataSource", []))

    @jsii.member(jsii_name="toCreateApplication")
    def to_create_application(self) -> "Kinesisanalytics":
        '''(experimental) Creates an application.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kinesisanalytics/latest/dev/API_CreateApplication.html

        :stability: experimental
        '''
        return typing.cast("Kinesisanalytics", jsii.invoke(self, "toCreateApplication", []))

    @jsii.member(jsii_name="toDeleteApplication")
    def to_delete_application(self) -> "Kinesisanalytics":
        '''(experimental) Deletes the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/dev/API_DeleteApplication.html

        :stability: experimental
        '''
        return typing.cast("Kinesisanalytics", jsii.invoke(self, "toDeleteApplication", []))

    @jsii.member(jsii_name="toDeleteApplicationOutput")
    def to_delete_application_output(self) -> "Kinesisanalytics":
        '''(experimental) Deletes the specified output of the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/dev/API_DeleteApplicationOutput.html

        :stability: experimental
        '''
        return typing.cast("Kinesisanalytics", jsii.invoke(self, "toDeleteApplicationOutput", []))

    @jsii.member(jsii_name="toDeleteApplicationReferenceDataSource")
    def to_delete_application_reference_data_source(self) -> "Kinesisanalytics":
        '''(experimental) Deletes the specified reference data source of the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/dev/API_DeleteApplicationReferenceDataSource.html

        :stability: experimental
        '''
        return typing.cast("Kinesisanalytics", jsii.invoke(self, "toDeleteApplicationReferenceDataSource", []))

    @jsii.member(jsii_name="toDescribeApplication")
    def to_describe_application(self) -> "Kinesisanalytics":
        '''(experimental) Describes the specified application.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisanalytics/latest/dev/API_DescribeApplication.html

        :stability: experimental
        '''
        return typing.cast("Kinesisanalytics", jsii.invoke(self, "toDescribeApplication", []))

    @jsii.member(jsii_name="toDiscoverInputSchema")
    def to_discover_input_schema(self) -> "Kinesisanalytics":
        '''(experimental) Discovers the input schema for the application.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisanalytics/latest/dev/API_DiscoverInputSchema.html

        :stability: experimental
        '''
        return typing.cast("Kinesisanalytics", jsii.invoke(self, "toDiscoverInputSchema", []))

    @jsii.member(jsii_name="toGetApplicationState")
    def to_get_application_state(self) -> "Kinesisanalytics":
        '''(experimental) Grant permission to Kinesis Data Analytics console to display stream results for Kinesis Data Analytics SQL runtime applications.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisanalytics/latest/dev/api-permissions-reference.html#api-permissions-reference-gas

        :stability: experimental
        '''
        return typing.cast("Kinesisanalytics", jsii.invoke(self, "toGetApplicationState", []))

    @jsii.member(jsii_name="toListApplications")
    def to_list_applications(self) -> "Kinesisanalytics":
        '''(experimental) List applications for the account.

        Access Level: List

        https://docs.aws.amazon.com/kinesisanalytics/latest/dev/API_ListApplications.html

        :stability: experimental
        '''
        return typing.cast("Kinesisanalytics", jsii.invoke(self, "toListApplications", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Kinesisanalytics":
        '''(experimental) Fetch the tags associated with the application.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisanalytics/latest/dev/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Kinesisanalytics", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toStartApplication")
    def to_start_application(self) -> "Kinesisanalytics":
        '''(experimental) Starts the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/dev/API_StartsApplication.html

        :stability: experimental
        '''
        return typing.cast("Kinesisanalytics", jsii.invoke(self, "toStartApplication", []))

    @jsii.member(jsii_name="toStopApplication")
    def to_stop_application(self) -> "Kinesisanalytics":
        '''(experimental) Stops the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/dev/API_StopApplication.html

        :stability: experimental
        '''
        return typing.cast("Kinesisanalytics", jsii.invoke(self, "toStopApplication", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Kinesisanalytics":
        '''(experimental) Add tags to the application.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kinesisanalytics/latest/dev/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Kinesisanalytics", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Kinesisanalytics":
        '''(experimental) Remove the specified tags from the application.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kinesisanalytics/latest/dev/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Kinesisanalytics", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateApplication")
    def to_update_application(self) -> "Kinesisanalytics":
        '''(experimental) Updates the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/dev/API_UpdateApplication.html

        :stability: experimental
        '''
        return typing.cast("Kinesisanalytics", jsii.invoke(self, "toUpdateApplication", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class KinesisanalyticsV2(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.KinesisanalyticsV2",
):
    '''(experimental) Statement provider for service `kinesisanalytics-v2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonkinesisanalyticsv2.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `kinesisanalytics-v2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonkinesisanalyticsv2.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(KinesisanalyticsV2, self, [sid])

    @jsii.member(jsii_name="onApplication")
    def on_application(
        self,
        application_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "KinesisanalyticsV2":
        '''(experimental) Adds a resource of type application to the statement.

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/how-it-works.html

        :param application_name: - Identifier for the applicationName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "onApplication", [application_name, account, region, partition]))

    @jsii.member(jsii_name="toAddApplicationCloudWatchLoggingOption")
    def to_add_application_cloud_watch_logging_option(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to add cloudwatch logging option to the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_AddApplicationCloudWatchLoggingOption.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toAddApplicationCloudWatchLoggingOption", []))

    @jsii.member(jsii_name="toAddApplicationInput")
    def to_add_application_input(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to add input to the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_AddApplicationInput.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toAddApplicationInput", []))

    @jsii.member(jsii_name="toAddApplicationInputProcessingConfiguration")
    def to_add_application_input_processing_configuration(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to add input processing configuration to the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_AddApplicationInputProcessingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toAddApplicationInputProcessingConfiguration", []))

    @jsii.member(jsii_name="toAddApplicationOutput")
    def to_add_application_output(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to add output to the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_AddApplicationOutput.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toAddApplicationOutput", []))

    @jsii.member(jsii_name="toAddApplicationReferenceDataSource")
    def to_add_application_reference_data_source(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to add reference data source to the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_AddApplicationReferenceDataSource.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toAddApplicationReferenceDataSource", []))

    @jsii.member(jsii_name="toAddApplicationVpcConfiguration")
    def to_add_application_vpc_configuration(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to add VPC configuration to the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_AddApplicationVpcConfiguration.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toAddApplicationVpcConfiguration", []))

    @jsii.member(jsii_name="toCreateApplication")
    def to_create_application(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to create an application.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_CreateApplication.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toCreateApplication", []))

    @jsii.member(jsii_name="toCreateApplicationPresignedUrl")
    def to_create_application_presigned_url(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to create and return a URL that you can use to connect to an application's extension.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_CreateApplicationPresignedUrl.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toCreateApplicationPresignedUrl", []))

    @jsii.member(jsii_name="toCreateApplicationSnapshot")
    def to_create_application_snapshot(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to create a snapshot for an application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_CreateApplicationSnapshot.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toCreateApplicationSnapshot", []))

    @jsii.member(jsii_name="toDeleteApplication")
    def to_delete_application(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to delete the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_DeleteApplication.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toDeleteApplication", []))

    @jsii.member(jsii_name="toDeleteApplicationCloudWatchLoggingOption")
    def to_delete_application_cloud_watch_logging_option(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to delete the specified cloudwatch logging option of the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_DeleteApplicationCloudWatchLoggingOption.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toDeleteApplicationCloudWatchLoggingOption", []))

    @jsii.member(jsii_name="toDeleteApplicationInputProcessingConfiguration")
    def to_delete_application_input_processing_configuration(
        self,
    ) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to delete the specified input processing configuration of the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_DeleteApplicationInputProcessingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toDeleteApplicationInputProcessingConfiguration", []))

    @jsii.member(jsii_name="toDeleteApplicationOutput")
    def to_delete_application_output(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to delete the specified output of the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_DeleteApplicationOutput.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toDeleteApplicationOutput", []))

    @jsii.member(jsii_name="toDeleteApplicationReferenceDataSource")
    def to_delete_application_reference_data_source(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to delete the specified reference data source of the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_DeleteApplicationReferenceDataSource.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toDeleteApplicationReferenceDataSource", []))

    @jsii.member(jsii_name="toDeleteApplicationSnapshot")
    def to_delete_application_snapshot(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to delete a snapshot for an application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_DeleteApplicationSnapshot.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toDeleteApplicationSnapshot", []))

    @jsii.member(jsii_name="toDeleteApplicationVpcConfiguration")
    def to_delete_application_vpc_configuration(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to delete the specified VPC configuration of the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_DeleteApplicationVpcConfiguration.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toDeleteApplicationVpcConfiguration", []))

    @jsii.member(jsii_name="toDescribeApplication")
    def to_describe_application(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to describe the specified application.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_DescribeApplication.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toDescribeApplication", []))

    @jsii.member(jsii_name="toDescribeApplicationSnapshot")
    def to_describe_application_snapshot(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to describe an application snapshot.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_DescribeApplicationSnapshot.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toDescribeApplicationSnapshot", []))

    @jsii.member(jsii_name="toDiscoverInputSchema")
    def to_discover_input_schema(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to discover the input schema for the application.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_DiscoverInputSchema.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toDiscoverInputSchema", []))

    @jsii.member(jsii_name="toListApplications")
    def to_list_applications(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to list applications for the account.

        Access Level: List

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_ListApplications.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toListApplications", []))

    @jsii.member(jsii_name="toListApplicationSnapshots")
    def to_list_application_snapshots(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to list the snapshots for an application.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_ListApplicationSnapshots.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toListApplicationSnapshots", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to fetch the tags associated with the application.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toStartApplication")
    def to_start_application(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to start the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_StartsApplication.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toStartApplication", []))

    @jsii.member(jsii_name="toStopApplication")
    def to_stop_application(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to stop the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_StopApplication.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toStopApplication", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to add tags to the application.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to remove the specified tags from the application.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateApplication")
    def to_update_application(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to update the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_UpdateApplication.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toUpdateApplication", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Kinesisvideo(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Kinesisvideo",
):
    '''(experimental) Statement provider for service `kinesisvideo <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonkinesisvideostreams.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `kinesisvideo <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonkinesisvideostreams.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Kinesisvideo, self, [sid])

    @jsii.member(jsii_name="onChannel")
    def on_channel(
        self,
        channel_name: builtins.str,
        creation_time: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Kinesisvideo":
        '''(experimental) Adds a resource of type channel to the statement.

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/kinesisvideostreams-webrtc-dg/latest/devguide/kvswebrtc-how-it-works.html

        :param channel_name: - Identifier for the channelName.
        :param creation_time: - Identifier for the creationTime.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "onChannel", [channel_name, creation_time, account, region, partition]))

    @jsii.member(jsii_name="onStream")
    def on_stream(
        self,
        stream_name: builtins.str,
        creation_time: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Kinesisvideo":
        '''(experimental) Adds a resource of type stream to the statement.

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/how-it-works.html

        :param stream_name: - Identifier for the streamName.
        :param creation_time: - Identifier for the creationTime.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "onStream", [stream_name, creation_time, account, region, partition]))

    @jsii.member(jsii_name="toConnectAsMaster")
    def to_connect_as_master(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to connect as a master to the signaling channel specified by the endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_ConnectAsMaster.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toConnectAsMaster", []))

    @jsii.member(jsii_name="toConnectAsViewer")
    def to_connect_as_viewer(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to connect as a viewer to the signaling channel specified by the endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_ConnectAsViewer.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toConnectAsViewer", []))

    @jsii.member(jsii_name="toCreateSignalingChannel")
    def to_create_signaling_channel(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to create a signaling channel.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_CreateSignalingChannel.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toCreateSignalingChannel", []))

    @jsii.member(jsii_name="toCreateStream")
    def to_create_stream(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to create a Kinesis video stream.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_CreateStream.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toCreateStream", []))

    @jsii.member(jsii_name="toDeleteSignalingChannel")
    def to_delete_signaling_channel(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to delete an existing signaling channel.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_DeleteSignalingChannel.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toDeleteSignalingChannel", []))

    @jsii.member(jsii_name="toDeleteStream")
    def to_delete_stream(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to delete an existing Kinesis video stream.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_DeleteStream.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toDeleteStream", []))

    @jsii.member(jsii_name="toDescribeSignalingChannel")
    def to_describe_signaling_channel(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to describe the specified signaling channel.

        Access Level: List

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_DescribeSignalingChannel.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toDescribeSignalingChannel", []))

    @jsii.member(jsii_name="toDescribeStream")
    def to_describe_stream(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to describe the specified Kinesis video stream.

        Access Level: List

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_DescribeStream.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toDescribeStream", []))

    @jsii.member(jsii_name="toGetClip")
    def to_get_clip(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to get a media clip from a video stream.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_GetClip.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toGetClip", []))

    @jsii.member(jsii_name="toGetDASHStreamingSessionURL")
    def to_get_dash_streaming_session_url(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to create a URL for MPEG-DASH video streaming.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_GetDASHStreamingSessionURL.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toGetDASHStreamingSessionURL", []))

    @jsii.member(jsii_name="toGetDataEndpoint")
    def to_get_data_endpoint(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to get an endpoint for a specified stream for either reading or writing media data to Kinesis Video Streams.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_GetDataEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toGetDataEndpoint", []))

    @jsii.member(jsii_name="toGetHLSStreamingSessionURL")
    def to_get_hls_streaming_session_url(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to create a URL for HLS video streaming.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_GetHLSStreamingSessionURL.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toGetHLSStreamingSessionURL", []))

    @jsii.member(jsii_name="toGetIceServerConfig")
    def to_get_ice_server_config(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to get the ICE server configuration.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_GetIceServerConfig.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toGetIceServerConfig", []))

    @jsii.member(jsii_name="toGetMedia")
    def to_get_media(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to return media content of a Kinesis video stream.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_GetMedia.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toGetMedia", []))

    @jsii.member(jsii_name="toGetMediaForFragmentList")
    def to_get_media_for_fragment_list(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to read and return media data only from persisted storage.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_GetMediaForFragmentList.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toGetMediaForFragmentList", []))

    @jsii.member(jsii_name="toGetSignalingChannelEndpoint")
    def to_get_signaling_channel_endpoint(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to get endpoints for a specified combination of protocol and role for a signaling channel.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_GetSignalingChannelEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toGetSignalingChannelEndpoint", []))

    @jsii.member(jsii_name="toListFragments")
    def to_list_fragments(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to list the fragments from archival storage based on the pagination token or selector type with range specified.

        Access Level: List

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_ListFragments.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toListFragments", []))

    @jsii.member(jsii_name="toListSignalingChannels")
    def to_list_signaling_channels(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to list your signaling channels.

        Access Level: List

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_ListSignalingChannels.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toListSignalingChannels", []))

    @jsii.member(jsii_name="toListStreams")
    def to_list_streams(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to list your Kinesis video streams.

        Access Level: List

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_ListStreams.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toListStreams", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to fetch the tags associated with your resource.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTagsForStream")
    def to_list_tags_for_stream(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to fetch the tags associated with Kinesis video stream.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_ListTagsForStream.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toListTagsForStream", []))

    @jsii.member(jsii_name="toPutMedia")
    def to_put_media(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to send media data to a Kinesis video stream.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_PutMedia.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toPutMedia", []))

    @jsii.member(jsii_name="toSendAlexaOfferToMaster")
    def to_send_alexa_offer_to_master(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to send the Alexa SDP offer to the master.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_SendAlexaOfferToMaster.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toSendAlexaOfferToMaster", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to attach set of tags to your resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTagStream")
    def to_tag_stream(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to attach set of tags to your Kinesis video streams.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_TagStream.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toTagStream", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to remove one or more tags from your resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUntagStream")
    def to_untag_stream(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to remove one or more tags from your Kinesis video streams.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_UntagStream.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toUntagStream", []))

    @jsii.member(jsii_name="toUpdateDataRetention")
    def to_update_data_retention(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to update the data retention period of your Kinesis video stream.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_UpdateDataRetention.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toUpdateDataRetention", []))

    @jsii.member(jsii_name="toUpdateSignalingChannel")
    def to_update_signaling_channel(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to update an existing signaling channel.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_UpdateSignalingChannel.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toUpdateSignalingChannel", []))

    @jsii.member(jsii_name="toUpdateStream")
    def to_update_stream(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to update an existing Kinesis video stream.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_UpdateStream.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toUpdateStream", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Kms(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Kms"):
    '''(experimental) Statement provider for service `kms <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awskeymanagementservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `kms <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awskeymanagementservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Kms, self, [sid])

    @jsii.member(jsii_name="ifBypassPolicyLockoutSafetyCheck")
    def if_bypass_policy_lockout_safety_check(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Kms":
        '''(experimental) Filters access to the CreateKey and PutKeyPolicy operations based on the value of the BypassPolicyLockoutSafetyCheck parameter in the request.

        https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-bypass-policy-lockout-safety-check

        Applies to actions:

        - .toCreateKey()
        - .toPutKeyPolicy()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "ifBypassPolicyLockoutSafetyCheck", [value]))

    @jsii.member(jsii_name="ifCallerAccount")
    def if_caller_account(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to specified AWS KMS operations based on the AWS account ID of the caller.

        You can use this condition key to allow or deny access to all IAM users and roles in an AWS account in a single policy statement

        https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-caller-account

        Applies to actions:

        - .toCancelKeyDeletion()
        - .toCreateAlias()
        - .toCreateGrant()
        - .toDecrypt()
        - .toDeleteAlias()
        - .toDeleteImportedKeyMaterial()
        - .toDescribeKey()
        - .toDisableKey()
        - .toDisableKeyRotation()
        - .toEnableKey()
        - .toEnableKeyRotation()
        - .toEncrypt()
        - .toGenerateDataKey()
        - .toGenerateDataKeyPair()
        - .toGenerateDataKeyPairWithoutPlaintext()
        - .toGenerateDataKeyWithoutPlaintext()
        - .toGetKeyPolicy()
        - .toGetKeyRotationStatus()
        - .toGetParametersForImport()
        - .toGetPublicKey()
        - .toImportKeyMaterial()
        - .toListGrants()
        - .toListKeyPolicies()
        - .toListResourceTags()
        - .toPutKeyPolicy()
        - .toReEncryptFrom()
        - .toReEncryptTo()
        - .toRevokeGrant()
        - .toScheduleKeyDeletion()
        - .toSign()
        - .toTagResource()
        - .toUntagResource()
        - .toUpdateAlias()
        - .toUpdateKeyDescription()
        - .toVerify()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "ifCallerAccount", [value, operator]))

    @jsii.member(jsii_name="ifCustomerMasterKeySpec")
    def if_customer_master_key_spec(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to an API operation based on the CustomerMasterKeySpec property of the CMK that is created by or used in the operation.

        Use it to qualify authorization of the CreateKey operation or any operation that is authorized for a CMK resource

        https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-customer-master-key-spec

        Applies to actions:

        - .toCreateKey()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "ifCustomerMasterKeySpec", [value, operator]))

    @jsii.member(jsii_name="ifCustomerMasterKeyUsage")
    def if_customer_master_key_usage(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to an API operation based on the KeyUsage property of the CMK created by or used in the operation.

        Use it to qualify authorization of the CreateKey operation or any operation that is authorized for a CMK resource

        https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-customer-master-key-usage

        Applies to actions:

        - .toCreateKey()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "ifCustomerMasterKeyUsage", [value, operator]))

    @jsii.member(jsii_name="ifDataKeyPairSpec")
    def if_data_key_pair_spec(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to GenerateDataKeyPair and GenerateDataKeyPairWithoutPlaintext operations based on the value of the DataKeyPairSpec parameter in the request.

        https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-data-key-pair-spec

        Applies to actions:

        - .toGenerateDataKeyPair()
        - .toGenerateDataKeyPairWithoutPlaintext()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "ifDataKeyPairSpec", [value, operator]))

    @jsii.member(jsii_name="ifEncryptionAlgorithm")
    def if_encryption_algorithm(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to encryption operations based on the value of the encryption algorithm in the request.

        https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-encryption-algorithm

        Applies to actions:

        - .toDecrypt()
        - .toEncrypt()
        - .toGenerateDataKey()
        - .toGenerateDataKeyPair()
        - .toGenerateDataKeyPairWithoutPlaintext()
        - .toGenerateDataKeyWithoutPlaintext()
        - .toReEncryptFrom()
        - .toReEncryptTo()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "ifEncryptionAlgorithm", [value, operator]))

    @jsii.member(jsii_name="ifEncryptionContextKeys")
    def if_encryption_context_keys(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access based on the presence of specified keys in the encryption context.

        The encryption context is an optional element in a cryptographic operation

        https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-encryption-context-keys

        Applies to actions:

        - .toDecrypt()
        - .toEncrypt()
        - .toGenerateDataKey()
        - .toGenerateDataKeyPair()
        - .toGenerateDataKeyPairWithoutPlaintext()
        - .toGenerateDataKeyWithoutPlaintext()
        - .toReEncryptFrom()
        - .toReEncryptTo()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "ifEncryptionContextKeys", [value, operator]))

    @jsii.member(jsii_name="ifExpirationModel")
    def if_expiration_model(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to the ImportKeyMaterial operation based on the value of the ExpirationModel parameter in the request.

        https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-expiration-model

        Applies to actions:

        - .toImportKeyMaterial()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "ifExpirationModel", [value, operator]))

    @jsii.member(jsii_name="ifGrantConstraintType")
    def if_grant_constraint_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to the CreateGrant operation based on the grant constraint in the request.

        https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-grant-constraint-type

        Applies to actions:

        - .toCreateGrant()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "ifGrantConstraintType", [value, operator]))

    @jsii.member(jsii_name="ifGranteePrincipal")
    def if_grantee_principal(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to the CreateGrant operation based on the grantee principal in the grant.

        https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-grantee-principal

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "ifGranteePrincipal", [value, operator]))

    @jsii.member(jsii_name="ifGrantIsForAWSResource")
    def if_grant_is_for_aws_resource(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Kms":
        '''(experimental) Filters access to the CreateGrant operation when the request comes from a specified AWS service.

        https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-grant-is-for-aws-resource

        Applies to actions:

        - .toCreateGrant()
        - .toListGrants()
        - .toRevokeGrant()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "ifGrantIsForAWSResource", [value]))

    @jsii.member(jsii_name="ifGrantOperations")
    def if_grant_operations(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to the CreateGrant operation based on the operations in the grant.

        https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-grant-operations

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "ifGrantOperations", [value, operator]))

    @jsii.member(jsii_name="ifKeyOrigin")
    def if_key_origin(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to an API operation based on the Origin property of the CMK created by or used in the operation.

        Use it to qualify authorization of the CreateKey operation or any operation that is authorized for a CMK resource

        https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-key-origin

        Applies to actions:

        - .toCreateKey()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "ifKeyOrigin", [value, operator]))

    @jsii.member(jsii_name="ifMessageType")
    def if_message_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to the Sign and Verify operations based on the value of the MessageType parameter in the request.

        https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-message-type

        Applies to actions:

        - .toSign()
        - .toVerify()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "ifMessageType", [value, operator]))

    @jsii.member(jsii_name="ifReEncryptOnSameKey")
    def if_re_encrypt_on_same_key(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Kms":
        '''(experimental) Filters access to the ReEncrypt operation when it uses the same customer master key that was used for the Encrypt operation.

        https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-reencrypt-on-same-key

        Applies to actions:

        - .toReEncryptFrom()
        - .toReEncryptTo()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "ifReEncryptOnSameKey", [value]))

    @jsii.member(jsii_name="ifRequestAlias")
    def if_request_alias(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to cryptographic operations, DescribeKey, and GetPublicKey based on the alias in the request.

        https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-request-alias

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "ifRequestAlias", [value, operator]))

    @jsii.member(jsii_name="ifResourceAliases")
    def if_resource_aliases(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to specified AWS KMS operations based on aliases associated with the customer master key.

        https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-resource-aliases

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "ifResourceAliases", [value, operator]))

    @jsii.member(jsii_name="ifRetiringPrincipal")
    def if_retiring_principal(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to the CreateGrant operation based on the retiring principal in the grant.

        https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-retiring-principal

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "ifRetiringPrincipal", [value, operator]))

    @jsii.member(jsii_name="ifSigningAlgorithm")
    def if_signing_algorithm(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to the Sign and Verify operations based on the signing algorithm in the request.

        https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-signing-algorithm

        Applies to actions:

        - .toSign()
        - .toVerify()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "ifSigningAlgorithm", [value, operator]))

    @jsii.member(jsii_name="ifValidTo")
    def if_valid_to(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to the ImportKeyMaterial operation based on the value of the ValidTo parameter in the request.

        You can use this condition key to allow users to import key material only when it expires by the specified date

        https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-valid-to

        Applies to actions:

        - .toImportKeyMaterial()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "ifValidTo", [value, operator]))

    @jsii.member(jsii_name="ifViaService")
    def if_via_service(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access when a request made on the principal's behalf comes from a specified AWS service.

        https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-via-service

        Applies to actions:

        - .toCancelKeyDeletion()
        - .toCreateAlias()
        - .toCreateGrant()
        - .toDecrypt()
        - .toDeleteAlias()
        - .toDeleteImportedKeyMaterial()
        - .toDescribeKey()
        - .toDisableKey()
        - .toDisableKeyRotation()
        - .toEnableKey()
        - .toEnableKeyRotation()
        - .toEncrypt()
        - .toGenerateDataKey()
        - .toGenerateDataKeyPair()
        - .toGenerateDataKeyPairWithoutPlaintext()
        - .toGenerateDataKeyWithoutPlaintext()
        - .toGetKeyPolicy()
        - .toGetKeyRotationStatus()
        - .toGetParametersForImport()
        - .toGetPublicKey()
        - .toImportKeyMaterial()
        - .toListGrants()
        - .toListKeyPolicies()
        - .toListResourceTags()
        - .toPutKeyPolicy()
        - .toReEncryptFrom()
        - .toReEncryptTo()
        - .toRevokeGrant()
        - .toScheduleKeyDeletion()
        - .toSign()
        - .toTagResource()
        - .toUntagResource()
        - .toUpdateAlias()
        - .toUpdateKeyDescription()
        - .toVerify()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "ifViaService", [value, operator]))

    @jsii.member(jsii_name="ifWrappingAlgorithm")
    def if_wrapping_algorithm(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to the GetParametersForImport operation based on the value of the WrappingAlgorithm parameter in the request.

        https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-wrapping-algorithm

        Applies to actions:

        - .toGetParametersForImport()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "ifWrappingAlgorithm", [value, operator]))

    @jsii.member(jsii_name="ifWrappingKeySpec")
    def if_wrapping_key_spec(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to the GetParametersForImport operation based on the value of the WrappingKeySpec parameter in the request.

        https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-wrapping-key-spec

        Applies to actions:

        - .toGetParametersForImport()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "ifWrappingKeySpec", [value, operator]))

    @jsii.member(jsii_name="onAlias")
    def on_alias(
        self,
        alias: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Kms":
        '''(experimental) Adds a resource of type alias to the statement.

        https://docs.aws.amazon.com/kms/latest/developerguide/programming-aliases.html

        :param alias: - Identifier for the alias.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "onAlias", [alias, account, region, partition]))

    @jsii.member(jsii_name="onKey")
    def on_key(
        self,
        key_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Kms":
        '''(experimental) Adds a resource of type key to the statement.

        https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#master_keys

        :param key_id: - Identifier for the keyId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "onKey", [key_id, account, region, partition]))

    @jsii.member(jsii_name="toCancelKeyDeletion")
    def to_cancel_key_deletion(self) -> "Kms":
        '''(experimental) Controls permission to cancel the scheduled deletion of a customer master key.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_CancelKeyDeletion.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toCancelKeyDeletion", []))

    @jsii.member(jsii_name="toConnectCustomKeyStore")
    def to_connect_custom_key_store(self) -> "Kms":
        '''(experimental) Controls permission to connect or reconnect a custom key store to its associated AWS CloudHSM cluster.

        Access Level: Write

        https://docs.aws.amazon.com/kms/latest/APIReference/API_ConnectCustomKeyStore.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toConnectCustomKeyStore", []))

    @jsii.member(jsii_name="toCreateAlias")
    def to_create_alias(self) -> "Kms":
        '''(experimental) Controls permission to create an alias for a customer master key (CMK).

        Aliases are optional friendly names that you can associate with customer master keys

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateAlias.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toCreateAlias", []))

    @jsii.member(jsii_name="toCreateCustomKeyStore")
    def to_create_custom_key_store(self) -> "Kms":
        '''(experimental) Controls permission to create a custom key store that is associated with an AWS CloudHSM cluster that you own and manage.

        Access Level: Write

        Dependent actions:

        - cloudhsm:DescribeClusters

        https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateCustomKeyStore.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toCreateCustomKeyStore", []))

    @jsii.member(jsii_name="toCreateGrant")
    def to_create_grant(self) -> "Kms":
        '''(experimental) Controls permission to add a grant to a customer master key.

        You can use grants to add permissions without changing the key policy or IAM policy

        Access Level: Permissions management

        Possible conditions:

        - .ifCallerAccount()
        - .ifGrantConstraintType()
        - .ifGrantIsForAWSResource()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateGrant.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toCreateGrant", []))

    @jsii.member(jsii_name="toCreateKey")
    def to_create_key(self) -> "Kms":
        '''(experimental) Controls permission to create a customer master key that can be used to protect data keys and other sensitive information.

        Access Level: Write

        Possible conditions:

        - .ifBypassPolicyLockoutSafetyCheck()
        - .ifCustomerMasterKeySpec()
        - .ifCustomerMasterKeyUsage()
        - .ifKeyOrigin()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateKey.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toCreateKey", []))

    @jsii.member(jsii_name="toDecrypt")
    def to_decrypt(self) -> "Kms":
        '''(experimental) Controls permission to decrypt ciphertext that was encrypted under a customer master key.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifEncryptionAlgorithm()
        - .ifEncryptionContextKeys()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_Decrypt.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toDecrypt", []))

    @jsii.member(jsii_name="toDeleteAlias")
    def to_delete_alias(self) -> "Kms":
        '''(experimental) Controls permission to delete an alias. Aliases are optional friendly names that you can associate with customer master keys.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_DeleteAlias.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toDeleteAlias", []))

    @jsii.member(jsii_name="toDeleteCustomKeyStore")
    def to_delete_custom_key_store(self) -> "Kms":
        '''(experimental) Controls permission to delete a custom key store.

        Access Level: Write

        https://docs.aws.amazon.com/kms/latest/APIReference/API_DeleteCustomKeyStore.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toDeleteCustomKeyStore", []))

    @jsii.member(jsii_name="toDeleteImportedKeyMaterial")
    def to_delete_imported_key_material(self) -> "Kms":
        '''(experimental) Controls permission to delete cryptographic material that you imported into a customer master key.

        This action makes the key unusable

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_DeleteImportedKeyMaterial.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toDeleteImportedKeyMaterial", []))

    @jsii.member(jsii_name="toDescribeCustomKeyStores")
    def to_describe_custom_key_stores(self) -> "Kms":
        '''(experimental) Controls permission to view detailed information about custom key stores in the account and region.

        Access Level: Read

        https://docs.aws.amazon.com/kms/latest/APIReference/API_DescribeCustomKeyStores.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toDescribeCustomKeyStores", []))

    @jsii.member(jsii_name="toDescribeKey")
    def to_describe_key(self) -> "Kms":
        '''(experimental) Controls permission to view detailed information about a customer master key.

        Access Level: Read

        Possible conditions:

        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_DescribeKey.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toDescribeKey", []))

    @jsii.member(jsii_name="toDisableKey")
    def to_disable_key(self) -> "Kms":
        '''(experimental) Controls permission to disable a customer master key, which prevents it from being used in cryptographic operations.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_DisableKey.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toDisableKey", []))

    @jsii.member(jsii_name="toDisableKeyRotation")
    def to_disable_key_rotation(self) -> "Kms":
        '''(experimental) Controls permission to disable automatic rotation of a customer managed customer master key.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_DisableKeyRotation.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toDisableKeyRotation", []))

    @jsii.member(jsii_name="toDisconnectCustomKeyStore")
    def to_disconnect_custom_key_store(self) -> "Kms":
        '''(experimental) Controls permission to disconnect the custom key store from its associated AWS CloudHSM cluster.

        Access Level: Write

        https://docs.aws.amazon.com/kms/latest/APIReference/API_DisconnectCustomKeyStore.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toDisconnectCustomKeyStore", []))

    @jsii.member(jsii_name="toEnableKey")
    def to_enable_key(self) -> "Kms":
        '''(experimental) Controls permission to change the state of a customer master key (CMK) to enabled.

        This allows the CMK to be used in cryptographic operations

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_EnableKey.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toEnableKey", []))

    @jsii.member(jsii_name="toEnableKeyRotation")
    def to_enable_key_rotation(self) -> "Kms":
        '''(experimental) Controls permission to enable automatic rotation of the cryptographic material in a customer master key.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_EnableKeyRotation.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toEnableKeyRotation", []))

    @jsii.member(jsii_name="toEncrypt")
    def to_encrypt(self) -> "Kms":
        '''(experimental) Controls permission to use the specified customer master key to encrypt data and data keys.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifEncryptionAlgorithm()
        - .ifEncryptionContextKeys()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_Encrypt.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toEncrypt", []))

    @jsii.member(jsii_name="toGenerateDataKey")
    def to_generate_data_key(self) -> "Kms":
        '''(experimental) Controls permission to use the customer master key to generate data keys.

        You can use the data keys to encrypt data outside of AWS KMS

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifEncryptionAlgorithm()
        - .ifEncryptionContextKeys()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKey.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toGenerateDataKey", []))

    @jsii.member(jsii_name="toGenerateDataKeyPair")
    def to_generate_data_key_pair(self) -> "Kms":
        '''(experimental) Controls permission to use the customer master key to generate data key pairs.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifDataKeyPairSpec()
        - .ifEncryptionAlgorithm()
        - .ifEncryptionContextKeys()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyPair.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toGenerateDataKeyPair", []))

    @jsii.member(jsii_name="toGenerateDataKeyPairWithoutPlaintext")
    def to_generate_data_key_pair_without_plaintext(self) -> "Kms":
        '''(experimental) Controls permission to use the customer master key to generate data key pairs.

        Unlike the GenerateDataKeyPair operation, this operation returns an encrypted private key without a plaintext copy

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifDataKeyPairSpec()
        - .ifEncryptionAlgorithm()
        - .ifEncryptionContextKeys()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyPairWithoutPlaintext.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toGenerateDataKeyPairWithoutPlaintext", []))

    @jsii.member(jsii_name="toGenerateDataKeyWithoutPlaintext")
    def to_generate_data_key_without_plaintext(self) -> "Kms":
        '''(experimental) Controls permission to use the customer master key to generate a data key.

        Unlike the GenerateDataKey operation, this operation returns an encrypted data key without a plaintext version of the data key

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifEncryptionAlgorithm()
        - .ifEncryptionContextKeys()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyWithoutPlaintext.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toGenerateDataKeyWithoutPlaintext", []))

    @jsii.member(jsii_name="toGenerateRandom")
    def to_generate_random(self) -> "Kms":
        '''(experimental) Controls permission to get a cryptographically secure random byte string from AWS KMS.

        Access Level: Write

        https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateRandom.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toGenerateRandom", []))

    @jsii.member(jsii_name="toGetKeyPolicy")
    def to_get_key_policy(self) -> "Kms":
        '''(experimental) Controls permission to view the key policy for the specified customer master key.

        Access Level: Read

        Possible conditions:

        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_GetKeyPolicy.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toGetKeyPolicy", []))

    @jsii.member(jsii_name="toGetKeyRotationStatus")
    def to_get_key_rotation_status(self) -> "Kms":
        '''(experimental) Controls permission to determine whether automatic key rotation is enabled on the customer master key.

        Access Level: Read

        Possible conditions:

        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_GetKeyRotationStatus.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toGetKeyRotationStatus", []))

    @jsii.member(jsii_name="toGetParametersForImport")
    def to_get_parameters_for_import(self) -> "Kms":
        '''(experimental) Controls permission to get data that is required to import cryptographic material into a customer managed key, including a public key and import token.

        Access Level: Read

        Possible conditions:

        - .ifCallerAccount()
        - .ifViaService()
        - .ifWrappingAlgorithm()
        - .ifWrappingKeySpec()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_GetParametersForImport.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toGetParametersForImport", []))

    @jsii.member(jsii_name="toGetPublicKey")
    def to_get_public_key(self) -> "Kms":
        '''(experimental) Controls permission to download the public key of an asymmetric customer master key.

        Access Level: Read

        Possible conditions:

        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toGetPublicKey", []))

    @jsii.member(jsii_name="toImportKeyMaterial")
    def to_import_key_material(self) -> "Kms":
        '''(experimental) Controls permission to import cryptographic material into a customer master key.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifExpirationModel()
        - .ifValidTo()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_ImportKeyMaterial.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toImportKeyMaterial", []))

    @jsii.member(jsii_name="toListAliases")
    def to_list_aliases(self) -> "Kms":
        '''(experimental) Controls permission to view the aliases that are defined in the account.

        Aliases are optional friendly names that you can associate with customer master keys

        Access Level: List

        https://docs.aws.amazon.com/kms/latest/APIReference/API_ListAliases.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toListAliases", []))

    @jsii.member(jsii_name="toListGrants")
    def to_list_grants(self) -> "Kms":
        '''(experimental) Controls permission to view all grants for a customer master key.

        Access Level: List

        Possible conditions:

        - .ifCallerAccount()
        - .ifGrantIsForAWSResource()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_ListGrants.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toListGrants", []))

    @jsii.member(jsii_name="toListKeyPolicies")
    def to_list_key_policies(self) -> "Kms":
        '''(experimental) Controls permission to view the names of key policies for a customer master key.

        Access Level: List

        Possible conditions:

        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_ListKeyPolicies.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toListKeyPolicies", []))

    @jsii.member(jsii_name="toListKeys")
    def to_list_keys(self) -> "Kms":
        '''(experimental) Controls permission to view the key ID and Amazon Resource Name (ARN) of all customer master keys in the account.

        Access Level: List

        https://docs.aws.amazon.com/kms/latest/APIReference/API_ListKeys.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toListKeys", []))

    @jsii.member(jsii_name="toListResourceTags")
    def to_list_resource_tags(self) -> "Kms":
        '''(experimental) Controls permission to view all tags that are attached to a customer master key.

        Access Level: List

        Possible conditions:

        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_ListResourceTags.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toListResourceTags", []))

    @jsii.member(jsii_name="toListRetirableGrants")
    def to_list_retirable_grants(self) -> "Kms":
        '''(experimental) Controls permission to view grants in which the specified principal is the retiring principal.

        Other principals might be able to retire the grant and this principal might be able to retire other grants

        Access Level: List

        https://docs.aws.amazon.com/kms/latest/APIReference/API_ListRetirableGrants.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toListRetirableGrants", []))

    @jsii.member(jsii_name="toPutKeyPolicy")
    def to_put_key_policy(self) -> "Kms":
        '''(experimental) Controls permission to replace the key policy for the specified customer master key.

        Access Level: Permissions management

        Possible conditions:

        - .ifBypassPolicyLockoutSafetyCheck()
        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_PutKeyPolicy.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toPutKeyPolicy", []))

    @jsii.member(jsii_name="toReEncryptFrom")
    def to_re_encrypt_from(self) -> "Kms":
        '''(experimental) Controls permission to decrypt data as part of the process that decrypts and reencrypts the data within AWS KMS.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifEncryptionAlgorithm()
        - .ifEncryptionContextKeys()
        - .ifReEncryptOnSameKey()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_ReEncrypt.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toReEncryptFrom", []))

    @jsii.member(jsii_name="toReEncryptTo")
    def to_re_encrypt_to(self) -> "Kms":
        '''(experimental) Controls permission to encrypt data as part of the process that decrypts and reencrypts the data within AWS KMS.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifEncryptionAlgorithm()
        - .ifEncryptionContextKeys()
        - .ifReEncryptOnSameKey()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_ReEncrypt.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toReEncryptTo", []))

    @jsii.member(jsii_name="toRetireGrant")
    def to_retire_grant(self) -> "Kms":
        '''(experimental) Controls permission to retire a grant.

        The RetireGrant operation is typically called by the grant user after they complete the tasks that the grant allowed them to perform

        Access Level: Permissions management

        https://docs.aws.amazon.com/kms/latest/APIReference/API_RetireGrant.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toRetireGrant", []))

    @jsii.member(jsii_name="toRevokeGrant")
    def to_revoke_grant(self) -> "Kms":
        '''(experimental) Controls permission to revoke a grant, which denies permission for all operations that depend on the grant.

        Access Level: Permissions management

        Possible conditions:

        - .ifCallerAccount()
        - .ifGrantIsForAWSResource()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_RevokeGrant.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toRevokeGrant", []))

    @jsii.member(jsii_name="toScheduleKeyDeletion")
    def to_schedule_key_deletion(self) -> "Kms":
        '''(experimental) Controls permission to schedule deletion of a customer master key.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_ScheduleKeyDeletion.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toScheduleKeyDeletion", []))

    @jsii.member(jsii_name="toSign")
    def to_sign(self) -> "Kms":
        '''(experimental) Controls permission to produce a digital signature for a message.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifMessageType()
        - .ifSigningAlgorithm()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_Sign.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toSign", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Kms":
        '''(experimental) Controls permission to create or update tags that are attached to a customer master key.

        Access Level: Tagging

        Possible conditions:

        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Kms":
        '''(experimental) Controls permission to delete tags that are attached to a customer master key.

        Access Level: Tagging

        Possible conditions:

        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAlias")
    def to_update_alias(self) -> "Kms":
        '''(experimental) Controls permission to associate an alias with a different customer master key.

        An alias is an optional friendly name that you can associate with a customer master key

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateAlias.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toUpdateAlias", []))

    @jsii.member(jsii_name="toUpdateCustomKeyStore")
    def to_update_custom_key_store(self) -> "Kms":
        '''(experimental) Controls permission to change the properties of a custom key store.

        Access Level: Write

        https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateCustomKeyStore.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toUpdateCustomKeyStore", []))

    @jsii.member(jsii_name="toUpdateKeyDescription")
    def to_update_key_description(self) -> "Kms":
        '''(experimental) Controls permission to delete or change the description of a customer master key.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateKeyDescription.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toUpdateKeyDescription", []))

    @jsii.member(jsii_name="toVerify")
    def to_verify(self) -> "Kms":
        '''(experimental) Controls permission to use the specified customer master key to verify digital signatures.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifMessageType()
        - .ifSigningAlgorithm()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_Verify.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toVerify", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Lakeformation(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Lakeformation",
):
    '''(experimental) Statement provider for service `lakeformation <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awslakeformation.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `lakeformation <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awslakeformation.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Lakeformation, self, [sid])

    @jsii.member(jsii_name="toBatchGrantPermissions")
    def to_batch_grant_permissions(self) -> "Lakeformation":
        '''(experimental) Grants data lake permissions to one or more principals in a batch.

        Access Level: Permissions management

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api.html

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toBatchGrantPermissions", []))

    @jsii.member(jsii_name="toBatchRevokePermissions")
    def to_batch_revoke_permissions(self) -> "Lakeformation":
        '''(experimental) Revokes data lake permissions from one or more principals in a batch.

        Access Level: Permissions management

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api.html

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toBatchRevokePermissions", []))

    @jsii.member(jsii_name="toDeregisterResource")
    def to_deregister_resource(self) -> "Lakeformation":
        '''(experimental) Deregisters a registered location.

        Access Level: Write

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api.html

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toDeregisterResource", []))

    @jsii.member(jsii_name="toDescribeResource")
    def to_describe_resource(self) -> "Lakeformation":
        '''(experimental) Describes a registered location.

        Access Level: Read

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api.html

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toDescribeResource", []))

    @jsii.member(jsii_name="toGetDataAccess")
    def to_get_data_access(self) -> "Lakeformation":
        '''(experimental) Grants virtual data lake access permissions.

        Access Level: Write

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api.html

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toGetDataAccess", []))

    @jsii.member(jsii_name="toGetDataLakeSettings")
    def to_get_data_lake_settings(self) -> "Lakeformation":
        '''(experimental) Retrieves data lake settings such as the list of data lake administrators and database and table default permissions.

        Access Level: Read

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api.html

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toGetDataLakeSettings", []))

    @jsii.member(jsii_name="toGetEffectivePermissionsForPath")
    def to_get_effective_permissions_for_path(self) -> "Lakeformation":
        '''(experimental) Retrieves permissions attached to resources in the given path.

        Access Level: Read

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api.html

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toGetEffectivePermissionsForPath", []))

    @jsii.member(jsii_name="toGrantPermissions")
    def to_grant_permissions(self) -> "Lakeformation":
        '''(experimental) Grants data lake permissions to a principal.

        Access Level: Permissions management

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api.html

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toGrantPermissions", []))

    @jsii.member(jsii_name="toListPermissions")
    def to_list_permissions(self) -> "Lakeformation":
        '''(experimental) Lists permissions filtered by principal or resource.

        Access Level: List

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api.html

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toListPermissions", []))

    @jsii.member(jsii_name="toListResources")
    def to_list_resources(self) -> "Lakeformation":
        '''(experimental) Lists registered locations.

        Access Level: List

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api.html

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toListResources", []))

    @jsii.member(jsii_name="toPutDataLakeSettings")
    def to_put_data_lake_settings(self) -> "Lakeformation":
        '''(experimental) Overwrites data lake settings such as the list of data lake administrators and database and table default permissions.

        Access Level: Permissions management

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api.html

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toPutDataLakeSettings", []))

    @jsii.member(jsii_name="toRegisterResource")
    def to_register_resource(self) -> "Lakeformation":
        '''(experimental) Registers a new location to be managed by Lake Formation.

        Access Level: Write

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api.html

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toRegisterResource", []))

    @jsii.member(jsii_name="toRevokePermissions")
    def to_revoke_permissions(self) -> "Lakeformation":
        '''(experimental) Revokes data lake permissions from a principal.

        Access Level: Permissions management

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api.html

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toRevokePermissions", []))

    @jsii.member(jsii_name="toUpdateResource")
    def to_update_resource(self) -> "Lakeformation":
        '''(experimental) Updates a registered location.

        Access Level: Write

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api.html

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toUpdateResource", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Lambda(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Lambda"):
    '''(experimental) Statement provider for service `lambda <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awslambda.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `lambda <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awslambda.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Lambda, self, [sid])

    @jsii.member(jsii_name="ifCodeSigningConfigArn")
    def if_code_signing_config_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Lambda":
        '''(experimental) Filters access by the ARN of an AWS Lambda code signing config.

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "ifCodeSigningConfigArn", [value, operator]))

    @jsii.member(jsii_name="ifFunctionArn")
    def if_function_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Lambda":
        '''(experimental) Filters access by the ARN of an AWS Lambda function.

        Applies to actions:

        - .toCreateEventSourceMapping()
        - .toDeleteEventSourceMapping()
        - .toGetEventSourceMapping()
        - .toUpdateEventSourceMapping()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "ifFunctionArn", [value, operator]))

    @jsii.member(jsii_name="ifLayer")
    def if_layer(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Lambda":
        '''(experimental) Filters access by the ARN of an AWS Lambda layer.

        Applies to actions:

        - .toCreateFunction()
        - .toUpdateFunctionConfiguration()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "ifLayer", [value, operator]))

    @jsii.member(jsii_name="ifPrincipal")
    def if_principal(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Lambda":
        '''(experimental) Filters access by restricting the AWS service or account that can invoke a function.

        Applies to actions:

        - .toAddPermission()
        - .toRemovePermission()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "ifPrincipal", [value, operator]))

    @jsii.member(jsii_name="ifSecurityGroupIds")
    def if_security_group_ids(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Lambda":
        '''(experimental) Filters access by the ID of security groups configured for the AWS Lambda function.

        Applies to actions:

        - .toCreateFunction()
        - .toUpdateFunctionConfiguration()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "ifSecurityGroupIds", [value, operator]))

    @jsii.member(jsii_name="ifSubnetIds")
    def if_subnet_ids(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Lambda":
        '''(experimental) Filters access by the ID of subnets configured for the AWS Lambda function.

        Applies to actions:

        - .toCreateFunction()
        - .toUpdateFunctionConfiguration()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "ifSubnetIds", [value, operator]))

    @jsii.member(jsii_name="ifVpcIds")
    def if_vpc_ids(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Lambda":
        '''(experimental) Filters access by the ID of the VPC configured for the AWS Lambda function.

        Applies to actions:

        - .toCreateFunction()
        - .toUpdateFunctionConfiguration()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "ifVpcIds", [value, operator]))

    @jsii.member(jsii_name="onCodeSigningConfig")
    def on_code_signing_config(
        self,
        code_signing_config_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lambda":
        '''(experimental) Adds a resource of type code signing config to the statement.

        https://docs.aws.amazon.com/lambda/latest/dg/lambda-api-permissions-ref.html

        :param code_signing_config_id: - Identifier for the codeSigningConfigId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "onCodeSigningConfig", [code_signing_config_id, account, region, partition]))

    @jsii.member(jsii_name="onEventSourceMapping")
    def on_event_source_mapping(
        self,
        u_uid: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lambda":
        '''(experimental) Adds a resource of type eventSourceMapping to the statement.

        https://docs.aws.amazon.com/lambda/latest/dg/lambda-api-permissions-ref.html

        :param u_uid: - Identifier for the uUID.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "onEventSourceMapping", [u_uid, account, region, partition]))

    @jsii.member(jsii_name="onFunction")
    def on_function(
        self,
        function_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lambda":
        '''(experimental) Adds a resource of type function to the statement.

        https://docs.aws.amazon.com/lambda/latest/dg/lambda-api-permissions-ref.html

        :param function_name: - Identifier for the functionName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "onFunction", [function_name, account, region, partition]))

    @jsii.member(jsii_name="onFunctionAlias")
    def on_function_alias(
        self,
        function_name: builtins.str,
        alias: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lambda":
        '''(experimental) Adds a resource of type function alias to the statement.

        https://docs.aws.amazon.com/lambda/latest/dg/lambda-api-permissions-ref.html

        :param function_name: - Identifier for the functionName.
        :param alias: - Identifier for the alias.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "onFunctionAlias", [function_name, alias, account, region, partition]))

    @jsii.member(jsii_name="onFunctionVersion")
    def on_function_version(
        self,
        function_name: builtins.str,
        version: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lambda":
        '''(experimental) Adds a resource of type function version to the statement.

        https://docs.aws.amazon.com/lambda/latest/dg/lambda-api-permissions-ref.html

        :param function_name: - Identifier for the functionName.
        :param version: - Identifier for the version.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "onFunctionVersion", [function_name, version, account, region, partition]))

    @jsii.member(jsii_name="onLayer")
    def on_layer(
        self,
        layer_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lambda":
        '''(experimental) Adds a resource of type layer to the statement.

        https://docs.aws.amazon.com/lambda/latest/dg/lambda-api-permissions-ref.html

        :param layer_name: - Identifier for the layerName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "onLayer", [layer_name, account, region, partition]))

    @jsii.member(jsii_name="onLayerVersion")
    def on_layer_version(
        self,
        layer_name: builtins.str,
        layer_version: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lambda":
        '''(experimental) Adds a resource of type layerVersion to the statement.

        https://docs.aws.amazon.com/lambda/latest/dg/lambda-api-permissions-ref.html

        :param layer_name: - Identifier for the layerName.
        :param layer_version: - Identifier for the layerVersion.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "onLayerVersion", [layer_name, layer_version, account, region, partition]))

    @jsii.member(jsii_name="toAddLayerVersionPermission")
    def to_add_layer_version_permission(self) -> "Lambda":
        '''(experimental) Grants permission to add permissions to the resource-based policy of a version of an AWS Lambda layer.

        Access Level: Permissions management

        https://docs.aws.amazon.com/lambda/latest/dg/API_AddLayerVersionPermission.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toAddLayerVersionPermission", []))

    @jsii.member(jsii_name="toAddPermission")
    def to_add_permission(self) -> "Lambda":
        '''(experimental) Grants permission to give an AWS service or another account permission to use an AWS Lambda function.

        Access Level: Permissions management

        Possible conditions:

        - .ifPrincipal()

        https://docs.aws.amazon.com/lambda/latest/dg/API_AddPermission.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toAddPermission", []))

    @jsii.member(jsii_name="toCreateAlias")
    def to_create_alias(self) -> "Lambda":
        '''(experimental) Grants permission to create an alias for a Lambda function version.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_CreateAlias.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toCreateAlias", []))

    @jsii.member(jsii_name="toCreateCodeSigningConfig")
    def to_create_code_signing_config(self) -> "Lambda":
        '''(experimental) Grants permission to create an AWS Lambda code signing config.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_CreateCodeSigningConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toCreateCodeSigningConfig", []))

    @jsii.member(jsii_name="toCreateEventSourceMapping")
    def to_create_event_source_mapping(self) -> "Lambda":
        '''(experimental) Grants permission to create a mapping between an event source and an AWS Lambda function.

        Access Level: Write

        Possible conditions:

        - .ifFunctionArn()

        https://docs.aws.amazon.com/lambda/latest/dg/API_CreateEventSourceMapping.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toCreateEventSourceMapping", []))

    @jsii.member(jsii_name="toCreateFunction")
    def to_create_function(self) -> "Lambda":
        '''(experimental) Grants permission to create an AWS Lambda function.

        Access Level: Write

        Possible conditions:

        - .ifLayer()
        - .ifVpcIds()
        - .ifSubnetIds()
        - .ifSecurityGroupIds()

        https://docs.aws.amazon.com/lambda/latest/dg/API_CreateFunction.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toCreateFunction", []))

    @jsii.member(jsii_name="toDeleteAlias")
    def to_delete_alias(self) -> "Lambda":
        '''(experimental) Grants permission to delete an AWS Lambda function alias.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_DeleteAlias.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toDeleteAlias", []))

    @jsii.member(jsii_name="toDeleteCodeSigningConfig")
    def to_delete_code_signing_config(self) -> "Lambda":
        '''(experimental) Grants permission to delete an AWS Lambda code signing config.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_DeleteCodeSigningConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toDeleteCodeSigningConfig", []))

    @jsii.member(jsii_name="toDeleteEventSourceMapping")
    def to_delete_event_source_mapping(self) -> "Lambda":
        '''(experimental) Grants permission to delete an AWS Lambda event source mapping.

        Access Level: Write

        Possible conditions:

        - .ifFunctionArn()

        https://docs.aws.amazon.com/lambda/latest/dg/API_DeleteEventSourceMapping.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toDeleteEventSourceMapping", []))

    @jsii.member(jsii_name="toDeleteFunction")
    def to_delete_function(self) -> "Lambda":
        '''(experimental) Grants permission to delete an AWS Lambda function.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_DeleteFunction.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toDeleteFunction", []))

    @jsii.member(jsii_name="toDeleteFunctionCodeSigningConfig")
    def to_delete_function_code_signing_config(self) -> "Lambda":
        '''(experimental) Grants permission to detach a code signing config from an AWS Lambda function.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_DeleteFunctionCodeSigningConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toDeleteFunctionCodeSigningConfig", []))

    @jsii.member(jsii_name="toDeleteFunctionConcurrency")
    def to_delete_function_concurrency(self) -> "Lambda":
        '''(experimental) Grants permission to remove a concurrent execution limit from an AWS Lambda function.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_DeleteFunctionConcurrency.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toDeleteFunctionConcurrency", []))

    @jsii.member(jsii_name="toDeleteFunctionEventInvokeConfig")
    def to_delete_function_event_invoke_config(self) -> "Lambda":
        '''(experimental) Grants permission to delete the configuration for asynchronous invocation for an AWS Lambda function, version, or alias.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_DeleteFunctionEventInvokeConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toDeleteFunctionEventInvokeConfig", []))

    @jsii.member(jsii_name="toDeleteLayerVersion")
    def to_delete_layer_version(self) -> "Lambda":
        '''(experimental) Grants permission to delete a version of an AWS Lambda layer.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_DeleteLayerVersion.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toDeleteLayerVersion", []))

    @jsii.member(jsii_name="toDeleteProvisionedConcurrencyConfig")
    def to_delete_provisioned_concurrency_config(self) -> "Lambda":
        '''(experimental) Grants permission to delete the provisioned concurrency configuration for an AWS Lambda function.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_DeleteProvisionedConcurrencyConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toDeleteProvisionedConcurrencyConfig", []))

    @jsii.member(jsii_name="toDisableReplication")
    def to_disable_replication(self) -> "Lambda":
        '''(experimental) Grants permission to disable replication for a Lambda@Edge function.

        Access Level: Permissions management

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toDisableReplication", []))

    @jsii.member(jsii_name="toEnableReplication")
    def to_enable_replication(self) -> "Lambda":
        '''(experimental) Grants permission to enable replication for a Lambda@Edge function.

        Access Level: Permissions management

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toEnableReplication", []))

    @jsii.member(jsii_name="toGetAccountSettings")
    def to_get_account_settings(self) -> "Lambda":
        '''(experimental) Grants permission to view details about an account's limits and usage in an AWS Region.

        Access Level: Read

        https://docs.aws.amazon.com/lambda/latest/dg/API_GetAccountSettings.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toGetAccountSettings", []))

    @jsii.member(jsii_name="toGetAlias")
    def to_get_alias(self) -> "Lambda":
        '''(experimental) Grants permission to view details about an AWS Lambda function alias.

        Access Level: Read

        https://docs.aws.amazon.com/lambda/latest/dg/API_GetAlias.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toGetAlias", []))

    @jsii.member(jsii_name="toGetCodeSigningConfig")
    def to_get_code_signing_config(self) -> "Lambda":
        '''(experimental) Grants permission to view details about an AWS Lambda code signing config.

        Access Level: Read

        https://docs.aws.amazon.com/lambda/latest/dg/API_GetCodeSigningConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toGetCodeSigningConfig", []))

    @jsii.member(jsii_name="toGetEventSourceMapping")
    def to_get_event_source_mapping(self) -> "Lambda":
        '''(experimental) Grants permission to view details about an AWS Lambda event source mapping.

        Access Level: Read

        Possible conditions:

        - .ifFunctionArn()

        https://docs.aws.amazon.com/lambda/latest/dg/API_GetEventSourceMapping.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toGetEventSourceMapping", []))

    @jsii.member(jsii_name="toGetFunction")
    def to_get_function(self) -> "Lambda":
        '''(experimental) Grants permission to view details about an AWS Lambda function.

        Access Level: Read

        https://docs.aws.amazon.com/lambda/latest/dg/API_GetFunction.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toGetFunction", []))

    @jsii.member(jsii_name="toGetFunctionCodeSigningConfig")
    def to_get_function_code_signing_config(self) -> "Lambda":
        '''(experimental) Grants permission to view the code signing config arn attached to an AWS Lambda function.

        Access Level: Read

        https://docs.aws.amazon.com/lambda/latest/dg/API_GetFunctionCodeSigningConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toGetFunctionCodeSigningConfig", []))

    @jsii.member(jsii_name="toGetFunctionConcurrency")
    def to_get_function_concurrency(self) -> "Lambda":
        '''(experimental) Grants permission to view details about the reserved concurrency configuration for a function.

        Access Level: Read

        https://docs.aws.amazon.com/lambda/latest/dg/API_GetFunctionConcurrency.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toGetFunctionConcurrency", []))

    @jsii.member(jsii_name="toGetFunctionConfiguration")
    def to_get_function_configuration(self) -> "Lambda":
        '''(experimental) Grants permission to view details about the version-specific settings of an AWS Lambda function or version.

        Access Level: Read

        https://docs.aws.amazon.com/lambda/latest/dg/API_GetFunctionConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toGetFunctionConfiguration", []))

    @jsii.member(jsii_name="toGetFunctionEventInvokeConfig")
    def to_get_function_event_invoke_config(self) -> "Lambda":
        '''(experimental) Grants permission to view the configuration for asynchronous invocation for a function, version, or alias.

        Access Level: Read

        https://docs.aws.amazon.com/lambda/latest/dg/API_GetFunctionEventInvokeConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toGetFunctionEventInvokeConfig", []))

    @jsii.member(jsii_name="toGetLayerVersion")
    def to_get_layer_version(self) -> "Lambda":
        '''(experimental) Grants permission to view details about a version of an AWS Lambda layer.

        Note this action also supports GetLayerVersionByArn API

        Access Level: Read

        https://docs.aws.amazon.com/lambda/latest/dg/API_GetLayerVersion.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toGetLayerVersion", []))

    @jsii.member(jsii_name="toGetLayerVersionPolicy")
    def to_get_layer_version_policy(self) -> "Lambda":
        '''(experimental) Grants permission to view the resource-based policy for a version of an AWS Lambda layer.

        Access Level: Read

        https://docs.aws.amazon.com/lambda/latest/dg/API_GetLayerVersionPolicy.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toGetLayerVersionPolicy", []))

    @jsii.member(jsii_name="toGetPolicy")
    def to_get_policy(self) -> "Lambda":
        '''(experimental) Grants permission to view the resource-based policy for an AWS Lambda function, version, or alias.

        Access Level: Read

        https://docs.aws.amazon.com/lambda/latest/dg/API_GetPolicy.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toGetPolicy", []))

    @jsii.member(jsii_name="toGetProvisionedConcurrencyConfig")
    def to_get_provisioned_concurrency_config(self) -> "Lambda":
        '''(experimental) Grants permission to view the provisioned concurrency configuration for an AWS Lambda function's alias or version.

        Access Level: Read

        https://docs.aws.amazon.com/lambda/latest/dg/API_GetProvisionedConcurrencyConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toGetProvisionedConcurrencyConfig", []))

    @jsii.member(jsii_name="toInvokeAsync")
    def to_invoke_async(self) -> "Lambda":
        '''(experimental) (Deprecated) Grants permission to invoke a function asynchronously.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_InvokeAsync.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toInvokeAsync", []))

    @jsii.member(jsii_name="toInvokeFunction")
    def to_invoke_function(self) -> "Lambda":
        '''(experimental) Grants permission to invoke an AWS Lambda function.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_Invoke.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toInvokeFunction", []))

    @jsii.member(jsii_name="toListAliases")
    def to_list_aliases(self) -> "Lambda":
        '''(experimental) Grants permission to retrieve a list of aliases for an AWS Lambda function.

        Access Level: List

        https://docs.aws.amazon.com/lambda/latest/dg/API_ListAliases.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toListAliases", []))

    @jsii.member(jsii_name="toListCodeSigningConfigs")
    def to_list_code_signing_configs(self) -> "Lambda":
        '''(experimental) Grants permission to retrieve a list of AWS Lambda code signing configs.

        Access Level: List

        https://docs.aws.amazon.com/lambda/latest/dg/API_ListCodeSigningConfigs.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toListCodeSigningConfigs", []))

    @jsii.member(jsii_name="toListEventSourceMappings")
    def to_list_event_source_mappings(self) -> "Lambda":
        '''(experimental) Grants permission to retrieve a list of AWS Lambda event source mappings.

        Access Level: List

        https://docs.aws.amazon.com/lambda/latest/dg/API_ListEventSourceMappings.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toListEventSourceMappings", []))

    @jsii.member(jsii_name="toListFunctionEventInvokeConfigs")
    def to_list_function_event_invoke_configs(self) -> "Lambda":
        '''(experimental) Grants permission to retrieve a list of configurations for asynchronous invocation for a function.

        Access Level: List

        https://docs.aws.amazon.com/lambda/latest/dg/API_ListFunctionEventInvokeConfigs.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toListFunctionEventInvokeConfigs", []))

    @jsii.member(jsii_name="toListFunctions")
    def to_list_functions(self) -> "Lambda":
        '''(experimental) Grants permission to retrieve a list of AWS Lambda functions, with the version-specific configuration of each function.

        Access Level: List

        https://docs.aws.amazon.com/lambda/latest/dg/API_ListFunctions.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toListFunctions", []))

    @jsii.member(jsii_name="toListFunctionsByCodeSigningConfig")
    def to_list_functions_by_code_signing_config(self) -> "Lambda":
        '''(experimental) Grants permission to retrieve a list of AWS Lambda functions by the code signing config assigned.

        Access Level: List

        https://docs.aws.amazon.com/lambda/latest/dg/API_ListFunctionsByCodeSigningConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toListFunctionsByCodeSigningConfig", []))

    @jsii.member(jsii_name="toListLayers")
    def to_list_layers(self) -> "Lambda":
        '''(experimental) Grants permission to retrieve a list of AWS Lambda layers, with details about the latest version of each layer.

        Access Level: List

        https://docs.aws.amazon.com/lambda/latest/dg/API_ListLayers.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toListLayers", []))

    @jsii.member(jsii_name="toListLayerVersions")
    def to_list_layer_versions(self) -> "Lambda":
        '''(experimental) Grants permission to retrieve a list of versions of an AWS Lambda layer.

        Access Level: List

        https://docs.aws.amazon.com/lambda/latest/dg/API_ListLayerVersions.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toListLayerVersions", []))

    @jsii.member(jsii_name="toListProvisionedConcurrencyConfigs")
    def to_list_provisioned_concurrency_configs(self) -> "Lambda":
        '''(experimental) Grants permission to retrieve a list of provisioned concurrency configurations for an AWS Lambda function.

        Access Level: List

        https://docs.aws.amazon.com/lambda/latest/dg/API_ListProvisionedConcurrencyConfigs.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toListProvisionedConcurrencyConfigs", []))

    @jsii.member(jsii_name="toListTags")
    def to_list_tags(self) -> "Lambda":
        '''(experimental) Grants permission to retrieve a list of tags for an AWS Lambda function.

        Access Level: Read

        https://docs.aws.amazon.com/lambda/latest/dg/API_ListTags.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toListTags", []))

    @jsii.member(jsii_name="toListVersionsByFunction")
    def to_list_versions_by_function(self) -> "Lambda":
        '''(experimental) Grants permission to retrieve a list of versions for an AWS Lambda function.

        Access Level: List

        https://docs.aws.amazon.com/lambda/latest/dg/API_ListVersionsByFunction.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toListVersionsByFunction", []))

    @jsii.member(jsii_name="toPublishLayerVersion")
    def to_publish_layer_version(self) -> "Lambda":
        '''(experimental) Grants permission to create an AWS Lambda layer.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_PublishLayerVersion.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toPublishLayerVersion", []))

    @jsii.member(jsii_name="toPublishVersion")
    def to_publish_version(self) -> "Lambda":
        '''(experimental) Grants permission to create an AWS Lambda function version.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_PublishVersion.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toPublishVersion", []))

    @jsii.member(jsii_name="toPutFunctionCodeSigningConfig")
    def to_put_function_code_signing_config(self) -> "Lambda":
        '''(experimental) Grants permission to attach a code signing config to an AWS Lambda function.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_PutFunctionCodeSigningConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toPutFunctionCodeSigningConfig", []))

    @jsii.member(jsii_name="toPutFunctionConcurrency")
    def to_put_function_concurrency(self) -> "Lambda":
        '''(experimental) Grants permission to configure reserved concurrency for an AWS Lambda function.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_PutFunctionConcurrency.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toPutFunctionConcurrency", []))

    @jsii.member(jsii_name="toPutFunctionEventInvokeConfig")
    def to_put_function_event_invoke_config(self) -> "Lambda":
        '''(experimental) Grants permission to configures options for asynchronous invocation on an AWS Lambda function, version, or alias.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_PutFunctionEventInvokeConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toPutFunctionEventInvokeConfig", []))

    @jsii.member(jsii_name="toPutProvisionedConcurrencyConfig")
    def to_put_provisioned_concurrency_config(self) -> "Lambda":
        '''(experimental) Grants permission to configure provisioned concurrency for an AWS Lambda function's alias or version.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_PutProvisionedConcurrencyConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toPutProvisionedConcurrencyConfig", []))

    @jsii.member(jsii_name="toRemoveLayerVersionPermission")
    def to_remove_layer_version_permission(self) -> "Lambda":
        '''(experimental) Grants permission to remove a statement from the permissions policy for a version of an AWS Lambda layer.

        Access Level: Permissions management

        https://docs.aws.amazon.com/lambda/latest/dg/API_RemoveLayerVersionPermission.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toRemoveLayerVersionPermission", []))

    @jsii.member(jsii_name="toRemovePermission")
    def to_remove_permission(self) -> "Lambda":
        '''(experimental) Grants permission to revoke function-use permission from an AWS service or another account.

        Access Level: Permissions management

        Possible conditions:

        - .ifPrincipal()

        https://docs.aws.amazon.com/lambda/latest/dg/API_RemovePermission.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toRemovePermission", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Lambda":
        '''(experimental) Grants permission to add tags to an AWS Lambda function.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_TagResources.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Lambda":
        '''(experimental) Grants permission to remove tags from an AWS Lambda function.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAlias")
    def to_update_alias(self) -> "Lambda":
        '''(experimental) Grants permission to update the configuration of an AWS Lambda function's alias.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_UpdateAlias.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toUpdateAlias", []))

    @jsii.member(jsii_name="toUpdateCodeSigningConfig")
    def to_update_code_signing_config(self) -> "Lambda":
        '''(experimental) Grants permission to update an AWS Lambda code signing config.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_UpdateCodeSigningConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toUpdateCodeSigningConfig", []))

    @jsii.member(jsii_name="toUpdateEventSourceMapping")
    def to_update_event_source_mapping(self) -> "Lambda":
        '''(experimental) Grants permission to update the configuration of an AWS Lambda event source mapping.

        Access Level: Write

        Possible conditions:

        - .ifFunctionArn()

        https://docs.aws.amazon.com/lambda/latest/dg/API_UpdateEventSourceMapping.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toUpdateEventSourceMapping", []))

    @jsii.member(jsii_name="toUpdateFunctionCode")
    def to_update_function_code(self) -> "Lambda":
        '''(experimental) Grants permission to update the code of an AWS Lambda function.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_UpdateFunctionCode.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toUpdateFunctionCode", []))

    @jsii.member(jsii_name="toUpdateFunctionCodeSigningConfig")
    def to_update_function_code_signing_config(self) -> "Lambda":
        '''(experimental) Grants permission to update the code signing config of an AWS Lambda function.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_UpdateFunctionCodeSigningConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toUpdateFunctionCodeSigningConfig", []))

    @jsii.member(jsii_name="toUpdateFunctionConfiguration")
    def to_update_function_configuration(self) -> "Lambda":
        '''(experimental) Grants permission to modify the version-specific settings of an AWS Lambda function.

        Access Level: Write

        Possible conditions:

        - .ifLayer()
        - .ifVpcIds()
        - .ifSubnetIds()
        - .ifSecurityGroupIds()

        https://docs.aws.amazon.com/lambda/latest/dg/API_UpdateFunctionConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toUpdateFunctionConfiguration", []))

    @jsii.member(jsii_name="toUpdateFunctionEventInvokeConfig")
    def to_update_function_event_invoke_config(self) -> "Lambda":
        '''(experimental) Grants permission to modify the configuration for asynchronous invocation for an AWS Lambda function, version, or alias.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_UpdateFunctionEventInvokeConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toUpdateFunctionEventInvokeConfig", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Launchwizard(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Launchwizard",
):
    '''(experimental) Statement provider for service `launchwizard <https://docs.aws.amazon.com/service-authorization/latest/reference/list_launchwizard.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `launchwizard <https://docs.aws.amazon.com/service-authorization/latest/reference/list_launchwizard.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Launchwizard, self, [sid])

    @jsii.member(jsii_name="toDeleteApp")
    def to_delete_app(self) -> "Launchwizard":
        '''(experimental) Delete an application.

        Access Level: Write

        https://docs.aws.amazon.com/launchwizard/

        :stability: experimental
        '''
        return typing.cast("Launchwizard", jsii.invoke(self, "toDeleteApp", []))

    @jsii.member(jsii_name="toDescribeProvisionedApp")
    def to_describe_provisioned_app(self) -> "Launchwizard":
        '''(experimental) Describe provisioning applications.

        Access Level: Read

        https://docs.aws.amazon.com/launchwizard/

        :stability: experimental
        '''
        return typing.cast("Launchwizard", jsii.invoke(self, "toDescribeProvisionedApp", []))

    @jsii.member(jsii_name="toDescribeProvisioningEvents")
    def to_describe_provisioning_events(self) -> "Launchwizard":
        '''(experimental) Describe provisioning events.

        Access Level: Read

        https://docs.aws.amazon.com/launchwizard/

        :stability: experimental
        '''
        return typing.cast("Launchwizard", jsii.invoke(self, "toDescribeProvisioningEvents", []))

    @jsii.member(jsii_name="toGetInfrastructureSuggestion")
    def to_get_infrastructure_suggestion(self) -> "Launchwizard":
        '''(experimental) Get infrastructure suggestion.

        Access Level: Read

        https://docs.aws.amazon.com/launchwizard/

        :stability: experimental
        '''
        return typing.cast("Launchwizard", jsii.invoke(self, "toGetInfrastructureSuggestion", []))

    @jsii.member(jsii_name="toGetIpAddress")
    def to_get_ip_address(self) -> "Launchwizard":
        '''(experimental) Get customer's ip address.

        Access Level: Read

        https://docs.aws.amazon.com/launchwizard/

        :stability: experimental
        '''
        return typing.cast("Launchwizard", jsii.invoke(self, "toGetIpAddress", []))

    @jsii.member(jsii_name="toGetResourceCostEstimate")
    def to_get_resource_cost_estimate(self) -> "Launchwizard":
        '''(experimental) Get resource cost estimate.

        Access Level: Read

        https://docs.aws.amazon.com/launchwizard/

        :stability: experimental
        '''
        return typing.cast("Launchwizard", jsii.invoke(self, "toGetResourceCostEstimate", []))

    @jsii.member(jsii_name="toListProvisionedApps")
    def to_list_provisioned_apps(self) -> "Launchwizard":
        '''(experimental) List provisioning applications.

        Access Level: List

        https://docs.aws.amazon.com/launchwizard/

        :stability: experimental
        '''
        return typing.cast("Launchwizard", jsii.invoke(self, "toListProvisionedApps", []))

    @jsii.member(jsii_name="toStartProvisioning")
    def to_start_provisioning(self) -> "Launchwizard":
        '''(experimental) Start a provisioning.

        Access Level: Write

        https://docs.aws.amazon.com/launchwizard/

        :stability: experimental
        '''
        return typing.cast("Launchwizard", jsii.invoke(self, "toStartProvisioning", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Lex(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Lex"):
    '''(experimental) Statement provider for service `lex <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonlex.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `lex <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonlex.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Lex, self, [sid])

    @jsii.member(jsii_name="ifAssociatedIntents")
    def if_associated_intents(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Lex":
        '''(experimental) Enables you to control access based on the intents included in the request.

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "ifAssociatedIntents", [value, operator]))

    @jsii.member(jsii_name="ifAssociatedSlotTypes")
    def if_associated_slot_types(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Lex":
        '''(experimental) Enables you to control access based on the slot types included in the request.

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "ifAssociatedSlotTypes", [value, operator]))

    @jsii.member(jsii_name="ifChannelType")
    def if_channel_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Lex":
        '''(experimental) Enables you to control access based on the channel type included in the request.

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "ifChannelType", [value, operator]))

    @jsii.member(jsii_name="onBot")
    def on_bot(
        self,
        bot_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lex":
        '''(experimental) Adds a resource of type bot to the statement.

        https://docs.aws.amazon.com/lex/latest/dg/API_BotMetadata.html

        :param bot_name: - Identifier for the botName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "onBot", [bot_name, account, region, partition]))

    @jsii.member(jsii_name="onBotAlias")
    def on_bot_alias(
        self,
        bot_name: builtins.str,
        bot_alias: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lex":
        '''(experimental) Adds a resource of type bot alias to the statement.

        https://docs.aws.amazon.com/lex/latest/dg/API_BotAliasMetadata.html

        :param bot_name: - Identifier for the botName.
        :param bot_alias: - Identifier for the botAlias.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "onBotAlias", [bot_name, bot_alias, account, region, partition]))

    @jsii.member(jsii_name="onBotVersion")
    def on_bot_version(
        self,
        bot_name: builtins.str,
        bot_version: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lex":
        '''(experimental) Adds a resource of type bot version to the statement.

        https://docs.aws.amazon.com/lex/latest/dg/API_BotMetadata.html

        :param bot_name: - Identifier for the botName.
        :param bot_version: - Identifier for the botVersion.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "onBotVersion", [bot_name, bot_version, account, region, partition]))

    @jsii.member(jsii_name="onChannel")
    def on_channel(
        self,
        bot_name: builtins.str,
        bot_alias: builtins.str,
        channel_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lex":
        '''(experimental) Adds a resource of type channel to the statement.

        https://docs.aws.amazon.com/lex/latest/dg/API_BotChannelAssociation.html

        :param bot_name: - Identifier for the botName.
        :param bot_alias: - Identifier for the botAlias.
        :param channel_name: - Identifier for the channelName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "onChannel", [bot_name, bot_alias, channel_name, account, region, partition]))

    @jsii.member(jsii_name="onIntentVersion")
    def on_intent_version(
        self,
        intent_name: builtins.str,
        intent_version: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lex":
        '''(experimental) Adds a resource of type intent version to the statement.

        https://docs.aws.amazon.com/lex/latest/dg/API_Intent.html

        :param intent_name: - Identifier for the intentName.
        :param intent_version: - Identifier for the intentVersion.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "onIntentVersion", [intent_name, intent_version, account, region, partition]))

    @jsii.member(jsii_name="onSlottypeVersion")
    def on_slottype_version(
        self,
        slot_name: builtins.str,
        slot_version: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lex":
        '''(experimental) Adds a resource of type slottype version to the statement.

        https://docs.aws.amazon.com/lex/latest/dg/API_SlotTypeMetadata.html

        :param slot_name: - Identifier for the slotName.
        :param slot_version: - Identifier for the slotVersion.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "onSlottypeVersion", [slot_name, slot_version, account, region, partition]))

    @jsii.member(jsii_name="toCreateBotVersion")
    def to_create_bot_version(self) -> "Lex":
        '''(experimental) Creates a new version based on the $LATEST version of the specified bot.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_CreateBotVersion.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toCreateBotVersion", []))

    @jsii.member(jsii_name="toCreateIntentVersion")
    def to_create_intent_version(self) -> "Lex":
        '''(experimental) Creates a new version based on the $LATEST version of the specified intent.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_CreateIntentVersion.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toCreateIntentVersion", []))

    @jsii.member(jsii_name="toCreateSlotTypeVersion")
    def to_create_slot_type_version(self) -> "Lex":
        '''(experimental) Creates a new version based on the $LATEST version of the specified slot type.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_CreateSlotTypeVersion.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toCreateSlotTypeVersion", []))

    @jsii.member(jsii_name="toDeleteBot")
    def to_delete_bot(self) -> "Lex":
        '''(experimental) Deletes all versions of a bot.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_DeleteBot.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toDeleteBot", []))

    @jsii.member(jsii_name="toDeleteBotAlias")
    def to_delete_bot_alias(self) -> "Lex":
        '''(experimental) Deletes an alias for a specific bot.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_DeleteBotAlias.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toDeleteBotAlias", []))

    @jsii.member(jsii_name="toDeleteBotChannelAssociation")
    def to_delete_bot_channel_association(self) -> "Lex":
        '''(experimental) Deletes the association between a Amazon Lex bot alias and a messaging platform.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_DeleteBotChannelAssociation.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toDeleteBotChannelAssociation", []))

    @jsii.member(jsii_name="toDeleteBotVersion")
    def to_delete_bot_version(self) -> "Lex":
        '''(experimental) Deletes a specific version of a bot.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_DeleteBotVersion.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toDeleteBotVersion", []))

    @jsii.member(jsii_name="toDeleteIntent")
    def to_delete_intent(self) -> "Lex":
        '''(experimental) Deletes all versions of an intent.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_DeleteIntent.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toDeleteIntent", []))

    @jsii.member(jsii_name="toDeleteIntentVersion")
    def to_delete_intent_version(self) -> "Lex":
        '''(experimental) Deletes a specific version of an intent.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_DeleteIntentVersion.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toDeleteIntentVersion", []))

    @jsii.member(jsii_name="toDeleteSession")
    def to_delete_session(self) -> "Lex":
        '''(experimental) Removes session information for a specified bot, alias, and user ID.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_runtime_DeleteSession.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toDeleteSession", []))

    @jsii.member(jsii_name="toDeleteSlotType")
    def to_delete_slot_type(self) -> "Lex":
        '''(experimental) Deletes all versions of a slot type.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_DeleteSlotType.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toDeleteSlotType", []))

    @jsii.member(jsii_name="toDeleteSlotTypeVersion")
    def to_delete_slot_type_version(self) -> "Lex":
        '''(experimental) Deletes a specific version of a slot type.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_DeleteSlotTypeVersion.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toDeleteSlotTypeVersion", []))

    @jsii.member(jsii_name="toDeleteUtterances")
    def to_delete_utterances(self) -> "Lex":
        '''(experimental) Deletes the information Amazon Lex maintains for utterances on a specific bot and userId.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_DeleteUtterances.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toDeleteUtterances", []))

    @jsii.member(jsii_name="toGetBot")
    def to_get_bot(self) -> "Lex":
        '''(experimental) Returns information for a specific bot. In addition to the bot name, the bot version or alias is required.

        Access Level: Read

        https://docs.aws.amazon.com/lex/latest/dg/API_GetBot.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetBot", []))

    @jsii.member(jsii_name="toGetBotAlias")
    def to_get_bot_alias(self) -> "Lex":
        '''(experimental) Returns information about a Amazon Lex bot alias.

        Access Level: Read

        https://docs.aws.amazon.com/lex/latest/dg/API_GetBotAlias.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetBotAlias", []))

    @jsii.member(jsii_name="toGetBotAliases")
    def to_get_bot_aliases(self) -> "Lex":
        '''(experimental) Returns a list of aliases for a given Amazon Lex bot.

        Access Level: List

        https://docs.aws.amazon.com/lex/latest/dg/API_GetBotAliases.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetBotAliases", []))

    @jsii.member(jsii_name="toGetBotChannelAssociation")
    def to_get_bot_channel_association(self) -> "Lex":
        '''(experimental) Returns information about the association between a Amazon Lex bot and a messaging platform.

        Access Level: Read

        https://docs.aws.amazon.com/lex/latest/dg/API_GetBotChannelAssociation.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetBotChannelAssociation", []))

    @jsii.member(jsii_name="toGetBotChannelAssociations")
    def to_get_bot_channel_associations(self) -> "Lex":
        '''(experimental) Returns a list of all of the channels associated with a single bot.

        Access Level: List

        https://docs.aws.amazon.com/lex/latest/dg/API_GetBotChannelAssociations.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetBotChannelAssociations", []))

    @jsii.member(jsii_name="toGetBots")
    def to_get_bots(self) -> "Lex":
        '''(experimental) Returns information for the $LATEST version of all bots, subject to filters provided by the client.

        Access Level: List

        https://docs.aws.amazon.com/lex/latest/dg/API_GetBots.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetBots", []))

    @jsii.member(jsii_name="toGetBotVersions")
    def to_get_bot_versions(self) -> "Lex":
        '''(experimental) Returns information for all versions of a specific bot.

        Access Level: List

        https://docs.aws.amazon.com/lex/latest/dg/API_GetBotVersions.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetBotVersions", []))

    @jsii.member(jsii_name="toGetBuiltinIntent")
    def to_get_builtin_intent(self) -> "Lex":
        '''(experimental) Returns information about a built-in intent.

        Access Level: Read

        https://docs.aws.amazon.com/lex/latest/dg/API_GetBuiltinIntent.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetBuiltinIntent", []))

    @jsii.member(jsii_name="toGetBuiltinIntents")
    def to_get_builtin_intents(self) -> "Lex":
        '''(experimental) Gets a list of built-in intents that meet the specified criteria.

        Access Level: Read

        https://docs.aws.amazon.com/lex/latest/dg/API_GetBuiltinIntents.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetBuiltinIntents", []))

    @jsii.member(jsii_name="toGetBuiltinSlotTypes")
    def to_get_builtin_slot_types(self) -> "Lex":
        '''(experimental) Gets a list of built-in slot types that meet the specified criteria.

        Access Level: Read

        https://docs.aws.amazon.com/lex/latest/dg/API_GetBuiltinSlotTypes.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetBuiltinSlotTypes", []))

    @jsii.member(jsii_name="toGetExport")
    def to_get_export(self) -> "Lex":
        '''(experimental) Exports Amazon Lex Resource in a requested format.

        Access Level: Read

        https://docs.aws.amazon.com/lex/latest/dg/API_GetExport.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetExport", []))

    @jsii.member(jsii_name="toGetImport")
    def to_get_import(self) -> "Lex":
        '''(experimental) Gets information about an import job started with StartImport.

        Access Level: Read

        https://docs.aws.amazon.com/lex/latest/dg/API_GetImport.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetImport", []))

    @jsii.member(jsii_name="toGetIntent")
    def to_get_intent(self) -> "Lex":
        '''(experimental) Returns information for a specific intent. In addition to the intent name, you must also specify the intent version.

        Access Level: Read

        https://docs.aws.amazon.com/lex/latest/dg/API_GetIntent.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetIntent", []))

    @jsii.member(jsii_name="toGetIntents")
    def to_get_intents(self) -> "Lex":
        '''(experimental) Returns information for the $LATEST version of all intents, subject to filters provided by the client.

        Access Level: List

        https://docs.aws.amazon.com/lex/latest/dg/API_GetIntents.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetIntents", []))

    @jsii.member(jsii_name="toGetIntentVersions")
    def to_get_intent_versions(self) -> "Lex":
        '''(experimental) Returns information for all versions of a specific intent.

        Access Level: List

        https://docs.aws.amazon.com/lex/latest/dg/API_GetIntentVersions.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetIntentVersions", []))

    @jsii.member(jsii_name="toGetSession")
    def to_get_session(self) -> "Lex":
        '''(experimental) Returns session information for a specified bot, alias, and user ID.

        Access Level: Read

        https://docs.aws.amazon.com/lex/latest/dg/API_runtime_GetSession.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetSession", []))

    @jsii.member(jsii_name="toGetSlotType")
    def to_get_slot_type(self) -> "Lex":
        '''(experimental) Returns information about a specific version of a slot type.

        In addition to specifying the slot type name, you must also specify the slot type version.

        Access Level: Read

        https://docs.aws.amazon.com/lex/latest/dg/API_GetSlotType.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetSlotType", []))

    @jsii.member(jsii_name="toGetSlotTypes")
    def to_get_slot_types(self) -> "Lex":
        '''(experimental) Returns information for the $LATEST version of all slot types, subject to filters provided by the client.

        Access Level: List

        https://docs.aws.amazon.com/lex/latest/dg/API_GetSlotTypes.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetSlotTypes", []))

    @jsii.member(jsii_name="toGetSlotTypeVersions")
    def to_get_slot_type_versions(self) -> "Lex":
        '''(experimental) Returns information for all versions of a specific slot type.

        Access Level: List

        https://docs.aws.amazon.com/lex/latest/dg/API_GetSlotTypeVersions.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetSlotTypeVersions", []))

    @jsii.member(jsii_name="toGetUtterancesView")
    def to_get_utterances_view(self) -> "Lex":
        '''(experimental) Returns a view of aggregate utterance data for versions of a bot for a recent time period.

        Access Level: List

        https://docs.aws.amazon.com/lex/latest/dg/API_GetUtterancesView.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetUtterancesView", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Lex":
        '''(experimental) Lists tags for a Lex resource.

        Access Level: Read

        https://docs.aws.amazon.com/lex/latest/dg/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPostContent")
    def to_post_content(self) -> "Lex":
        '''(experimental) Sends user input (text or speech) to Amazon Lex.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_runtime_PostContent.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toPostContent", []))

    @jsii.member(jsii_name="toPostText")
    def to_post_text(self) -> "Lex":
        '''(experimental) Sends user input (text-only) to Amazon Lex.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_runtime_PostText.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toPostText", []))

    @jsii.member(jsii_name="toPutBot")
    def to_put_bot(self) -> "Lex":
        '''(experimental) Creates or updates the $LATEST version of a Amazon Lex conversational bot.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/lex/latest/dg/API_PutBot.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toPutBot", []))

    @jsii.member(jsii_name="toPutBotAlias")
    def to_put_bot_alias(self) -> "Lex":
        '''(experimental) Creates or updates an alias for the specific bot.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/lex/latest/dg/API_PutBotAlias.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toPutBotAlias", []))

    @jsii.member(jsii_name="toPutIntent")
    def to_put_intent(self) -> "Lex":
        '''(experimental) Creates or updates the $LATEST version of an intent.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_PutIntent.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toPutIntent", []))

    @jsii.member(jsii_name="toPutSession")
    def to_put_session(self) -> "Lex":
        '''(experimental) Creates a new session or modifies an existing session with an Amazon Lex bot.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_runtime_PutSession.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toPutSession", []))

    @jsii.member(jsii_name="toPutSlotType")
    def to_put_slot_type(self) -> "Lex":
        '''(experimental) Creates or updates the $LATEST version of a slot type.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_PutSlotType.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toPutSlotType", []))

    @jsii.member(jsii_name="toStartImport")
    def to_start_import(self) -> "Lex":
        '''(experimental) Starts a job to import a resource to Amazon Lex.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_StartImport.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toStartImport", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Lex":
        '''(experimental) Adds or overwrites tags to a Lex resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/lex/latest/dg/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Lex":
        '''(experimental) Removes tags from a Lex resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/lex/latest/dg/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toUntagResource", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class LexV2(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.LexV2"):
    '''(experimental) Statement provider for service `lex-v2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonlexv2.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `lex-v2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonlexv2.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(LexV2, self, [sid])

    @jsii.member(jsii_name="onBot")
    def on_bot(
        self,
        bot_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "LexV2":
        '''(experimental) Adds a resource of type bot to the statement.

        https://docs.aws.amazon.com/lexv2/latest/dg/how-it-works.html

        :param bot_id: - Identifier for the botId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "onBot", [bot_id, account, region, partition]))

    @jsii.member(jsii_name="onBotAlias")
    def on_bot_alias(
        self,
        bot_id: builtins.str,
        bot_alias_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "LexV2":
        '''(experimental) Adds a resource of type bot alias to the statement.

        https://docs.aws.amazon.com/lexv2/latest/dg/how-it-works.html

        :param bot_id: - Identifier for the botId.
        :param bot_alias_id: - Identifier for the botAliasId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "onBotAlias", [bot_id, bot_alias_id, account, region, partition]))

    @jsii.member(jsii_name="toBuildBotLocale")
    def to_build_bot_locale(self) -> "LexV2":
        '''(experimental) Grants permission to build an existing bot locale in a bot.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_BuildBotLocale.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toBuildBotLocale", []))

    @jsii.member(jsii_name="toCreateBot")
    def to_create_bot(self) -> "LexV2":
        '''(experimental) Grants permission to create a new bot and a test bot alias pointing to the DRAFT bot version.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/lexv2/latest/dg/API_CreateBot.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toCreateBot", []))

    @jsii.member(jsii_name="toCreateBotAlias")
    def to_create_bot_alias(self) -> "LexV2":
        '''(experimental) Grants permission to create a new bot alias in a bot.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/lexv2/latest/dg/API_CreateBotAlias.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toCreateBotAlias", []))

    @jsii.member(jsii_name="toCreateBotChannel")
    def to_create_bot_channel(self) -> "LexV2":
        '''(experimental) Grants permission to create a bot channel in an existing bot.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/deploying-messaging-platform.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toCreateBotChannel", []))

    @jsii.member(jsii_name="toCreateBotLocale")
    def to_create_bot_locale(self) -> "LexV2":
        '''(experimental) Grants permission to create a new bot locale in an existing bot.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_CreateBotLocale.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toCreateBotLocale", []))

    @jsii.member(jsii_name="toCreateBotVersion")
    def to_create_bot_version(self) -> "LexV2":
        '''(experimental) Grants permission to create a new version of an existing bot.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_CreateBotVersion.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toCreateBotVersion", []))

    @jsii.member(jsii_name="toCreateIntent")
    def to_create_intent(self) -> "LexV2":
        '''(experimental) Grants permission to create a new intent in an existing bot locale.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_CreateIntent.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toCreateIntent", []))

    @jsii.member(jsii_name="toCreateSlot")
    def to_create_slot(self) -> "LexV2":
        '''(experimental) Grants permission to create a new slot in an intent.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_CreateSlot.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toCreateSlot", []))

    @jsii.member(jsii_name="toCreateSlotType")
    def to_create_slot_type(self) -> "LexV2":
        '''(experimental) Grants permission to create a new slot type in an existing bot locale.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_CreateSlotType.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toCreateSlotType", []))

    @jsii.member(jsii_name="toDeleteBot")
    def to_delete_bot(self) -> "LexV2":
        '''(experimental) Grants permission to delete an existing bot.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DeleteBot.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDeleteBot", []))

    @jsii.member(jsii_name="toDeleteBotAlias")
    def to_delete_bot_alias(self) -> "LexV2":
        '''(experimental) Grants permission to delete an existing bot alias in a bot.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DeleteBotAlias.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDeleteBotAlias", []))

    @jsii.member(jsii_name="toDeleteBotChannel")
    def to_delete_bot_channel(self) -> "LexV2":
        '''(experimental) Grants permission to delete an existing bot channel.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/deploying-messaging-platform.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDeleteBotChannel", []))

    @jsii.member(jsii_name="toDeleteBotLocale")
    def to_delete_bot_locale(self) -> "LexV2":
        '''(experimental) Grants permission to delete an existing bot locale in a bot.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DeleteBotLocale.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDeleteBotLocale", []))

    @jsii.member(jsii_name="toDeleteBotVersion")
    def to_delete_bot_version(self) -> "LexV2":
        '''(experimental) Grants permission to delete an existing bot version.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DeleteBotVersion.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDeleteBotVersion", []))

    @jsii.member(jsii_name="toDeleteIntent")
    def to_delete_intent(self) -> "LexV2":
        '''(experimental) Grants permission to delete an existing intent in a bot locale.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DeleteIntent.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDeleteIntent", []))

    @jsii.member(jsii_name="toDeleteSession")
    def to_delete_session(self) -> "LexV2":
        '''(experimental) Grants permission to delete session information for a bot alias and user ID.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_runtime_DeleteSession.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDeleteSession", []))

    @jsii.member(jsii_name="toDeleteSlot")
    def to_delete_slot(self) -> "LexV2":
        '''(experimental) Grants permission to delete an existing slot in an intent.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DeleteSlot.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDeleteSlot", []))

    @jsii.member(jsii_name="toDeleteSlotType")
    def to_delete_slot_type(self) -> "LexV2":
        '''(experimental) Grants permission to delete an existing slot type in a bot locale.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DeleteSlotType.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDeleteSlotType", []))

    @jsii.member(jsii_name="toDescribeBot")
    def to_describe_bot(self) -> "LexV2":
        '''(experimental) Grants permission to retrieve an existing bot.

        Access Level: Read

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DescribeBot.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDescribeBot", []))

    @jsii.member(jsii_name="toDescribeBotAlias")
    def to_describe_bot_alias(self) -> "LexV2":
        '''(experimental) Grants permission to retrieve an existing bot alias.

        Access Level: Read

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DescribeBotAlias.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDescribeBotAlias", []))

    @jsii.member(jsii_name="toDescribeBotChannel")
    def to_describe_bot_channel(self) -> "LexV2":
        '''(experimental) Grants permission to retrieve an existing bot channel.

        Access Level: Read

        https://docs.aws.amazon.com/lexv2/latest/dg/deploying-messaging-platform.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDescribeBotChannel", []))

    @jsii.member(jsii_name="toDescribeBotLocale")
    def to_describe_bot_locale(self) -> "LexV2":
        '''(experimental) Grants permission to retrieve an existing bot locale.

        Access Level: Read

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DescribeBotLocale.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDescribeBotLocale", []))

    @jsii.member(jsii_name="toDescribeBotVersion")
    def to_describe_bot_version(self) -> "LexV2":
        '''(experimental) Grants permission to retrieve an existing bot version.

        Access Level: Read

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DescribeBotVersion.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDescribeBotVersion", []))

    @jsii.member(jsii_name="toDescribeIntent")
    def to_describe_intent(self) -> "LexV2":
        '''(experimental) Grants permission to retrieve an existing intent.

        Access Level: Read

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DescribeIntent.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDescribeIntent", []))

    @jsii.member(jsii_name="toDescribeSlot")
    def to_describe_slot(self) -> "LexV2":
        '''(experimental) Grants permission to retrieve an existing slot.

        Access Level: Read

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DescribeSlot.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDescribeSlot", []))

    @jsii.member(jsii_name="toDescribeSlotType")
    def to_describe_slot_type(self) -> "LexV2":
        '''(experimental) Grants permission to retrieve an existing slot type.

        Access Level: Read

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DescribeSlotType.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDescribeSlotType", []))

    @jsii.member(jsii_name="toGetBuiltinIntents")
    def to_get_builtin_intents(self) -> "LexV2":
        '''(experimental) Grants permission to list built-in intents.

        Access Level: List

        https://docs.aws.amazon.com/lexv2/latest/dg/API_GetBuiltinIntents.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toGetBuiltinIntents", []))

    @jsii.member(jsii_name="toGetBuiltinSlotTypes")
    def to_get_builtin_slot_types(self) -> "LexV2":
        '''(experimental) Grants permission to list built-in slot types.

        Access Level: List

        https://docs.aws.amazon.com/lexv2/latest/dg/API_GetBuiltinSlotTypes.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toGetBuiltinSlotTypes", []))

    @jsii.member(jsii_name="toGetSession")
    def to_get_session(self) -> "LexV2":
        '''(experimental) Grants permission to retrieve session information for a bot alias and user ID.

        Access Level: Read

        https://docs.aws.amazon.com/lexv2/latest/dg/API_runtime_GetSession.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toGetSession", []))

    @jsii.member(jsii_name="toListBotAliases")
    def to_list_bot_aliases(self) -> "LexV2":
        '''(experimental) Grants permission to list bot aliases in an bot.

        Access Level: List

        https://docs.aws.amazon.com/lexv2/latest/dg/API_ListBotAliases.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toListBotAliases", []))

    @jsii.member(jsii_name="toListBotChannels")
    def to_list_bot_channels(self) -> "LexV2":
        '''(experimental) Grants permission to list bot channels.

        Access Level: List

        https://docs.aws.amazon.com/lexv2/latest/dg/deploying-messaging-platform.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toListBotChannels", []))

    @jsii.member(jsii_name="toListBotLocales")
    def to_list_bot_locales(self) -> "LexV2":
        '''(experimental) Grants permission to list bot locales in a bot.

        Access Level: List

        https://docs.aws.amazon.com/lexv2/latest/dg/API_ListBotLocales.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toListBotLocales", []))

    @jsii.member(jsii_name="toListBots")
    def to_list_bots(self) -> "LexV2":
        '''(experimental) Grants permission to list existing bots.

        Access Level: List

        https://docs.aws.amazon.com/lexv2/latest/dg/API_ListBots.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toListBots", []))

    @jsii.member(jsii_name="toListBotVersions")
    def to_list_bot_versions(self) -> "LexV2":
        '''(experimental) Grants permission to list existing bot versions.

        Access Level: List

        https://docs.aws.amazon.com/lexv2/latest/dg/API_ListBotVersions.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toListBotVersions", []))

    @jsii.member(jsii_name="toListIntents")
    def to_list_intents(self) -> "LexV2":
        '''(experimental) Grants permission to list intents in a bot.

        Access Level: List

        https://docs.aws.amazon.com/lexv2/latest/dg/API_ListIntents.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toListIntents", []))

    @jsii.member(jsii_name="toListSlots")
    def to_list_slots(self) -> "LexV2":
        '''(experimental) Grants permission to list slots in an intent.

        Access Level: List

        https://docs.aws.amazon.com/lexv2/latest/dg/API_ListSlots.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toListSlots", []))

    @jsii.member(jsii_name="toListSlotTypes")
    def to_list_slot_types(self) -> "LexV2":
        '''(experimental) Grants permission to list slot types in a bot.

        Access Level: List

        https://docs.aws.amazon.com/lexv2/latest/dg/API_ListSlotTypes.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toListSlotTypes", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "LexV2":
        '''(experimental) Grants permission to lists tags for a Lex resource.

        Access Level: Read

        https://docs.aws.amazon.com/lexv2/latest/dg/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutSession")
    def to_put_session(self) -> "LexV2":
        '''(experimental) Grants permission to create a new session or modify an existing session for a bot alias and user ID.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_runtime_PutSession.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toPutSession", []))

    @jsii.member(jsii_name="toRecognizeSpeech")
    def to_recognize_speech(self) -> "LexV2":
        '''(experimental) Grants permission to send user input (text or speech) to an bot alias.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_runtime_RecognizeSpeech.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toRecognizeSpeech", []))

    @jsii.member(jsii_name="toRecognizeText")
    def to_recognize_text(self) -> "LexV2":
        '''(experimental) Grants permission to send user input (text-only) to an bot alias.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_runtime_RecognizeText.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toRecognizeText", []))

    @jsii.member(jsii_name="toStartConversation")
    def to_start_conversation(self) -> "LexV2":
        '''(experimental) Grants permission to stream user input (speech/text/DTMF) to a bot alias.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_runtime_StartConversation.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toStartConversation", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "LexV2":
        '''(experimental) Grants permission to add or overwrite tags of a Lex resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/lexv2/latest/dg/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "LexV2":
        '''(experimental) Grants permission to remove tags from a Lex resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/lexv2/latest/dg/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateBot")
    def to_update_bot(self) -> "LexV2":
        '''(experimental) Grants permission to update an existing bot.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_UpdateBot.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toUpdateBot", []))

    @jsii.member(jsii_name="toUpdateBotAlias")
    def to_update_bot_alias(self) -> "LexV2":
        '''(experimental) Grants permission to update an existing bot alias.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_UpdateBotAlias.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toUpdateBotAlias", []))

    @jsii.member(jsii_name="toUpdateBotLocale")
    def to_update_bot_locale(self) -> "LexV2":
        '''(experimental) Grants permission to update an existing bot locale.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_UpdateBotLocale.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toUpdateBotLocale", []))

    @jsii.member(jsii_name="toUpdateIntent")
    def to_update_intent(self) -> "LexV2":
        '''(experimental) Grants permission to update an existing intent.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_UpdateIntent.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toUpdateIntent", []))

    @jsii.member(jsii_name="toUpdateSlot")
    def to_update_slot(self) -> "LexV2":
        '''(experimental) Grants permission to update an existing slot.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_UpdateSlot.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toUpdateSlot", []))

    @jsii.member(jsii_name="toUpdateSlotType")
    def to_update_slot_type(self) -> "LexV2":
        '''(experimental) Grants permission to update an existing slot type.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_UpdateSlotType.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toUpdateSlotType", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class LicenseManager(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.LicenseManager",
):
    '''(experimental) Statement provider for service `license-manager <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awslicensemanager.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `license-manager <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awslicensemanager.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(LicenseManager, self, [sid])

    @jsii.member(jsii_name="ifResourceTag")
    def if_resource_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "LicenseManager":
        '''(experimental) Filters actions based on tag-value associated with the resource.

        https://docs.aws.amazon.com/license-manager/latest/userguide/identity-access-management.html

        Applies to resource types:

        - license-configuration

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "ifResourceTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="onGrant")
    def on_grant(
        self,
        grant_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "LicenseManager":
        '''(experimental) Adds a resource of type grant to the statement.

        https://docs.aws.amazon.com/license-manager/latest/userguide/granted-licenses.html

        :param grant_id: - Identifier for the grantId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "onGrant", [grant_id, account, partition]))

    @jsii.member(jsii_name="onLicense")
    def on_license(
        self,
        license_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "LicenseManager":
        '''(experimental) Adds a resource of type license to the statement.

        https://docs.aws.amazon.com/license-manager/latest/userguide/seller-issued-licenses.html

        :param license_id: - Identifier for the licenseId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "onLicense", [license_id, account, partition]))

    @jsii.member(jsii_name="onLicenseConfiguration")
    def on_license_configuration(
        self,
        license_configuration_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "LicenseManager":
        '''(experimental) Adds a resource of type license-configuration to the statement.

        https://docs.aws.amazon.com/license-manager/latest/userguide/license-configurations.html

        :param license_configuration_id: - Identifier for the licenseConfigurationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifResourceTag()

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "onLicenseConfiguration", [license_configuration_id, account, region, partition]))

    @jsii.member(jsii_name="toAcceptGrant")
    def to_accept_grant(self) -> "LicenseManager":
        '''(experimental) Grants permission to accept a grant.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_AcceptGrant.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toAcceptGrant", []))

    @jsii.member(jsii_name="toCheckInLicense")
    def to_check_in_license(self) -> "LicenseManager":
        '''(experimental) Grants permission to check in license entitlements back to pool.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_CheckInLicense.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toCheckInLicense", []))

    @jsii.member(jsii_name="toCheckoutBorrowLicense")
    def to_checkout_borrow_license(self) -> "LicenseManager":
        '''(experimental) Grants permission to check out license entitlements for borrow use case.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_CheckoutBorrowLicense.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toCheckoutBorrowLicense", []))

    @jsii.member(jsii_name="toCheckoutLicense")
    def to_checkout_license(self) -> "LicenseManager":
        '''(experimental) Grants permission to check out license entitlements.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_CheckoutLicense.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toCheckoutLicense", []))

    @jsii.member(jsii_name="toCreateGrant")
    def to_create_grant(self) -> "LicenseManager":
        '''(experimental) Grants permission to create a new grant for license.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_CreateGrant.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toCreateGrant", []))

    @jsii.member(jsii_name="toCreateGrantVersion")
    def to_create_grant_version(self) -> "LicenseManager":
        '''(experimental) Grants permission to create new version of grant.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_CreateGrantVersion.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toCreateGrantVersion", []))

    @jsii.member(jsii_name="toCreateLicense")
    def to_create_license(self) -> "LicenseManager":
        '''(experimental) Grants permission to create a new license.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_CreateLicense.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toCreateLicense", []))

    @jsii.member(jsii_name="toCreateLicenseConfiguration")
    def to_create_license_configuration(self) -> "LicenseManager":
        '''(experimental) Grants permission to create a new license configuration.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_CreateLicenseConfiguration.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toCreateLicenseConfiguration", []))

    @jsii.member(jsii_name="toCreateLicenseVersion")
    def to_create_license_version(self) -> "LicenseManager":
        '''(experimental) Grants permission to create new version of license.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_CreateLicenseVersion.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toCreateLicenseVersion", []))

    @jsii.member(jsii_name="toCreateToken")
    def to_create_token(self) -> "LicenseManager":
        '''(experimental) Grants permission to create a new token for license.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_CreateToken.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toCreateToken", []))

    @jsii.member(jsii_name="toDeleteGrant")
    def to_delete_grant(self) -> "LicenseManager":
        '''(experimental) Deletes a grant.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_DeleteGrant.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toDeleteGrant", []))

    @jsii.member(jsii_name="toDeleteLicense")
    def to_delete_license(self) -> "LicenseManager":
        '''(experimental) Grants permission to delete a license.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_DeleteLicense.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toDeleteLicense", []))

    @jsii.member(jsii_name="toDeleteLicenseConfiguration")
    def to_delete_license_configuration(self) -> "LicenseManager":
        '''(experimental) Grants permission to permanently delete a license configuration.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_DeleteLicenseConfiguration.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toDeleteLicenseConfiguration", []))

    @jsii.member(jsii_name="toDeleteToken")
    def to_delete_token(self) -> "LicenseManager":
        '''(experimental) Grants permission to delete token.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_DeleteToken.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toDeleteToken", []))

    @jsii.member(jsii_name="toExtendLicenseConsumption")
    def to_extend_license_consumption(self) -> "LicenseManager":
        '''(experimental) Grants permission to extend consumption period of already checkout license entitlements.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ExtendLicenseConsumption.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toExtendLicenseConsumption", []))

    @jsii.member(jsii_name="toGetAccessToken")
    def to_get_access_token(self) -> "LicenseManager":
        '''(experimental) Grants permission to get access token.

        Access Level: Read

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_GetAccessToken.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toGetAccessToken", []))

    @jsii.member(jsii_name="toGetGrant")
    def to_get_grant(self) -> "LicenseManager":
        '''(experimental) Grants permission to get a grant.

        Access Level: Read

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_GetGrant.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toGetGrant", []))

    @jsii.member(jsii_name="toGetLicense")
    def to_get_license(self) -> "LicenseManager":
        '''(experimental) Grants permission to get a license.

        Access Level: Read

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_GetLicense.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toGetLicense", []))

    @jsii.member(jsii_name="toGetLicenseConfiguration")
    def to_get_license_configuration(self) -> "LicenseManager":
        '''(experimental) Grants permission to get a license configuration.

        Access Level: List

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_GetLicenseConfiguration.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toGetLicenseConfiguration", []))

    @jsii.member(jsii_name="toGetLicenseUsage")
    def to_get_license_usage(self) -> "LicenseManager":
        '''(experimental) Grants permission to get a license usage.

        Access Level: Read

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_GetLicenseUsage.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toGetLicenseUsage", []))

    @jsii.member(jsii_name="toGetServiceSettings")
    def to_get_service_settings(self) -> "LicenseManager":
        '''(experimental) Grants permission to get service settings.

        Access Level: List

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_GetServiceSettings.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toGetServiceSettings", []))

    @jsii.member(jsii_name="toListAssociationsForLicenseConfiguration")
    def to_list_associations_for_license_configuration(self) -> "LicenseManager":
        '''(experimental) Grants permission to list associations for a selected license configuration.

        Access Level: List

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ListAssociationsForLicenseConfiguration.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toListAssociationsForLicenseConfiguration", []))

    @jsii.member(jsii_name="toListDistributedGrants")
    def to_list_distributed_grants(self) -> "LicenseManager":
        '''(experimental) Grants permission to list distributed grants.

        Access Level: List

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ListDistributedGrants.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toListDistributedGrants", []))

    @jsii.member(jsii_name="toListFailuresForLicenseConfigurationOperations")
    def to_list_failures_for_license_configuration_operations(self) -> "LicenseManager":
        '''(experimental) Grants permission to list the license configuration operations that failed.

        Access Level: List

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ListFailuresForLicenseConfigurationOperations.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toListFailuresForLicenseConfigurationOperations", []))

    @jsii.member(jsii_name="toListLicenseConfigurations")
    def to_list_license_configurations(self) -> "LicenseManager":
        '''(experimental) Grants permission to list license configurations.

        Access Level: List

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ListLicenseConfigurations.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toListLicenseConfigurations", []))

    @jsii.member(jsii_name="toListLicenses")
    def to_list_licenses(self) -> "LicenseManager":
        '''(experimental) Grants permission to list licenses.

        Access Level: List

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ListLicenses.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toListLicenses", []))

    @jsii.member(jsii_name="toListLicenseSpecificationsForResource")
    def to_list_license_specifications_for_resource(self) -> "LicenseManager":
        '''(experimental) Grants permission to list license specifications associated with a selected resource.

        Access Level: List

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ListLicenseSpecificationsForResource.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toListLicenseSpecificationsForResource", []))

    @jsii.member(jsii_name="toListLicenseVersions")
    def to_list_license_versions(self) -> "LicenseManager":
        '''(experimental) Grants permission to list license versions.

        Access Level: List

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ListLicenseVersions.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toListLicenseVersions", []))

    @jsii.member(jsii_name="toListReceivedGrants")
    def to_list_received_grants(self) -> "LicenseManager":
        '''(experimental) Grants permission to list received grants.

        Access Level: List

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ListReceivedGrants.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toListReceivedGrants", []))

    @jsii.member(jsii_name="toListReceivedLicenses")
    def to_list_received_licenses(self) -> "LicenseManager":
        '''(experimental) Grants permission to list received licenses.

        Access Level: List

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ListReceivedLicenses.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toListReceivedLicenses", []))

    @jsii.member(jsii_name="toListResourceInventory")
    def to_list_resource_inventory(self) -> "LicenseManager":
        '''(experimental) Grants permission to list resource inventory.

        Access Level: List

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ListResourceInventory.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toListResourceInventory", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "LicenseManager":
        '''(experimental) Grants permission to list tags for a selected resource.

        Access Level: List

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTokens")
    def to_list_tokens(self) -> "LicenseManager":
        '''(experimental) Grants permission to list tokens.

        Access Level: List

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ListTokens.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toListTokens", []))

    @jsii.member(jsii_name="toListUsageForLicenseConfiguration")
    def to_list_usage_for_license_configuration(self) -> "LicenseManager":
        '''(experimental) Grants permission to list usage records for selected license configuration.

        Access Level: List

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ListUsageForLicenseConfiguration.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toListUsageForLicenseConfiguration", []))

    @jsii.member(jsii_name="toRejectGrant")
    def to_reject_grant(self) -> "LicenseManager":
        '''(experimental) Grants permission to reject a grant.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_RejectGrant.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toRejectGrant", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "LicenseManager":
        '''(experimental) Grants permission to tag a selected resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "LicenseManager":
        '''(experimental) Grants permission to untag a selected resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateLicenseConfiguration")
    def to_update_license_configuration(self) -> "LicenseManager":
        '''(experimental) Grants permission to update an existing license configuration.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_UpdateLicenseConfiguration.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toUpdateLicenseConfiguration", []))

    @jsii.member(jsii_name="toUpdateLicenseSpecificationsForResource")
    def to_update_license_specifications_for_resource(self) -> "LicenseManager":
        '''(experimental) Grants permission to updates license specifications for a selected resource.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_UpdateLicenseSpecificationsForResource.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toUpdateLicenseSpecificationsForResource", []))

    @jsii.member(jsii_name="toUpdateServiceSettings")
    def to_update_service_settings(self) -> "LicenseManager":
        '''(experimental) Grants permission to updates service settings.

        Access Level: Permissions management

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_UpdateServiceSettings.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toUpdateServiceSettings", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Lightsail(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Lightsail",
):
    '''(experimental) Statement provider for service `lightsail <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonlightsail.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `lightsail <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonlightsail.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Lightsail, self, [sid])

    @jsii.member(jsii_name="onAlarm")
    def on_alarm(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lightsail":
        '''(experimental) Adds a resource of type Alarm to the statement.

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_Alarm.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "onAlarm", [id, account, region, partition]))

    @jsii.member(jsii_name="onCertificate")
    def on_certificate(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lightsail":
        '''(experimental) Adds a resource of type Certificate to the statement.

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_Certificate.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "onCertificate", [id, account, region, partition]))

    @jsii.member(jsii_name="onCloudFormationStackRecord")
    def on_cloud_formation_stack_record(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lightsail":
        '''(experimental) Adds a resource of type CloudFormationStackRecord to the statement.

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CloudFormationStackRecord.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "onCloudFormationStackRecord", [id, account, region, partition]))

    @jsii.member(jsii_name="onContactMethod")
    def on_contact_method(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lightsail":
        '''(experimental) Adds a resource of type ContactMethod to the statement.

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_ContactMethod.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "onContactMethod", [id, account, region, partition]))

    @jsii.member(jsii_name="onContainerService")
    def on_container_service(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lightsail":
        '''(experimental) Adds a resource of type ContainerService to the statement.

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_ContainerService.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "onContainerService", [id, account, region, partition]))

    @jsii.member(jsii_name="onDisk")
    def on_disk(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lightsail":
        '''(experimental) Adds a resource of type Disk to the statement.

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_Disk.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "onDisk", [id, account, region, partition]))

    @jsii.member(jsii_name="onDiskSnapshot")
    def on_disk_snapshot(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lightsail":
        '''(experimental) Adds a resource of type DiskSnapshot to the statement.

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DiskSnapshot.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "onDiskSnapshot", [id, account, region, partition]))

    @jsii.member(jsii_name="onDistribution")
    def on_distribution(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lightsail":
        '''(experimental) Adds a resource of type Distribution to the statement.

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_LightsailDistribution.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "onDistribution", [id, account, region, partition]))

    @jsii.member(jsii_name="onDomain")
    def on_domain(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lightsail":
        '''(experimental) Adds a resource of type Domain to the statement.

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_Domain.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "onDomain", [id, account, region, partition]))

    @jsii.member(jsii_name="onExportSnapshotRecord")
    def on_export_snapshot_record(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lightsail":
        '''(experimental) Adds a resource of type ExportSnapshotRecord to the statement.

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_ExportSnapshotRecord.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "onExportSnapshotRecord", [id, account, region, partition]))

    @jsii.member(jsii_name="onInstance")
    def on_instance(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lightsail":
        '''(experimental) Adds a resource of type Instance to the statement.

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_Instance.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "onInstance", [id, account, region, partition]))

    @jsii.member(jsii_name="onInstanceSnapshot")
    def on_instance_snapshot(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lightsail":
        '''(experimental) Adds a resource of type InstanceSnapshot to the statement.

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_InstanceSnapshot.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "onInstanceSnapshot", [id, account, region, partition]))

    @jsii.member(jsii_name="onKeyPair")
    def on_key_pair(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lightsail":
        '''(experimental) Adds a resource of type KeyPair to the statement.

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_KeyPair.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "onKeyPair", [id, account, region, partition]))

    @jsii.member(jsii_name="onLoadBalancer")
    def on_load_balancer(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lightsail":
        '''(experimental) Adds a resource of type LoadBalancer to the statement.

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_LoadBalancer.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "onLoadBalancer", [id, account, region, partition]))

    @jsii.member(jsii_name="onLoadBalancerTlsCertificate")
    def on_load_balancer_tls_certificate(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lightsail":
        '''(experimental) Adds a resource of type LoadBalancerTlsCertificate to the statement.

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_LoadBalancerTlsCertificate.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "onLoadBalancerTlsCertificate", [id, account, region, partition]))

    @jsii.member(jsii_name="onRelationalDatabase")
    def on_relational_database(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lightsail":
        '''(experimental) Adds a resource of type RelationalDatabase to the statement.

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_RelationalDatabase.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "onRelationalDatabase", [id, account, region, partition]))

    @jsii.member(jsii_name="onRelationalDatabaseSnapshot")
    def on_relational_database_snapshot(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lightsail":
        '''(experimental) Adds a resource of type RelationalDatabaseSnapshot to the statement.

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_RelationalDatabaseSnapshot.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "onRelationalDatabaseSnapshot", [id, account, region, partition]))

    @jsii.member(jsii_name="onStaticIp")
    def on_static_ip(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lightsail":
        '''(experimental) Adds a resource of type StaticIp to the statement.

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_StaticIp.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "onStaticIp", [id, account, region, partition]))

    @jsii.member(jsii_name="toAllocateStaticIp")
    def to_allocate_static_ip(self) -> "Lightsail":
        '''(experimental) Creates a static IP address that can be attached to an instance.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_AllocateStaticIp.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toAllocateStaticIp", []))

    @jsii.member(jsii_name="toAttachCertificateToDistribution")
    def to_attach_certificate_to_distribution(self) -> "Lightsail":
        '''(experimental) Grants permission to attach an SSL/TLS certificate to your Amazon Lightsail content delivery network (CDN) distribution.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_AttachCertificateToDistribution.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toAttachCertificateToDistribution", []))

    @jsii.member(jsii_name="toAttachDisk")
    def to_attach_disk(self) -> "Lightsail":
        '''(experimental) Attaches a disk to an instance.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_AttachDisk.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toAttachDisk", []))

    @jsii.member(jsii_name="toAttachInstancesToLoadBalancer")
    def to_attach_instances_to_load_balancer(self) -> "Lightsail":
        '''(experimental) Attaches one or more instances to a load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_AttachInstancesToLoadBalancer.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toAttachInstancesToLoadBalancer", []))

    @jsii.member(jsii_name="toAttachLoadBalancerTlsCertificate")
    def to_attach_load_balancer_tls_certificate(self) -> "Lightsail":
        '''(experimental) Attaches a TLS certificate to a load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_AttachLoadBalancerTlsCertificate.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toAttachLoadBalancerTlsCertificate", []))

    @jsii.member(jsii_name="toAttachStaticIp")
    def to_attach_static_ip(self) -> "Lightsail":
        '''(experimental) Attaches a static IP address to an instance.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_AttachStaticIp.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toAttachStaticIp", []))

    @jsii.member(jsii_name="toCloseInstancePublicPorts")
    def to_close_instance_public_ports(self) -> "Lightsail":
        '''(experimental) Closes a public port of an instance.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CloseInstancePublicPorts.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCloseInstancePublicPorts", []))

    @jsii.member(jsii_name="toCopySnapshot")
    def to_copy_snapshot(self) -> "Lightsail":
        '''(experimental) Copies a snapshot from one AWS Region to another in Amazon Lightsail.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CopySnapshot.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCopySnapshot", []))

    @jsii.member(jsii_name="toCreateCertificate")
    def to_create_certificate(self) -> "Lightsail":
        '''(experimental) Grants permission to create an SSL/TLS certificate.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateCertificate.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateCertificate", []))

    @jsii.member(jsii_name="toCreateCloudFormationStack")
    def to_create_cloud_formation_stack(self) -> "Lightsail":
        '''(experimental) Creates a new Amazon EC2 instance from an exported Amazon Lightsail snapshot.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateCloudFormationStack.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateCloudFormationStack", []))

    @jsii.member(jsii_name="toCreateContactMethod")
    def to_create_contact_method(self) -> "Lightsail":
        '''(experimental) Grants permission to create an email or SMS text message contact method.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateContactMethod.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateContactMethod", []))

    @jsii.member(jsii_name="toCreateContainerService")
    def to_create_container_service(self) -> "Lightsail":
        '''(experimental) Grants permission to create an Amazon Lightsail container service.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateContainerService.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateContainerService", []))

    @jsii.member(jsii_name="toCreateContainerServiceDeployment")
    def to_create_container_service_deployment(self) -> "Lightsail":
        '''(experimental) Grants permission to create a deployment for your Amazon Lightsail container service.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateContainerServiceDeployment.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateContainerServiceDeployment", []))

    @jsii.member(jsii_name="toCreateContainerServiceRegistryLogin")
    def to_create_container_service_registry_login(self) -> "Lightsail":
        '''(experimental) Grants permission to create a temporary set of log in credentials that you can use to log in to the Docker process on your local machine.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateContainerServiceRegistryLogin.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateContainerServiceRegistryLogin", []))

    @jsii.member(jsii_name="toCreateDisk")
    def to_create_disk(self) -> "Lightsail":
        '''(experimental) Creates a disk.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateDisk.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateDisk", []))

    @jsii.member(jsii_name="toCreateDiskFromSnapshot")
    def to_create_disk_from_snapshot(self) -> "Lightsail":
        '''(experimental) Creates a disk from snapshot.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateDiskFromSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateDiskFromSnapshot", []))

    @jsii.member(jsii_name="toCreateDiskSnapshot")
    def to_create_disk_snapshot(self) -> "Lightsail":
        '''(experimental) Creates a disk snapshot.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateDiskSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateDiskSnapshot", []))

    @jsii.member(jsii_name="toCreateDistribution")
    def to_create_distribution(self) -> "Lightsail":
        '''(experimental) Grants permission to create an Amazon Lightsail content delivery network (CDN) distribution.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateDistribution.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateDistribution", []))

    @jsii.member(jsii_name="toCreateDomain")
    def to_create_domain(self) -> "Lightsail":
        '''(experimental) Creates a domain resource for the specified domain name.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateDomain.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateDomain", []))

    @jsii.member(jsii_name="toCreateDomainEntry")
    def to_create_domain_entry(self) -> "Lightsail":
        '''(experimental) Creates one or more DNS record entries for a domain resource: Address (A), canonical name (CNAME), mail exchanger (MX), name server (NS), start of authority (SOA), service locator (SRV), or text (TXT).

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateDomainEntry.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateDomainEntry", []))

    @jsii.member(jsii_name="toCreateInstances")
    def to_create_instances(self) -> "Lightsail":
        '''(experimental) Creates one or more instances.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateInstances.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateInstances", []))

    @jsii.member(jsii_name="toCreateInstancesFromSnapshot")
    def to_create_instances_from_snapshot(self) -> "Lightsail":
        '''(experimental) Creates one or more instances based on an instance snapshot.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateInstancesFromSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateInstancesFromSnapshot", []))

    @jsii.member(jsii_name="toCreateInstanceSnapshot")
    def to_create_instance_snapshot(self) -> "Lightsail":
        '''(experimental) Creates an instance snapshot.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateInstanceSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateInstanceSnapshot", []))

    @jsii.member(jsii_name="toCreateKeyPair")
    def to_create_key_pair(self) -> "Lightsail":
        '''(experimental) Creates a key pair used to authenticate and connect to an instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateKeyPair.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateKeyPair", []))

    @jsii.member(jsii_name="toCreateLoadBalancer")
    def to_create_load_balancer(self) -> "Lightsail":
        '''(experimental) Creates a load balancer.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateLoadBalancer.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateLoadBalancer", []))

    @jsii.member(jsii_name="toCreateLoadBalancerTlsCertificate")
    def to_create_load_balancer_tls_certificate(self) -> "Lightsail":
        '''(experimental) Creates a load balancer TLS certificate.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateLoadBalancerTlsCertificate.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateLoadBalancerTlsCertificate", []))

    @jsii.member(jsii_name="toCreateRelationalDatabase")
    def to_create_relational_database(self) -> "Lightsail":
        '''(experimental) Creates a new relational database.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateRelationalDatabase.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateRelationalDatabase", []))

    @jsii.member(jsii_name="toCreateRelationalDatabaseFromSnapshot")
    def to_create_relational_database_from_snapshot(self) -> "Lightsail":
        '''(experimental) Creates a new relational database from a snapshot.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateRelationalDatabaseFromSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateRelationalDatabaseFromSnapshot", []))

    @jsii.member(jsii_name="toCreateRelationalDatabaseSnapshot")
    def to_create_relational_database_snapshot(self) -> "Lightsail":
        '''(experimental) Creates a relational database snapshot.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateRelationalDatabaseSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateRelationalDatabaseSnapshot", []))

    @jsii.member(jsii_name="toDeleteAlarm")
    def to_delete_alarm(self) -> "Lightsail":
        '''(experimental) Grants permission to delete an alarm.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteAlarm.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteAlarm", []))

    @jsii.member(jsii_name="toDeleteAutoSnapshot")
    def to_delete_auto_snapshot(self) -> "Lightsail":
        '''(experimental) Grants permission to delete an automatic snapshot of an instance or disk.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteAutoSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteAutoSnapshot", []))

    @jsii.member(jsii_name="toDeleteCertificate")
    def to_delete_certificate(self) -> "Lightsail":
        '''(experimental) Grants permission to delete an SSL/TLS certificate.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteCertificate.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteCertificate", []))

    @jsii.member(jsii_name="toDeleteContactMethod")
    def to_delete_contact_method(self) -> "Lightsail":
        '''(experimental) Grants permission to delete a contact method.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteContactMethod.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteContactMethod", []))

    @jsii.member(jsii_name="toDeleteContainerImage")
    def to_delete_container_image(self) -> "Lightsail":
        '''(experimental) Grants permission to delete a container image that is registered to your Amazon Lightsail container service.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteContainerImage.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteContainerImage", []))

    @jsii.member(jsii_name="toDeleteContainerService")
    def to_delete_container_service(self) -> "Lightsail":
        '''(experimental) Grants permission to delete your Amazon Lightsail container service.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteContainerService.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteContainerService", []))

    @jsii.member(jsii_name="toDeleteDisk")
    def to_delete_disk(self) -> "Lightsail":
        '''(experimental) Deletes a disk.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteDisk.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteDisk", []))

    @jsii.member(jsii_name="toDeleteDiskSnapshot")
    def to_delete_disk_snapshot(self) -> "Lightsail":
        '''(experimental) Deletes a disk snapshot.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteDiskSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteDiskSnapshot", []))

    @jsii.member(jsii_name="toDeleteDistribution")
    def to_delete_distribution(self) -> "Lightsail":
        '''(experimental) Grants permission to delete your Amazon Lightsail content delivery network (CDN) distribution.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteDistribution.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteDistribution", []))

    @jsii.member(jsii_name="toDeleteDomain")
    def to_delete_domain(self) -> "Lightsail":
        '''(experimental) Deletes a domain resource and all of its DNS records.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteDomain.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteDomain", []))

    @jsii.member(jsii_name="toDeleteDomainEntry")
    def to_delete_domain_entry(self) -> "Lightsail":
        '''(experimental) Deletes a DNS record entry for a domain resource.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteDomainEntry.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteDomainEntry", []))

    @jsii.member(jsii_name="toDeleteInstance")
    def to_delete_instance(self) -> "Lightsail":
        '''(experimental) Deletes an instance.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteInstance.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteInstance", []))

    @jsii.member(jsii_name="toDeleteInstanceSnapshot")
    def to_delete_instance_snapshot(self) -> "Lightsail":
        '''(experimental) Deletes an instance snapshot.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteInstanceSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteInstanceSnapshot", []))

    @jsii.member(jsii_name="toDeleteKeyPair")
    def to_delete_key_pair(self) -> "Lightsail":
        '''(experimental) Deletes a key pair used to authenticate and connect to an instance.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteKeyPair.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteKeyPair", []))

    @jsii.member(jsii_name="toDeleteKnownHostKeys")
    def to_delete_known_host_keys(self) -> "Lightsail":
        '''(experimental) Deletes the known host key or certificate used by the Amazon Lightsail browser-based SSH or RDP clients to authenticate an instance.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteKnownHostKeys.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteKnownHostKeys", []))

    @jsii.member(jsii_name="toDeleteLoadBalancer")
    def to_delete_load_balancer(self) -> "Lightsail":
        '''(experimental) Deletes a load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteLoadBalancer.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteLoadBalancer", []))

    @jsii.member(jsii_name="toDeleteLoadBalancerTlsCertificate")
    def to_delete_load_balancer_tls_certificate(self) -> "Lightsail":
        '''(experimental) Deletes a load balancer TLS certificate.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteLoadBalancerTlsCertificate.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteLoadBalancerTlsCertificate", []))

    @jsii.member(jsii_name="toDeleteRelationalDatabase")
    def to_delete_relational_database(self) -> "Lightsail":
        '''(experimental) Deletes a relational database.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteRelationalDatabase.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteRelationalDatabase", []))

    @jsii.member(jsii_name="toDeleteRelationalDatabaseSnapshot")
    def to_delete_relational_database_snapshot(self) -> "Lightsail":
        '''(experimental) Deletes relational database snapshot.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteRelationalDatabaseSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteRelationalDatabaseSnapshot", []))

    @jsii.member(jsii_name="toDetachCertificateFromDistribution")
    def to_detach_certificate_from_distribution(self) -> "Lightsail":
        '''(experimental) Grants permission to detach an SSL/TLS certificate from your Amazon Lightsail content delivery network (CDN) distribution.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DetachCertificateFromDistribution.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDetachCertificateFromDistribution", []))

    @jsii.member(jsii_name="toDetachDisk")
    def to_detach_disk(self) -> "Lightsail":
        '''(experimental) Detaches a disk from an instance.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DetachDisk.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDetachDisk", []))

    @jsii.member(jsii_name="toDetachInstancesFromLoadBalancer")
    def to_detach_instances_from_load_balancer(self) -> "Lightsail":
        '''(experimental) Detaches one or more instances from a load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DetachInstancesFromLoadBalancer.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDetachInstancesFromLoadBalancer", []))

    @jsii.member(jsii_name="toDetachStaticIp")
    def to_detach_static_ip(self) -> "Lightsail":
        '''(experimental) Detaches a static IP from an instance to which it is attached.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DetachStaticIp.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDetachStaticIp", []))

    @jsii.member(jsii_name="toDisableAddOn")
    def to_disable_add_on(self) -> "Lightsail":
        '''(experimental) Grants permission to disable an add-on for an Amazon Lightsail resource.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DisableAddOn.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDisableAddOn", []))

    @jsii.member(jsii_name="toDownloadDefaultKeyPair")
    def to_download_default_key_pair(self) -> "Lightsail":
        '''(experimental) Downloads the default key pair used to authenticate and connect to instances in a specific AWS Region.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DownloadDefaultKeyPair.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDownloadDefaultKeyPair", []))

    @jsii.member(jsii_name="toEnableAddOn")
    def to_enable_add_on(self) -> "Lightsail":
        '''(experimental) Grants permission to enable or modify an add-on for an Amazon Lightsail resource.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_EnableAddOn.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toEnableAddOn", []))

    @jsii.member(jsii_name="toExportSnapshot")
    def to_export_snapshot(self) -> "Lightsail":
        '''(experimental) Exports an Amazon Lightsail snapshot to Amazon EC2.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_ExportSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toExportSnapshot", []))

    @jsii.member(jsii_name="toGetActiveNames")
    def to_get_active_names(self) -> "Lightsail":
        '''(experimental) Returns the names of all active (not deleted) resources.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetActiveNames.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetActiveNames", []))

    @jsii.member(jsii_name="toGetAlarms")
    def to_get_alarms(self) -> "Lightsail":
        '''(experimental) Grants permission to view information about the configured alarms.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetAlarms.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetAlarms", []))

    @jsii.member(jsii_name="toGetAutoSnapshots")
    def to_get_auto_snapshots(self) -> "Lightsail":
        '''(experimental) Grants permission to view the available automatic snapshots for an instance or disk.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetAutoSnapshots.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetAutoSnapshots", []))

    @jsii.member(jsii_name="toGetBlueprints")
    def to_get_blueprints(self) -> "Lightsail":
        '''(experimental) Returns a list of instance images, or blueprints.

        You can use a blueprint to create a new instance already running a specific operating system, as well as a pre-installed application or development stack. The software that runs on your instance depends on the blueprint you define when creating the instance

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetBlueprints.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetBlueprints", []))

    @jsii.member(jsii_name="toGetBundles")
    def to_get_bundles(self) -> "Lightsail":
        '''(experimental) Returns a list of instance bundles.

        You can use a bundle to create a new instance with a set of performance specifications, such as CPU count, disk size, RAM size, and network transfer allowance. The cost of your instance depends on the bundle you define when creating the instance

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetBundles.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetBundles", []))

    @jsii.member(jsii_name="toGetCertificates")
    def to_get_certificates(self) -> "Lightsail":
        '''(experimental) Grants permission to view information about one or more Amazon Lightsail SSL/TLS certificates.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetCertificates.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetCertificates", []))

    @jsii.member(jsii_name="toGetCloudFormationStackRecords")
    def to_get_cloud_formation_stack_records(self) -> "Lightsail":
        '''(experimental) Returns information about all CloudFormation stacks used to create Amazon EC2 resources from exported Amazon Lightsail snapshots.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetCloudFormationStackRecords.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetCloudFormationStackRecords", []))

    @jsii.member(jsii_name="toGetContactMethods")
    def to_get_contact_methods(self) -> "Lightsail":
        '''(experimental) Grants permission to view information about the configured contact methods.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetContactMethods.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetContactMethods", []))

    @jsii.member(jsii_name="toGetContainerAPIMetadata")
    def to_get_container_api_metadata(self) -> "Lightsail":
        '''(experimental) Grants permission to view information about Amazon Lightsail containers, such as the current version of the Lightsail Control (lightsailctl) plugin.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetContainerAPIMetadata.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetContainerAPIMetadata", []))

    @jsii.member(jsii_name="toGetContainerImages")
    def to_get_container_images(self) -> "Lightsail":
        '''(experimental) Grants permission to view the container images that are registered to your Amazon Lightsail container service.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetContainerImages.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetContainerImages", []))

    @jsii.member(jsii_name="toGetContainerLog")
    def to_get_container_log(self) -> "Lightsail":
        '''(experimental) Grants permission to view the log events of a container of your Amazon Lightsail container service.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetContainerLog.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetContainerLog", []))

    @jsii.member(jsii_name="toGetContainerServiceDeployments")
    def to_get_container_service_deployments(self) -> "Lightsail":
        '''(experimental) Grants permission to view the deployments for your Amazon Lightsail container service.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetContainerServiceDeployments.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetContainerServiceDeployments", []))

    @jsii.member(jsii_name="toGetContainerServiceMetricData")
    def to_get_container_service_metric_data(self) -> "Lightsail":
        '''(experimental) Grants permission to view the data points of a specific metric of your Amazon Lightsail container service.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetContainerServiceMetricData.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetContainerServiceMetricData", []))

    @jsii.member(jsii_name="toGetContainerServicePowers")
    def to_get_container_service_powers(self) -> "Lightsail":
        '''(experimental) Grants permission to view the list of powers that can be specified for your Amazon Lightsail container services.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetContainerServicePowers.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetContainerServicePowers", []))

    @jsii.member(jsii_name="toGetContainerServices")
    def to_get_container_services(self) -> "Lightsail":
        '''(experimental) Grants permission to view information about one or more of your Amazon Lightsail container services.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetContainerServices.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetContainerServices", []))

    @jsii.member(jsii_name="toGetDisk")
    def to_get_disk(self) -> "Lightsail":
        '''(experimental) Returns information about a disk.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetDisk.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetDisk", []))

    @jsii.member(jsii_name="toGetDisks")
    def to_get_disks(self) -> "Lightsail":
        '''(experimental) Returns information about all disks.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetDisks.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetDisks", []))

    @jsii.member(jsii_name="toGetDiskSnapshot")
    def to_get_disk_snapshot(self) -> "Lightsail":
        '''(experimental) Returns information about a disk snapshot.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetDiskSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetDiskSnapshot", []))

    @jsii.member(jsii_name="toGetDiskSnapshots")
    def to_get_disk_snapshots(self) -> "Lightsail":
        '''(experimental) Returns information about all disk snapshots.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetDiskSnapshots.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetDiskSnapshots", []))

    @jsii.member(jsii_name="toGetDistributionBundles")
    def to_get_distribution_bundles(self) -> "Lightsail":
        '''(experimental) Grants permission to view the list of bundles that can be applied to you Amazon Lightsail content delivery network (CDN) distributions.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetDistributionBundles.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetDistributionBundles", []))

    @jsii.member(jsii_name="toGetDistributionLatestCacheReset")
    def to_get_distribution_latest_cache_reset(self) -> "Lightsail":
        '''(experimental) Grants permission to view the timestamp and status of the last cache reset of a specific Amazon Lightsail content delivery network (CDN) distribution.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetDistributionLatestCacheReset.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetDistributionLatestCacheReset", []))

    @jsii.member(jsii_name="toGetDistributionMetricData")
    def to_get_distribution_metric_data(self) -> "Lightsail":
        '''(experimental) Grants permission to view the data points of a specific metric for an Amazon Lightsail content delivery network (CDN) distribution.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetDistributionMetricData.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetDistributionMetricData", []))

    @jsii.member(jsii_name="toGetDistributions")
    def to_get_distributions(self) -> "Lightsail":
        '''(experimental) Grants permission to view information about one or more of your Amazon Lightsail content delivery network (CDN) distributions.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetDistributions.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetDistributions", []))

    @jsii.member(jsii_name="toGetDomain")
    def to_get_domain(self) -> "Lightsail":
        '''(experimental) Returns DNS records for a domain resource.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetDomain.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetDomain", []))

    @jsii.member(jsii_name="toGetDomains")
    def to_get_domains(self) -> "Lightsail":
        '''(experimental) Returns DNS records for all domain resources.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetDomains.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetDomains", []))

    @jsii.member(jsii_name="toGetExportSnapshotRecords")
    def to_get_export_snapshot_records(self) -> "Lightsail":
        '''(experimental) Returns information about all records to export Amazon Lightsail snapshots to Amazon EC2.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetExportSnapshotRecords.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetExportSnapshotRecords", []))

    @jsii.member(jsii_name="toGetInstance")
    def to_get_instance(self) -> "Lightsail":
        '''(experimental) Returns information about an instance.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetInstance.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetInstance", []))

    @jsii.member(jsii_name="toGetInstanceAccessDetails")
    def to_get_instance_access_details(self) -> "Lightsail":
        '''(experimental) Returns temporary keys you can use to authenticate and connect to an instance.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetInstanceAccessDetails.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetInstanceAccessDetails", []))

    @jsii.member(jsii_name="toGetInstanceMetricData")
    def to_get_instance_metric_data(self) -> "Lightsail":
        '''(experimental) Returns the data points for the specified metric of an instance.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetInstanceMetricData.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetInstanceMetricData", []))

    @jsii.member(jsii_name="toGetInstancePortStates")
    def to_get_instance_port_states(self) -> "Lightsail":
        '''(experimental) Returns the port states of an instance.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetInstancePortStates.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetInstancePortStates", []))

    @jsii.member(jsii_name="toGetInstances")
    def to_get_instances(self) -> "Lightsail":
        '''(experimental) Returns information about all instances.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetInstances.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetInstances", []))

    @jsii.member(jsii_name="toGetInstanceSnapshot")
    def to_get_instance_snapshot(self) -> "Lightsail":
        '''(experimental) Returns information about an instance snapshot.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetInstanceSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetInstanceSnapshot", []))

    @jsii.member(jsii_name="toGetInstanceSnapshots")
    def to_get_instance_snapshots(self) -> "Lightsail":
        '''(experimental) Returns information about all instance snapshots.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetInstanceSnapshots.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetInstanceSnapshots", []))

    @jsii.member(jsii_name="toGetInstanceState")
    def to_get_instance_state(self) -> "Lightsail":
        '''(experimental) Returns the state of an instance.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetInstanceState.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetInstanceState", []))

    @jsii.member(jsii_name="toGetKeyPair")
    def to_get_key_pair(self) -> "Lightsail":
        '''(experimental) Returns information about a key pair.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetKeyPair.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetKeyPair", []))

    @jsii.member(jsii_name="toGetKeyPairs")
    def to_get_key_pairs(self) -> "Lightsail":
        '''(experimental) Returns information about all key pairs.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetKeyPairs.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetKeyPairs", []))

    @jsii.member(jsii_name="toGetLoadBalancer")
    def to_get_load_balancer(self) -> "Lightsail":
        '''(experimental) Returns information about a load balancer.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetLoadBalancer.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetLoadBalancer", []))

    @jsii.member(jsii_name="toGetLoadBalancerMetricData")
    def to_get_load_balancer_metric_data(self) -> "Lightsail":
        '''(experimental) Returns the data points for the specified metric of a load balancer.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetLoadBalancerMetricData.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetLoadBalancerMetricData", []))

    @jsii.member(jsii_name="toGetLoadBalancers")
    def to_get_load_balancers(self) -> "Lightsail":
        '''(experimental) Returns information about load balancers.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetLoadBalancers.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetLoadBalancers", []))

    @jsii.member(jsii_name="toGetLoadBalancerTlsCertificates")
    def to_get_load_balancer_tls_certificates(self) -> "Lightsail":
        '''(experimental) Returns information about a load balancer TLS certificate.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteLoadBalancerTlsCertificate.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetLoadBalancerTlsCertificates", []))

    @jsii.member(jsii_name="toGetOperation")
    def to_get_operation(self) -> "Lightsail":
        '''(experimental) Returns information about an operation.

        Operations include events such as when you create an instance, allocate a static IP, attach a static IP, and so on

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetOperation.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetOperation", []))

    @jsii.member(jsii_name="toGetOperations")
    def to_get_operations(self) -> "Lightsail":
        '''(experimental) Returns information about all operations.

        Operations include events such as when you create an instance, allocate a static IP, attach a static IP, and so on

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetOperations.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetOperations", []))

    @jsii.member(jsii_name="toGetOperationsForResource")
    def to_get_operations_for_resource(self) -> "Lightsail":
        '''(experimental) Returns operations for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetOperationsForResource.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetOperationsForResource", []))

    @jsii.member(jsii_name="toGetRegions")
    def to_get_regions(self) -> "Lightsail":
        '''(experimental) Returns a list of all valid AWS Regions for Amazon Lightsail.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetRegions.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetRegions", []))

    @jsii.member(jsii_name="toGetRelationalDatabase")
    def to_get_relational_database(self) -> "Lightsail":
        '''(experimental) Returns information about a relational database.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetRelationalDatabase.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetRelationalDatabase", []))

    @jsii.member(jsii_name="toGetRelationalDatabaseBlueprints")
    def to_get_relational_database_blueprints(self) -> "Lightsail":
        '''(experimental) Returns a list of relational database images, or blueprints.

        You can use a blueprint to create a new database running a specific database engine. The database engine that runs on your database depends on the blueprint you define when creating the relational database

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetRelationalDatabaseBlueprints.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetRelationalDatabaseBlueprints", []))

    @jsii.member(jsii_name="toGetRelationalDatabaseBundles")
    def to_get_relational_database_bundles(self) -> "Lightsail":
        '''(experimental) Returns a list of relational database bundles.

        You can use a bundle to create a new database with a set of performance specifications, such as CPU count, disk size, RAM size, network transfer allowance, and standard of high availability. The cost of your database depends on the bundle you define when creating the relational database

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetRelationalDatabaseBundles.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetRelationalDatabaseBundles", []))

    @jsii.member(jsii_name="toGetRelationalDatabaseEvents")
    def to_get_relational_database_events(self) -> "Lightsail":
        '''(experimental) Returns events for a relational database.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetRelationalDatabaseEvents.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetRelationalDatabaseEvents", []))

    @jsii.member(jsii_name="toGetRelationalDatabaseLogEvents")
    def to_get_relational_database_log_events(self) -> "Lightsail":
        '''(experimental) Returns events for the specified log stream of a relational database.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetRelationalDatabaseLogEvents.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetRelationalDatabaseLogEvents", []))

    @jsii.member(jsii_name="toGetRelationalDatabaseLogStreams")
    def to_get_relational_database_log_streams(self) -> "Lightsail":
        '''(experimental) Returns the log streams available for a relational database.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetRelationalDatabaseLogStreams.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetRelationalDatabaseLogStreams", []))

    @jsii.member(jsii_name="toGetRelationalDatabaseMasterUserPassword")
    def to_get_relational_database_master_user_password(self) -> "Lightsail":
        '''(experimental) Returns the master user password of a relational database.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetRelationalDatabaseMasterUserPassword.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetRelationalDatabaseMasterUserPassword", []))

    @jsii.member(jsii_name="toGetRelationalDatabaseMetricData")
    def to_get_relational_database_metric_data(self) -> "Lightsail":
        '''(experimental) Returns the data points for the specified metric of a relational database.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetRelationalDatabaseMetricData.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetRelationalDatabaseMetricData", []))

    @jsii.member(jsii_name="toGetRelationalDatabaseParameters")
    def to_get_relational_database_parameters(self) -> "Lightsail":
        '''(experimental) Returns the parameters of a relational database.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetRelationalDatabaseParameters.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetRelationalDatabaseParameters", []))

    @jsii.member(jsii_name="toGetRelationalDatabases")
    def to_get_relational_databases(self) -> "Lightsail":
        '''(experimental) Return information about all relational databases.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetRelationalDatabases.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetRelationalDatabases", []))

    @jsii.member(jsii_name="toGetRelationalDatabaseSnapshot")
    def to_get_relational_database_snapshot(self) -> "Lightsail":
        '''(experimental) Returns information about a relational database snapshot.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetRelationalDatabaseSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetRelationalDatabaseSnapshot", []))

    @jsii.member(jsii_name="toGetRelationalDatabaseSnapshots")
    def to_get_relational_database_snapshots(self) -> "Lightsail":
        '''(experimental) Returns information about all relational database snapshots.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetRelationalDatabaseSnapshots.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetRelationalDatabaseSnapshots", []))

    @jsii.member(jsii_name="toGetStaticIp")
    def to_get_static_ip(self) -> "Lightsail":
        '''(experimental) Returns information about a static IP.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetStaticIp.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetStaticIp", []))

    @jsii.member(jsii_name="toGetStaticIps")
    def to_get_static_ips(self) -> "Lightsail":
        '''(experimental) Returns information about all static IPs.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetStaticIps.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetStaticIps", []))

    @jsii.member(jsii_name="toImportKeyPair")
    def to_import_key_pair(self) -> "Lightsail":
        '''(experimental) Imports a public key from a key pair.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_ImportKeyPair.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toImportKeyPair", []))

    @jsii.member(jsii_name="toIsVpcPeered")
    def to_is_vpc_peered(self) -> "Lightsail":
        '''(experimental) Returns a boolean value indicating whether the Amazon Lightsail virtual private cloud (VPC) is peered.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_IsVpcPeered.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toIsVpcPeered", []))

    @jsii.member(jsii_name="toOpenInstancePublicPorts")
    def to_open_instance_public_ports(self) -> "Lightsail":
        '''(experimental) Adds, or opens a public port of an instance.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_OpenInstancePublicPorts.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toOpenInstancePublicPorts", []))

    @jsii.member(jsii_name="toPeerVpc")
    def to_peer_vpc(self) -> "Lightsail":
        '''(experimental) Tries to peer the Amazon Lightsail virtual private cloud (VPC) with the default VPC.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_PeerVpc.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toPeerVpc", []))

    @jsii.member(jsii_name="toPutAlarm")
    def to_put_alarm(self) -> "Lightsail":
        '''(experimental) Grants permission to creates or update an alarm, and associate it with the specified metric.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_PutAlarm.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toPutAlarm", []))

    @jsii.member(jsii_name="toPutInstancePublicPorts")
    def to_put_instance_public_ports(self) -> "Lightsail":
        '''(experimental) Sets the specified open ports for an instance, and closes all ports for every protocol not included in the request.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_PutInstancePublicPorts.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toPutInstancePublicPorts", []))

    @jsii.member(jsii_name="toRebootInstance")
    def to_reboot_instance(self) -> "Lightsail":
        '''(experimental) Reboots an instance that is in a running state.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_RebootInstance.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toRebootInstance", []))

    @jsii.member(jsii_name="toRebootRelationalDatabase")
    def to_reboot_relational_database(self) -> "Lightsail":
        '''(experimental) Reboots a relational database that is in a running state.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_RebootRelationalDatabase.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toRebootRelationalDatabase", []))

    @jsii.member(jsii_name="toRegisterContainerImage")
    def to_register_container_image(self) -> "Lightsail":
        '''(experimental) Grants permission to register a container image to your Amazon Lightsail container service.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_RegisterContainerImage.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toRegisterContainerImage", []))

    @jsii.member(jsii_name="toReleaseStaticIp")
    def to_release_static_ip(self) -> "Lightsail":
        '''(experimental) Deletes a static IP.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_ReleaseStaticIp.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toReleaseStaticIp", []))

    @jsii.member(jsii_name="toResetDistributionCache")
    def to_reset_distribution_cache(self) -> "Lightsail":
        '''(experimental) Grants permission to delete currently cached content from your Amazon Lightsail content delivery network (CDN) distribution.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_ResetDistributionCache.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toResetDistributionCache", []))

    @jsii.member(jsii_name="toSendContactMethodVerification")
    def to_send_contact_method_verification(self) -> "Lightsail":
        '''(experimental) Grants permission to send a verification request to an email contact method to ensure it's owned by the requester.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_SendContactMethodVerification.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toSendContactMethodVerification", []))

    @jsii.member(jsii_name="toSetIpAddressType")
    def to_set_ip_address_type(self) -> "Lightsail":
        '''(experimental) Grants permission to set the IP address type for a Amazon Lightsail resource.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_SetIpAddressType.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toSetIpAddressType", []))

    @jsii.member(jsii_name="toStartInstance")
    def to_start_instance(self) -> "Lightsail":
        '''(experimental) Starts an instance that is in a stopped state.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_StartInstance.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toStartInstance", []))

    @jsii.member(jsii_name="toStartRelationalDatabase")
    def to_start_relational_database(self) -> "Lightsail":
        '''(experimental) Starts a relational database that is in a stopped state.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_StartRelationalDatabase.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toStartRelationalDatabase", []))

    @jsii.member(jsii_name="toStopInstance")
    def to_stop_instance(self) -> "Lightsail":
        '''(experimental) Stops an instance that is in a running state.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_StopInstance.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toStopInstance", []))

    @jsii.member(jsii_name="toStopRelationalDatabase")
    def to_stop_relational_database(self) -> "Lightsail":
        '''(experimental) Stops a relational database that is in a running state.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_StopRelationalDatabase.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toStopRelationalDatabase", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Lightsail":
        '''(experimental) Tags a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTestAlarm")
    def to_test_alarm(self) -> "Lightsail":
        '''(experimental) Grants permission to test an alarm by displaying a banner on the Amazon Lightsail console or if a notification trigger is configured for the specified alarm, by sending a notification to the notification protocol.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_TestAlarm.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toTestAlarm", []))

    @jsii.member(jsii_name="toUnpeerVpc")
    def to_unpeer_vpc(self) -> "Lightsail":
        '''(experimental) Attempts to unpeer the Amazon Lightsail virtual private cloud (VPC) from the default VPC.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_UnpeerVpc.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toUnpeerVpc", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Lightsail":
        '''(experimental) Untags a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateContainerService")
    def to_update_container_service(self) -> "Lightsail":
        '''(experimental) Grants permission to update the configuration of your Amazon Lightsail container service, such as its power, scale, and public domain names.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_UpdateContainerService.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toUpdateContainerService", []))

    @jsii.member(jsii_name="toUpdateDistribution")
    def to_update_distribution(self) -> "Lightsail":
        '''(experimental) Grants permission to update an existing Amazon Lightsail content delivery network (CDN) distribution or its configuration.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_UpdateDistribution.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toUpdateDistribution", []))

    @jsii.member(jsii_name="toUpdateDistributionBundle")
    def to_update_distribution_bundle(self) -> "Lightsail":
        '''(experimental) Grants permission to update the bundle of your Amazon Lightsail content delivery network (CDN) distribution.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_UpdateDistributionBundle.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toUpdateDistributionBundle", []))

    @jsii.member(jsii_name="toUpdateDomainEntry")
    def to_update_domain_entry(self) -> "Lightsail":
        '''(experimental) Updates a domain recordset after it is created.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_UpdateDomainEntry.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toUpdateDomainEntry", []))

    @jsii.member(jsii_name="toUpdateLoadBalancerAttribute")
    def to_update_load_balancer_attribute(self) -> "Lightsail":
        '''(experimental) Updates a load balancer attribute, such as the health check path and session stickiness.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DetachInstancesFromLoadBalancer.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toUpdateLoadBalancerAttribute", []))

    @jsii.member(jsii_name="toUpdateRelationalDatabase")
    def to_update_relational_database(self) -> "Lightsail":
        '''(experimental) Updates a relational database.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_UpdateRelationalDatabase.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toUpdateRelationalDatabase", []))

    @jsii.member(jsii_name="toUpdateRelationalDatabaseParameters")
    def to_update_relational_database_parameters(self) -> "Lightsail":
        '''(experimental) Updates the parameters of a relational database.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_UpdateRelationalDatabaseParameters.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toUpdateRelationalDatabaseParameters", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Logs(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Logs"):
    '''(experimental) Statement provider for service `logs <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudwatchlogs.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `logs <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudwatchlogs.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Logs, self, [sid])

    @jsii.member(jsii_name="onLogGroup")
    def on_log_group(
        self,
        log_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Logs":
        '''(experimental) Adds a resource of type log-group to the statement.

        :param log_group_name: - Identifier for the logGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "onLogGroup", [log_group_name, account, region, partition]))

    @jsii.member(jsii_name="onLogStream")
    def on_log_stream(
        self,
        log_group_name: builtins.str,
        log_stream_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Logs":
        '''(experimental) Adds a resource of type log-stream to the statement.

        :param log_group_name: - Identifier for the logGroupName.
        :param log_stream_name: - Identifier for the logStreamName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "onLogStream", [log_group_name, log_stream_name, account, region, partition]))

    @jsii.member(jsii_name="toAssociateKmsKey")
    def to_associate_kms_key(self) -> "Logs":
        '''(experimental) Associates the specified AWS Key Management Service (AWS KMS) customer master key (CMK) with the specified log group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_AssociateKmsKey.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toAssociateKmsKey", []))

    @jsii.member(jsii_name="toCancelExportTask")
    def to_cancel_export_task(self) -> "Logs":
        '''(experimental) Cancels an export task if it is in PENDING or RUNNING state.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_CancelExportTask.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toCancelExportTask", []))

    @jsii.member(jsii_name="toCreateExportTask")
    def to_create_export_task(self) -> "Logs":
        '''(experimental) Creates an ExportTask which allows you to efficiently export data from a Log Group to your Amazon S3 bucket.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_CreateExportTask.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toCreateExportTask", []))

    @jsii.member(jsii_name="toCreateLogDelivery")
    def to_create_log_delivery(self) -> "Logs":
        '''(experimental) Creates the log delivery.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toCreateLogDelivery", []))

    @jsii.member(jsii_name="toCreateLogGroup")
    def to_create_log_group(self) -> "Logs":
        '''(experimental) Creates a new log group with the specified name.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_CreateLogGroup.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toCreateLogGroup", []))

    @jsii.member(jsii_name="toCreateLogStream")
    def to_create_log_stream(self) -> "Logs":
        '''(experimental) Creates a new log stream with the specified name.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_CreateLogStream.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toCreateLogStream", []))

    @jsii.member(jsii_name="toDeleteDestination")
    def to_delete_destination(self) -> "Logs":
        '''(experimental) Deletes the destination with the specified name and eventually disables all the subscription filters that publish to it.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DeleteDestination.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toDeleteDestination", []))

    @jsii.member(jsii_name="toDeleteLogDelivery")
    def to_delete_log_delivery(self) -> "Logs":
        '''(experimental) Deletes the log delivery information for specified log delivery.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toDeleteLogDelivery", []))

    @jsii.member(jsii_name="toDeleteLogGroup")
    def to_delete_log_group(self) -> "Logs":
        '''(experimental) Deletes the log group with the specified name and permanently deletes all the archived log events associated with it.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DeleteLogGroup.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toDeleteLogGroup", []))

    @jsii.member(jsii_name="toDeleteLogStream")
    def to_delete_log_stream(self) -> "Logs":
        '''(experimental) Deletes a log stream and permanently deletes all the archived log events associated with it.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DeleteLogStream.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toDeleteLogStream", []))

    @jsii.member(jsii_name="toDeleteMetricFilter")
    def to_delete_metric_filter(self) -> "Logs":
        '''(experimental) Deletes a metric filter associated with the specified log group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DeleteMetricFilter.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toDeleteMetricFilter", []))

    @jsii.member(jsii_name="toDeleteResourcePolicy")
    def to_delete_resource_policy(self) -> "Logs":
        '''(experimental) Deletes a resource policy from this account.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DeleteResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toDeleteResourcePolicy", []))

    @jsii.member(jsii_name="toDeleteRetentionPolicy")
    def to_delete_retention_policy(self) -> "Logs":
        '''(experimental) Deletes the retention policy of the specified log group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DeleteRetentionPolicy.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toDeleteRetentionPolicy", []))

    @jsii.member(jsii_name="toDeleteSubscriptionFilter")
    def to_delete_subscription_filter(self) -> "Logs":
        '''(experimental) Deletes a subscription filter associated with the specified log group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DeleteSubscriptionFilter.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toDeleteSubscriptionFilter", []))

    @jsii.member(jsii_name="toDescribeDestinations")
    def to_describe_destinations(self) -> "Logs":
        '''(experimental) Returns all the destinations that are associated with the AWS account making the request.

        Access Level: List

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeDestinations.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toDescribeDestinations", []))

    @jsii.member(jsii_name="toDescribeExportTasks")
    def to_describe_export_tasks(self) -> "Logs":
        '''(experimental) Returns all the export tasks that are associated with the AWS account making the request.

        Access Level: List

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeExportTasks.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toDescribeExportTasks", []))

    @jsii.member(jsii_name="toDescribeLogGroups")
    def to_describe_log_groups(self) -> "Logs":
        '''(experimental) Returns all the log groups that are associated with the AWS account making the request.

        Access Level: List

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeLogGroups.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toDescribeLogGroups", []))

    @jsii.member(jsii_name="toDescribeLogStreams")
    def to_describe_log_streams(self) -> "Logs":
        '''(experimental) Returns all the log streams that are associated with the specified log group.

        Access Level: List

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeLogStreams.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toDescribeLogStreams", []))

    @jsii.member(jsii_name="toDescribeMetricFilters")
    def to_describe_metric_filters(self) -> "Logs":
        '''(experimental) Returns all the metrics filters associated with the specified log group.

        Access Level: List

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeMetricFilters.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toDescribeMetricFilters", []))

    @jsii.member(jsii_name="toDescribeQueries")
    def to_describe_queries(self) -> "Logs":
        '''(experimental) Returns a list of CloudWatch Logs Insights queries that are scheduled, executing, or have been executed recently in this account.

        You can request all queries, or limit it to queries of a specific log group or queries with a certain status.

        Access Level: List

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeQueries.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toDescribeQueries", []))

    @jsii.member(jsii_name="toDescribeResourcePolicies")
    def to_describe_resource_policies(self) -> "Logs":
        '''(experimental) Return all the resource policies in this account.

        Access Level: List

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeResourcePolicies.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toDescribeResourcePolicies", []))

    @jsii.member(jsii_name="toDescribeSubscriptionFilters")
    def to_describe_subscription_filters(self) -> "Logs":
        '''(experimental) Returns all the subscription filters associated with the specified log group.

        Access Level: List

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeSubscriptionFilters.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toDescribeSubscriptionFilters", []))

    @jsii.member(jsii_name="toDisassociateKmsKey")
    def to_disassociate_kms_key(self) -> "Logs":
        '''(experimental) Disassociates the associated AWS Key Management Service (AWS KMS) customer master key (CMK) from the specified log group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DisassociateKmsKey.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toDisassociateKmsKey", []))

    @jsii.member(jsii_name="toFilterLogEvents")
    def to_filter_log_events(self) -> "Logs":
        '''(experimental) Retrieves log events, optionally filtered by a filter pattern from the specified log group.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_FilterLogEvents.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toFilterLogEvents", []))

    @jsii.member(jsii_name="toGetLogDelivery")
    def to_get_log_delivery(self) -> "Logs":
        '''(experimental) Gets the log delivery information for specified log delivery.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toGetLogDelivery", []))

    @jsii.member(jsii_name="toGetLogEvents")
    def to_get_log_events(self) -> "Logs":
        '''(experimental) Retrieves log events from the specified log stream.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetLogEvents.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toGetLogEvents", []))

    @jsii.member(jsii_name="toGetLogGroupFields")
    def to_get_log_group_fields(self) -> "Logs":
        '''(experimental) Returns a list of the fields that are included in log events in the specified log group, along with the percentage of log events that contain each field.

        The search is limited to a time period that you specify.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetLogGroupFields.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toGetLogGroupFields", []))

    @jsii.member(jsii_name="toGetLogRecord")
    def to_get_log_record(self) -> "Logs":
        '''(experimental) Retrieves all the fields and values of a single log event.

        All fields are retrieved, even if the original query that produced the logRecordPointer retrieved only a subset of fields. Fields are returned as field name/field value pairs.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetLogRecord.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toGetLogRecord", []))

    @jsii.member(jsii_name="toGetQueryResults")
    def to_get_query_results(self) -> "Logs":
        '''(experimental) Returns the results from the specified query.

        If the query is in progress, partial results of that current execution are returned. Only the fields requested in the query are returned.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetQueryResults.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toGetQueryResults", []))

    @jsii.member(jsii_name="toListLogDeliveries")
    def to_list_log_deliveries(self) -> "Logs":
        '''(experimental) Lists all the log deliveries for specified account and/or log source.

        Access Level: List

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toListLogDeliveries", []))

    @jsii.member(jsii_name="toListTagsLogGroup")
    def to_list_tags_log_group(self) -> "Logs":
        '''(experimental) Lists the tags for the specified log group.

        Access Level: List

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_ListTagsLogGroup.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toListTagsLogGroup", []))

    @jsii.member(jsii_name="toPutDestination")
    def to_put_destination(self) -> "Logs":
        '''(experimental) Creates or updates a Destination.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutDestination.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toPutDestination", []))

    @jsii.member(jsii_name="toPutDestinationPolicy")
    def to_put_destination_policy(self) -> "Logs":
        '''(experimental) Creates or updates an access policy associated with an existing Destination.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutDestinationPolicy.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toPutDestinationPolicy", []))

    @jsii.member(jsii_name="toPutLogEvents")
    def to_put_log_events(self) -> "Logs":
        '''(experimental) Uploads a batch of log events to the specified log stream.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutLogEvents.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toPutLogEvents", []))

    @jsii.member(jsii_name="toPutMetricFilter")
    def to_put_metric_filter(self) -> "Logs":
        '''(experimental) Creates or updates a metric filter and associates it with the specified log group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutMetricFilter.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toPutMetricFilter", []))

    @jsii.member(jsii_name="toPutResourcePolicy")
    def to_put_resource_policy(self) -> "Logs":
        '''(experimental) Creates or updates a resource policy allowing other AWS services to put log events to this account.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toPutResourcePolicy", []))

    @jsii.member(jsii_name="toPutRetentionPolicy")
    def to_put_retention_policy(self) -> "Logs":
        '''(experimental) Sets the retention of the specified log group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutRetentionPolicy.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toPutRetentionPolicy", []))

    @jsii.member(jsii_name="toPutSubscriptionFilter")
    def to_put_subscription_filter(self) -> "Logs":
        '''(experimental) Creates or updates a subscription filter and associates it with the specified log group.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutSubscriptionFilter.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toPutSubscriptionFilter", []))

    @jsii.member(jsii_name="toStartQuery")
    def to_start_query(self) -> "Logs":
        '''(experimental) Schedules a query of a log group using CloudWatch Logs Insights.

        You specify the log group and time range to query, and the query string to use.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_StartQuery.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toStartQuery", []))

    @jsii.member(jsii_name="toStopQuery")
    def to_stop_query(self) -> "Logs":
        '''(experimental) Stops a CloudWatch Logs Insights query that is in progress.

        If the query has already ended, the operation returns an error indicating that the specified query is not running.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_StopQuery.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toStopQuery", []))

    @jsii.member(jsii_name="toTagLogGroup")
    def to_tag_log_group(self) -> "Logs":
        '''(experimental) Adds or updates the specified tags for the specified log group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_TagLogGroup.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toTagLogGroup", []))

    @jsii.member(jsii_name="toTestMetricFilter")
    def to_test_metric_filter(self) -> "Logs":
        '''(experimental) Tests the filter pattern of a metric filter against a sample of log event messages.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_TestMetricFilter.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toTestMetricFilter", []))

    @jsii.member(jsii_name="toUntagLogGroup")
    def to_untag_log_group(self) -> "Logs":
        '''(experimental) Removes the specified tags from the specified log group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_UntagLogGroup.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toUntagLogGroup", []))

    @jsii.member(jsii_name="toUpdateLogDelivery")
    def to_update_log_delivery(self) -> "Logs":
        '''(experimental) Updates the log delivery information for specified log delivery.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toUpdateLogDelivery", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Lookoutequipment(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Lookoutequipment",
):
    '''(experimental) Statement provider for service `lookoutequipment <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonlookoutforequipment.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `lookoutequipment <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonlookoutforequipment.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Lookoutequipment, self, [sid])

    @jsii.member(jsii_name="onDataset")
    def on_dataset(
        self,
        dataset_name: builtins.str,
        dataset_id: builtins.str,
        account_id: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lookoutequipment":
        '''(experimental) Adds a resource of type dataset to the statement.

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/dataset.html

        :param dataset_name: - Identifier for the datasetName.
        :param dataset_id: - Identifier for the datasetId.
        :param account_id: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "onDataset", [dataset_name, dataset_id, account_id, region, partition]))

    @jsii.member(jsii_name="onInferenceScheduler")
    def on_inference_scheduler(
        self,
        inference_scheduler_name: builtins.str,
        inference_scheduler_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lookoutequipment":
        '''(experimental) Adds a resource of type inference-scheduler to the statement.

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/inference-scheduler.html

        :param inference_scheduler_name: - Identifier for the inferenceSchedulerName.
        :param inference_scheduler_id: - Identifier for the inferenceSchedulerId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "onInferenceScheduler", [inference_scheduler_name, inference_scheduler_id, account, region, partition]))

    @jsii.member(jsii_name="onModel")
    def on_model(
        self,
        model_name: builtins.str,
        model_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lookoutequipment":
        '''(experimental) Adds a resource of type model to the statement.

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/model.html

        :param model_name: - Identifier for the modelName.
        :param model_id: - Identifier for the modelId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "onModel", [model_name, model_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateDataset")
    def to_create_dataset(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to create a dataset.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_CreateDataset.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toCreateDataset", []))

    @jsii.member(jsii_name="toCreateInferenceScheduler")
    def to_create_inference_scheduler(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to create an inference scheduler for a trained model.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_CreateInferenceScheduler.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toCreateInferenceScheduler", []))

    @jsii.member(jsii_name="toCreateModel")
    def to_create_model(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to create a model that is trained on a dataset.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_CreateModel.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toCreateModel", []))

    @jsii.member(jsii_name="toDeleteDataset")
    def to_delete_dataset(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to delete a dataset.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_DeleteDataset.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toDeleteDataset", []))

    @jsii.member(jsii_name="toDeleteInferenceScheduler")
    def to_delete_inference_scheduler(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to delete an inference scheduler.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_DeleteInferenceScheduler.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toDeleteInferenceScheduler", []))

    @jsii.member(jsii_name="toDeleteModel")
    def to_delete_model(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to delete a model.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_DeleteModel.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toDeleteModel", []))

    @jsii.member(jsii_name="toDescribeDataIngestionJob")
    def to_describe_data_ingestion_job(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to describe a data ingestion job.

        Access Level: Read

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_DescribeDataIngestionJob

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toDescribeDataIngestionJob", []))

    @jsii.member(jsii_name="toDescribeDataset")
    def to_describe_dataset(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to describe a dataset.

        Access Level: Read

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_DescribeDataset.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toDescribeDataset", []))

    @jsii.member(jsii_name="toDescribeInferenceScheduler")
    def to_describe_inference_scheduler(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to describe an inference scheduler.

        Access Level: Read

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_DescribeInferenceScheduler.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toDescribeInferenceScheduler", []))

    @jsii.member(jsii_name="toDescribeModel")
    def to_describe_model(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to describe a model.

        Access Level: Read

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_DescribeModel.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toDescribeModel", []))

    @jsii.member(jsii_name="toListDataIngestionJobs")
    def to_list_data_ingestion_jobs(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to list the data ingestion jobs in your account or for a particular dataset.

        Access Level: List

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_ListDataIngestionJobs.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toListDataIngestionJobs", []))

    @jsii.member(jsii_name="toListDatasets")
    def to_list_datasets(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to list the datasets in your account.

        Access Level: List

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_ListDatasets.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toListDatasets", []))

    @jsii.member(jsii_name="toListInferenceExecutions")
    def to_list_inference_executions(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to list the inference executions for an inference scheduler.

        Access Level: Read

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_ListInferenceExecutions.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toListInferenceExecutions", []))

    @jsii.member(jsii_name="toListInferenceSchedulers")
    def to_list_inference_schedulers(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to list the inference schedulers in your account.

        Access Level: List

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_ListInferenceSchedulers.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toListInferenceSchedulers", []))

    @jsii.member(jsii_name="toListModels")
    def to_list_models(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to list the models in your account.

        Access Level: List

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_ListModels.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toListModels", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to list the tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toStartDataIngestionJob")
    def to_start_data_ingestion_job(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to start a data ingestion job for a dataset.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_StartDataIngestionJob.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toStartDataIngestionJob", []))

    @jsii.member(jsii_name="toStartInferenceScheduler")
    def to_start_inference_scheduler(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to start an inference scheduler.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_StartInferenceScheduler.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toStartInferenceScheduler", []))

    @jsii.member(jsii_name="toStopInferenceScheduler")
    def to_stop_inference_scheduler(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to stop an inference scheduler.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_StopInferenceScheduler.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toStopInferenceScheduler", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to tag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to untag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateInferenceScheduler")
    def to_update_inference_scheduler(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to update an inference scheduler.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_UpdateInferenceScheduler.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toUpdateInferenceScheduler", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Lookoutmetrics(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Lookoutmetrics",
):
    '''(experimental) Statement provider for service `lookoutmetrics <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonlookoutformetrics.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `lookoutmetrics <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonlookoutformetrics.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Lookoutmetrics, self, [sid])

    @jsii.member(jsii_name="onAlert")
    def on_alert(
        self,
        alert_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lookoutmetrics":
        '''(experimental) Adds a resource of type Alert to the statement.

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_AlertSummary.html

        :param alert_name: - Identifier for the alertName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "onAlert", [alert_name, account, region, partition]))

    @jsii.member(jsii_name="onAnomalyDetector")
    def on_anomaly_detector(
        self,
        anomaly_detector_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lookoutmetrics":
        '''(experimental) Adds a resource of type AnomalyDetector to the statement.

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_AnomalyDetectorSummary.html

        :param anomaly_detector_name: - Identifier for the anomalyDetectorName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "onAnomalyDetector", [anomaly_detector_name, account, region, partition]))

    @jsii.member(jsii_name="onMetricSet")
    def on_metric_set(
        self,
        anomaly_detector_name: builtins.str,
        metric_set_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lookoutmetrics":
        '''(experimental) Adds a resource of type MetricSet to the statement.

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_MetricSetSummary.html

        :param anomaly_detector_name: - Identifier for the anomalyDetectorName.
        :param metric_set_name: - Identifier for the metricSetName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "onMetricSet", [anomaly_detector_name, metric_set_name, account, region, partition]))

    @jsii.member(jsii_name="toActivateAnomalyDetector")
    def to_activate_anomaly_detector(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to activate an anomaly detector.

        Access Level: Write

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_ActivateAnomalyDetector.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toActivateAnomalyDetector", []))

    @jsii.member(jsii_name="toBackTestAnomalyDetector")
    def to_back_test_anomaly_detector(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to run a backtest with an anomaly detector.

        Access Level: Write

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_BackTestAnomalyDetector.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toBackTestAnomalyDetector", []))

    @jsii.member(jsii_name="toCreateAlert")
    def to_create_alert(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to create an alert for an anomaly detector.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_CreateAlert.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toCreateAlert", []))

    @jsii.member(jsii_name="toCreateAnomalyDetector")
    def to_create_anomaly_detector(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to create an anomaly detector.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_CreateAnomalyDetector.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toCreateAnomalyDetector", []))

    @jsii.member(jsii_name="toCreateMetricSet")
    def to_create_metric_set(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to create a dataset.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_CreateMetricSet.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toCreateMetricSet", []))

    @jsii.member(jsii_name="toDeleteAlert")
    def to_delete_alert(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to delete an alert.

        Access Level: Write

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_DeleteAlert.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toDeleteAlert", []))

    @jsii.member(jsii_name="toDeleteAnomalyDetector")
    def to_delete_anomaly_detector(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to delete an anomaly detector.

        Access Level: Write

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_DeleteAnomalyDetector.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toDeleteAnomalyDetector", []))

    @jsii.member(jsii_name="toDescribeAlert")
    def to_describe_alert(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to get details about an alert.

        Access Level: Read

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_DescribeAlert.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toDescribeAlert", []))

    @jsii.member(jsii_name="toDescribeAnomalyDetectionExecutions")
    def to_describe_anomaly_detection_executions(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to get information about an anomaly detection job.

        Access Level: Read

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_DescribeAnomalyDetectionExecutions.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toDescribeAnomalyDetectionExecutions", []))

    @jsii.member(jsii_name="toDescribeAnomalyDetector")
    def to_describe_anomaly_detector(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to get details about an anomaly detector.

        Access Level: Read

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_DescribeAnomalyDetector.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toDescribeAnomalyDetector", []))

    @jsii.member(jsii_name="toDescribeMetricSet")
    def to_describe_metric_set(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to get details about a dataset.

        Access Level: Read

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_DescribeMetricSet.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toDescribeMetricSet", []))

    @jsii.member(jsii_name="toGetAnomalyGroup")
    def to_get_anomaly_group(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to get details about a group of affected metrics.

        Access Level: Read

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_GetAnomalyGroup.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toGetAnomalyGroup", []))

    @jsii.member(jsii_name="toGetDataQualityMetrics")
    def to_get_data_quality_metrics(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to get data quality metrics for an anomaly detector.

        Access Level: Read

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_GetDataQualityMetrics.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toGetDataQualityMetrics", []))

    @jsii.member(jsii_name="toGetFeedback")
    def to_get_feedback(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to get feedback on affected metrics for an anomaly group.

        Access Level: Read

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_GetFeedback.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toGetFeedback", []))

    @jsii.member(jsii_name="toGetSampleData")
    def to_get_sample_data(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to get a selection of sample records from an Amazon S3 datasource.

        Access Level: Read

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_GetSampleData.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toGetSampleData", []))

    @jsii.member(jsii_name="toListAlerts")
    def to_list_alerts(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to get a list of alerts for a detector.

        Access Level: List

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_ListAlerts.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toListAlerts", []))

    @jsii.member(jsii_name="toListAnomalyDetectors")
    def to_list_anomaly_detectors(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to get a list of anomaly detectors.

        Access Level: List

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_ListAnomalyDetectors.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toListAnomalyDetectors", []))

    @jsii.member(jsii_name="toListAnomalyGroupSummaries")
    def to_list_anomaly_group_summaries(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to get a list of anomaly groups.

        Access Level: List

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_ListAnomalyGroupSummaries.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toListAnomalyGroupSummaries", []))

    @jsii.member(jsii_name="toListAnomalyGroupTimeSeries")
    def to_list_anomaly_group_time_series(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to get a list of affected metrics for a measure in an anomaly group.

        Access Level: List

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_ListAnomalyGroupTimeSeries.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toListAnomalyGroupTimeSeries", []))

    @jsii.member(jsii_name="toListMetricSets")
    def to_list_metric_sets(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to get a list of datasets.

        Access Level: List

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_ListMetricSets.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toListMetricSets", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to get a list of tags for a detector, dataset, or alert.

        Access Level: Read

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutFeedback")
    def to_put_feedback(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to add feedback for an affected metric in an anomaly group.

        Access Level: Write

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_PutFeedback.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toPutFeedback", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to add tags to a detector, dataset, or alert.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to remove tags from a detector, dataset, or alert.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAnomalyDetector")
    def to_update_anomaly_detector(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to update an anomaly detector.

        Access Level: Write

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_UpdateAnomalyDetector.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toUpdateAnomalyDetector", []))

    @jsii.member(jsii_name="toUpdateMetricSet")
    def to_update_metric_set(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to update a dataset.

        Access Level: Write

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_UpdateMetricSet.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toUpdateMetricSet", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Lookoutvision(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Lookoutvision",
):
    '''(experimental) Statement provider for service `lookoutvision <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonlookoutforvision.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `lookoutvision <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonlookoutforvision.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Lookoutvision, self, [sid])

    @jsii.member(jsii_name="onModel")
    def on_model(
        self,
        project_name: builtins.str,
        model_version: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lookoutvision":
        '''(experimental) Adds a resource of type model to the statement.

        https://docs.aws.amazon.com/lookout-for-vision/latest/developer-guide/model-create-project.html

        :param project_name: - Identifier for the projectName.
        :param model_version: - Identifier for the modelVersion.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "onModel", [project_name, model_version, account, region, partition]))

    @jsii.member(jsii_name="onProject")
    def on_project(
        self,
        project_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lookoutvision":
        '''(experimental) Adds a resource of type project to the statement.

        https://docs.aws.amazon.com/lookout-for-vision/latest/developer-guide/model-create-project.html

        :param project_name: - Identifier for the projectName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "onProject", [project_name, account, region, partition]))

    @jsii.member(jsii_name="toCreateDataset")
    def to_create_dataset(self) -> "Lookoutvision":
        '''(experimental) Grants permission to create a dataset manifest.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_CreateDataset.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toCreateDataset", []))

    @jsii.member(jsii_name="toCreateModel")
    def to_create_model(self) -> "Lookoutvision":
        '''(experimental) Grants permission to create a new anomaly detection model.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_CreateModel.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toCreateModel", []))

    @jsii.member(jsii_name="toCreateProject")
    def to_create_project(self) -> "Lookoutvision":
        '''(experimental) Grants permission to create a new project.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_CreateProject.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toCreateProject", []))

    @jsii.member(jsii_name="toDeleteDataset")
    def to_delete_dataset(self) -> "Lookoutvision":
        '''(experimental) Grants permission to delete a dataset.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_DeleteDataset.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toDeleteDataset", []))

    @jsii.member(jsii_name="toDeleteModel")
    def to_delete_model(self) -> "Lookoutvision":
        '''(experimental) Grants permission to delete a model and all associated assets.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_DeleteModel.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toDeleteModel", []))

    @jsii.member(jsii_name="toDeleteProject")
    def to_delete_project(self) -> "Lookoutvision":
        '''(experimental) Grants permission to permanently remove a project.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_DeleteProject.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toDeleteProject", []))

    @jsii.member(jsii_name="toDescribeDataset")
    def to_describe_dataset(self) -> "Lookoutvision":
        '''(experimental) Grants permission to show detailed information about dataset manifest.

        Access Level: Read

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_DescribeDataset.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toDescribeDataset", []))

    @jsii.member(jsii_name="toDescribeModel")
    def to_describe_model(self) -> "Lookoutvision":
        '''(experimental) Grants permission to show detailed information about a model.

        Access Level: Read

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_DescribeModel.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toDescribeModel", []))

    @jsii.member(jsii_name="toDescribeProject")
    def to_describe_project(self) -> "Lookoutvision":
        '''(experimental) Grants permission to show detailed information about a project.

        Access Level: Read

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_DescribeProject.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toDescribeProject", []))

    @jsii.member(jsii_name="toDescribeTrialDetection")
    def to_describe_trial_detection(self) -> "Lookoutvision":
        '''(experimental) Grants permission to provides state information about a running anomaly detection job.

        Access Level: Read

        https://docs.aws.amazon.com/lookout-for-vision/latest/developer-guide/trial-detection.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toDescribeTrialDetection", []))

    @jsii.member(jsii_name="toDetectAnomalies")
    def to_detect_anomalies(self) -> "Lookoutvision":
        '''(experimental) Grants permission to invoke detection of anomalies.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_DetectAnomalies.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toDetectAnomalies", []))

    @jsii.member(jsii_name="toListDatasetEntries")
    def to_list_dataset_entries(self) -> "Lookoutvision":
        '''(experimental) Grants permission to list the contents of dataset manifest.

        Access Level: Read

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_ListDatasetEntries.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toListDatasetEntries", []))

    @jsii.member(jsii_name="toListModels")
    def to_list_models(self) -> "Lookoutvision":
        '''(experimental) Grants permission to list all models associated with a project.

        Access Level: List

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_ListModels.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toListModels", []))

    @jsii.member(jsii_name="toListProjects")
    def to_list_projects(self) -> "Lookoutvision":
        '''(experimental) Grants permission to list all projects.

        Access Level: List

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_ListProjects.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toListProjects", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Lookoutvision":
        '''(experimental) Grant permission to list tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTrialDetections")
    def to_list_trial_detections(self) -> "Lookoutvision":
        '''(experimental) Grants permission to list all anomaly detection jobs.

        Access Level: List

        https://docs.aws.amazon.com/lookout-for-vision/latest/developer-guide/trial-detection.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toListTrialDetections", []))

    @jsii.member(jsii_name="toStartModel")
    def to_start_model(self) -> "Lookoutvision":
        '''(experimental) Grants permission to start anomaly detection model.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_StartModel.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toStartModel", []))

    @jsii.member(jsii_name="toStartTrialDetection")
    def to_start_trial_detection(self) -> "Lookoutvision":
        '''(experimental) Grants permission to start bulk detection of anomalies for a set of images stored in an S3 bucket.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-vision/latest/developer-guide/trial-detection.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toStartTrialDetection", []))

    @jsii.member(jsii_name="toStopModel")
    def to_stop_model(self) -> "Lookoutvision":
        '''(experimental) Grants permission to stop anomaly detection model.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_StopModel.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toStopModel", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Lookoutvision":
        '''(experimental) Grant permission to tag a resource with given key value pairs.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Lookoutvision":
        '''(experimental) Grant permission to remove the tag with the given key from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateDatasetEntries")
    def to_update_dataset_entries(self) -> "Lookoutvision":
        '''(experimental) Grants permission to update a training or test dataset manifest.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_UpdateDatasetEntries.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toUpdateDatasetEntries", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Machinelearning(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Machinelearning",
):
    '''(experimental) Statement provider for service `machinelearning <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmachinelearning.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `machinelearning <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmachinelearning.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Machinelearning, self, [sid])

    @jsii.member(jsii_name="onBatchprediction")
    def on_batchprediction(
        self,
        batch_prediction_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Machinelearning":
        '''(experimental) Adds a resource of type batchprediction to the statement.

        https://docs.aws.amazon.com/machine-learning/latest/dg/amazon-machine-learning-key-concepts.html#batch-predictions

        :param batch_prediction_id: - Identifier for the batchPredictionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "onBatchprediction", [batch_prediction_id, account, region, partition]))

    @jsii.member(jsii_name="onDatasource")
    def on_datasource(
        self,
        datasource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Machinelearning":
        '''(experimental) Adds a resource of type datasource to the statement.

        https://docs.aws.amazon.com/machine-learning/latest/dg/amazon-machine-learning-key-concepts.html#datasources

        :param datasource_id: - Identifier for the datasourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "onDatasource", [datasource_id, account, region, partition]))

    @jsii.member(jsii_name="onEvaluation")
    def on_evaluation(
        self,
        evaluation_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Machinelearning":
        '''(experimental) Adds a resource of type evaluation to the statement.

        https://docs.aws.amazon.com/machine-learning/latest/dg/amazon-machine-learning-key-concepts.html#evaluations

        :param evaluation_id: - Identifier for the evaluationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "onEvaluation", [evaluation_id, account, region, partition]))

    @jsii.member(jsii_name="onMlmodel")
    def on_mlmodel(
        self,
        ml_model_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Machinelearning":
        '''(experimental) Adds a resource of type mlmodel to the statement.

        https://docs.aws.amazon.com/machine-learning/latest/dg/amazon-machine-learning-key-concepts.html#ml-models

        :param ml_model_id: - Identifier for the mlModelId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "onMlmodel", [ml_model_id, account, region, partition]))

    @jsii.member(jsii_name="toAddTags")
    def to_add_tags(self) -> "Machinelearning":
        '''(experimental) Adds one or more tags to an object, up to a limit of 10.

        Each tag consists of a key and an optional value

        Access Level: Tagging

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_AddTags.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toAddTags", []))

    @jsii.member(jsii_name="toCreateBatchPrediction")
    def to_create_batch_prediction(self) -> "Machinelearning":
        '''(experimental) Generates predictions for a group of observations.

        Access Level: Write

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_CreateBatchPrediction.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toCreateBatchPrediction", []))

    @jsii.member(jsii_name="toCreateDataSourceFromRDS")
    def to_create_data_source_from_rds(self) -> "Machinelearning":
        '''(experimental) Creates a DataSource object from an Amazon RDS.

        Access Level: Write

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_CreateDataSourceFromRDS.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toCreateDataSourceFromRDS", []))

    @jsii.member(jsii_name="toCreateDataSourceFromRedshift")
    def to_create_data_source_from_redshift(self) -> "Machinelearning":
        '''(experimental) Creates a DataSource from a database hosted on an Amazon Redshift cluster.

        Access Level: Write

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_CreateDataSourceFromRedshift.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toCreateDataSourceFromRedshift", []))

    @jsii.member(jsii_name="toCreateDataSourceFromS3")
    def to_create_data_source_from_s3(self) -> "Machinelearning":
        '''(experimental) Creates a DataSource object from S3.

        Access Level: Write

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_CreateDataSourceFromS3.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toCreateDataSourceFromS3", []))

    @jsii.member(jsii_name="toCreateEvaluation")
    def to_create_evaluation(self) -> "Machinelearning":
        '''(experimental) Creates a new Evaluation of an MLModel.

        Access Level: Write

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_CreateEvaluation.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toCreateEvaluation", []))

    @jsii.member(jsii_name="toCreateMLModel")
    def to_create_ml_model(self) -> "Machinelearning":
        '''(experimental) Creates a new MLModel.

        Access Level: Write

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_CreateMLModel.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toCreateMLModel", []))

    @jsii.member(jsii_name="toCreateRealtimeEndpoint")
    def to_create_realtime_endpoint(self) -> "Machinelearning":
        '''(experimental) Creates a real-time endpoint for the MLModel.

        Access Level: Write

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_CreateRealtimeEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toCreateRealtimeEndpoint", []))

    @jsii.member(jsii_name="toDeleteBatchPrediction")
    def to_delete_batch_prediction(self) -> "Machinelearning":
        '''(experimental) Assigns the DELETED status to a BatchPrediction, rendering it unusable.

        Access Level: Write

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_DeleteBatchPrediction.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toDeleteBatchPrediction", []))

    @jsii.member(jsii_name="toDeleteDataSource")
    def to_delete_data_source(self) -> "Machinelearning":
        '''(experimental) Assigns the DELETED status to a DataSource, rendering it unusable.

        Access Level: Write

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_DeleteDataSource.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toDeleteDataSource", []))

    @jsii.member(jsii_name="toDeleteEvaluation")
    def to_delete_evaluation(self) -> "Machinelearning":
        '''(experimental) Assigns the DELETED status to an Evaluation, rendering it unusable.

        Access Level: Write

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_DeleteEvaluation.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toDeleteEvaluation", []))

    @jsii.member(jsii_name="toDeleteMLModel")
    def to_delete_ml_model(self) -> "Machinelearning":
        '''(experimental) Assigns the DELETED status to an MLModel, rendering it unusable.

        Access Level: Write

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_DeleteMLModel.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toDeleteMLModel", []))

    @jsii.member(jsii_name="toDeleteRealtimeEndpoint")
    def to_delete_realtime_endpoint(self) -> "Machinelearning":
        '''(experimental) Deletes a real time endpoint of an MLModel.

        Access Level: Write

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_DeleteRealtimeEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toDeleteRealtimeEndpoint", []))

    @jsii.member(jsii_name="toDeleteTags")
    def to_delete_tags(self) -> "Machinelearning":
        '''(experimental) Deletes the specified tags associated with an ML object. After this operation is complete, you can't recover deleted tags.

        Access Level: Tagging

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_DeleteTags.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toDeleteTags", []))

    @jsii.member(jsii_name="toDescribeBatchPredictions")
    def to_describe_batch_predictions(self) -> "Machinelearning":
        '''(experimental) Returns a list of BatchPrediction operations that match the search criteria in the request.

        Access Level: List

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_DescribeBatchPredictions.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toDescribeBatchPredictions", []))

    @jsii.member(jsii_name="toDescribeDataSources")
    def to_describe_data_sources(self) -> "Machinelearning":
        '''(experimental) Returns a list of DataSource that match the search criteria in the request.

        Access Level: List

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_DescribeDataSources.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toDescribeDataSources", []))

    @jsii.member(jsii_name="toDescribeEvaluations")
    def to_describe_evaluations(self) -> "Machinelearning":
        '''(experimental) Returns a list of DescribeEvaluations that match the search criteria in the request.

        Access Level: List

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_DescribeEvaluations.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toDescribeEvaluations", []))

    @jsii.member(jsii_name="toDescribeMLModels")
    def to_describe_ml_models(self) -> "Machinelearning":
        '''(experimental) Returns a list of MLModel that match the search criteria in the request.

        Access Level: List

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_DescribeMLModels.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toDescribeMLModels", []))

    @jsii.member(jsii_name="toDescribeTags")
    def to_describe_tags(self) -> "Machinelearning":
        '''(experimental) Describes one or more of the tags for your Amazon ML object.

        Access Level: List

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_DescribeTags.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toDescribeTags", []))

    @jsii.member(jsii_name="toGetBatchPrediction")
    def to_get_batch_prediction(self) -> "Machinelearning":
        '''(experimental) Returns a BatchPrediction that includes detailed metadata, status, and data file information.

        Access Level: Read

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_GetBatchPrediction.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toGetBatchPrediction", []))

    @jsii.member(jsii_name="toGetDataSource")
    def to_get_data_source(self) -> "Machinelearning":
        '''(experimental) Returns a DataSource that includes metadata and data file information, as well as the current status of the DataSource.

        Access Level: Read

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_GetDataSource.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toGetDataSource", []))

    @jsii.member(jsii_name="toGetEvaluation")
    def to_get_evaluation(self) -> "Machinelearning":
        '''(experimental) Returns an Evaluation that includes metadata as well as the current status of the Evaluation.

        Access Level: Read

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_GetEvaluation.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toGetEvaluation", []))

    @jsii.member(jsii_name="toGetMLModel")
    def to_get_ml_model(self) -> "Machinelearning":
        '''(experimental) Returns an MLModel that includes detailed metadata, and data source information as well as the current status of the MLModel.

        Access Level: Read

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_GetMLModel.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toGetMLModel", []))

    @jsii.member(jsii_name="toPredict")
    def to_predict(self) -> "Machinelearning":
        '''(experimental) Generates a prediction for the observation using the specified ML Model.

        Access Level: Write

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_Predict.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toPredict", []))

    @jsii.member(jsii_name="toUpdateBatchPrediction")
    def to_update_batch_prediction(self) -> "Machinelearning":
        '''(experimental) Updates the BatchPredictionName of a BatchPrediction.

        Access Level: Write

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_UpdateBatchPrediction.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toUpdateBatchPrediction", []))

    @jsii.member(jsii_name="toUpdateDataSource")
    def to_update_data_source(self) -> "Machinelearning":
        '''(experimental) Updates the DataSourceName of a DataSource.

        Access Level: Write

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_UpdateDataSource.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toUpdateDataSource", []))

    @jsii.member(jsii_name="toUpdateEvaluation")
    def to_update_evaluation(self) -> "Machinelearning":
        '''(experimental) Updates the EvaluationName of an Evaluation.

        Access Level: Write

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_UpdateEvaluation.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toUpdateEvaluation", []))

    @jsii.member(jsii_name="toUpdateMLModel")
    def to_update_ml_model(self) -> "Machinelearning":
        '''(experimental) Updates the MLModelName and the ScoreThreshold of an MLModel.

        Access Level: Write

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_UpdateMLModel.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toUpdateMLModel", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Macie(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Macie"):
    '''(experimental) Statement provider for service `macie <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmacieclassic.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `macie <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmacieclassic.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Macie, self, [sid])

    @jsii.member(jsii_name="toAssociateMemberAccount")
    def to_associate_member_account(self) -> "Macie":
        '''(experimental) Enables the user to associate a specified AWS account with Amazon Macie as a member account.

        Access Level: Write

        https://docs.aws.amazon.com/macie/1.0/APIReference/API_AssociateMemberAccount.html

        :stability: experimental
        '''
        return typing.cast("Macie", jsii.invoke(self, "toAssociateMemberAccount", []))

    @jsii.member(jsii_name="toAssociateS3Resources")
    def to_associate_s3_resources(self) -> "Macie":
        '''(experimental) Enables the user to associate specified S3 resources with Amazon Macie for monitoring and data classification.

        Access Level: Write

        Possible conditions:

        - .ifAwsSourceArn()

        https://docs.aws.amazon.com/macie/1.0/APIReference/API_AssociateS3Resources.html

        :stability: experimental
        '''
        return typing.cast("Macie", jsii.invoke(self, "toAssociateS3Resources", []))

    @jsii.member(jsii_name="toDisassociateMemberAccount")
    def to_disassociate_member_account(self) -> "Macie":
        '''(experimental) Enables the user to remove the specified member account from Amazon Macie.

        Access Level: Write

        https://docs.aws.amazon.com/macie/1.0/APIReference/API_DisassociateMemberAccount.html

        :stability: experimental
        '''
        return typing.cast("Macie", jsii.invoke(self, "toDisassociateMemberAccount", []))

    @jsii.member(jsii_name="toDisassociateS3Resources")
    def to_disassociate_s3_resources(self) -> "Macie":
        '''(experimental) Enables the user to remove specified S3 resources from being monitored by Amazon Macie.

        Access Level: Write

        Possible conditions:

        - .ifAwsSourceArn()

        https://docs.aws.amazon.com/macie/1.0/APIReference/API_DisassociateS3Resources.html

        :stability: experimental
        '''
        return typing.cast("Macie", jsii.invoke(self, "toDisassociateS3Resources", []))

    @jsii.member(jsii_name="toListMemberAccounts")
    def to_list_member_accounts(self) -> "Macie":
        '''(experimental) Enables the user to list all Amazon Macie member accounts for the current Macie master account.

        Access Level: List

        https://docs.aws.amazon.com/macie/1.0/APIReference/API_ListMemberAccounts.html

        :stability: experimental
        '''
        return typing.cast("Macie", jsii.invoke(self, "toListMemberAccounts", []))

    @jsii.member(jsii_name="toListS3Resources")
    def to_list_s3_resources(self) -> "Macie":
        '''(experimental) Enables the user to list all the S3 resources associated with Amazon Macie.

        Access Level: List

        https://docs.aws.amazon.com/macie/1.0/APIReference/API_ListS3Resources.html

        :stability: experimental
        '''
        return typing.cast("Macie", jsii.invoke(self, "toListS3Resources", []))

    @jsii.member(jsii_name="toUpdateS3Resources")
    def to_update_s3_resources(self) -> "Macie":
        '''(experimental) Enables the user to update the classification types for the specified S3 resources.

        Access Level: Write

        Possible conditions:

        - .ifAwsSourceArn()

        https://docs.aws.amazon.com/macie/1.0/APIReference/API_UpdateS3Resources.html

        :stability: experimental
        '''
        return typing.cast("Macie", jsii.invoke(self, "toUpdateS3Resources", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Macie2(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Macie2"):
    '''(experimental) Statement provider for service `macie2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmacie.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `macie2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmacie.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Macie2, self, [sid])

    @jsii.member(jsii_name="onClassificationJob")
    def on_classification_job(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Macie2":
        '''(experimental) Adds a resource of type ClassificationJob to the statement.

        https://docs.aws.amazon.com/macie/latest/user/what-is-macie.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "onClassificationJob", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onCustomDataIdentifier")
    def on_custom_data_identifier(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Macie2":
        '''(experimental) Adds a resource of type CustomDataIdentifier to the statement.

        https://docs.aws.amazon.com/macie/latest/user/what-is-macie.html.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "onCustomDataIdentifier", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onFindingsFilter")
    def on_findings_filter(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Macie2":
        '''(experimental) Adds a resource of type FindingsFilter to the statement.

        https://docs.aws.amazon.com/macie/latest/user/what-is-macie.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "onFindingsFilter", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onMember")
    def on_member(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Macie2":
        '''(experimental) Adds a resource of type Member to the statement.

        https://docs.aws.amazon.com/macie/latest/user/what-is-macie.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "onMember", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toAcceptInvitation")
    def to_accept_invitation(self) -> "Macie2":
        '''(experimental) Grants permission to accept an Amazon Macie membership invitation.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/invitations-accept.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toAcceptInvitation", []))

    @jsii.member(jsii_name="toBatchGetCustomDataIdentifiers")
    def to_batch_get_custom_data_identifiers(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve information about one or more custom data identifiers.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/custom-data-identifiers-get.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toBatchGetCustomDataIdentifiers", []))

    @jsii.member(jsii_name="toCreateClassificationJob")
    def to_create_classification_job(self) -> "Macie2":
        '''(experimental) Grants permission to create and define the settings for a classification job.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/macie/latest/APIReference/jobs.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toCreateClassificationJob", []))

    @jsii.member(jsii_name="toCreateCustomDataIdentifier")
    def to_create_custom_data_identifier(self) -> "Macie2":
        '''(experimental) Grants permission to create and define the settings for a custom data identifier.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/macie/latest/APIReference/custom-data-identifiers.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toCreateCustomDataIdentifier", []))

    @jsii.member(jsii_name="toCreateFindingsFilter")
    def to_create_findings_filter(self) -> "Macie2":
        '''(experimental) Grants permission to create and define the settings for a findings filter.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/macie/latest/APIReference/findingsfilters.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toCreateFindingsFilter", []))

    @jsii.member(jsii_name="toCreateInvitations")
    def to_create_invitations(self) -> "Macie2":
        '''(experimental) Grants permission to send an Amazon Macie membership invitation.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/invitations.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toCreateInvitations", []))

    @jsii.member(jsii_name="toCreateMember")
    def to_create_member(self) -> "Macie2":
        '''(experimental) Grants permission to associate an account with an Amazon Macie master account.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/macie/latest/APIReference/members.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toCreateMember", []))

    @jsii.member(jsii_name="toCreateSampleFindings")
    def to_create_sample_findings(self) -> "Macie2":
        '''(experimental) Grants permission to create sample findings.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/findings-sample.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toCreateSampleFindings", []))

    @jsii.member(jsii_name="toDeclineInvitations")
    def to_decline_invitations(self) -> "Macie2":
        '''(experimental) Grants permission to decline Amazon Macie membership invitations.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/invitations-decline.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toDeclineInvitations", []))

    @jsii.member(jsii_name="toDeleteCustomDataIdentifier")
    def to_delete_custom_data_identifier(self) -> "Macie2":
        '''(experimental) Grants permission to delete a custom data identifier.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/custom-data-identifiers-id.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toDeleteCustomDataIdentifier", []))

    @jsii.member(jsii_name="toDeleteFindingsFilter")
    def to_delete_findings_filter(self) -> "Macie2":
        '''(experimental) Grants permission to delete a findings filter.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/findingsfilters-id.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toDeleteFindingsFilter", []))

    @jsii.member(jsii_name="toDeleteInvitations")
    def to_delete_invitations(self) -> "Macie2":
        '''(experimental) Grants permission to delete Amazon Macie membership invitations.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/invitations-delete.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toDeleteInvitations", []))

    @jsii.member(jsii_name="toDeleteMember")
    def to_delete_member(self) -> "Macie2":
        '''(experimental) Grants permission to delete the association between an Amazon Macie master account and an account.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/members-id.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toDeleteMember", []))

    @jsii.member(jsii_name="toDescribeBuckets")
    def to_describe_buckets(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve statistical and other data about S3 buckets that Amazon Macie monitors and analyzes.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/datasources-s3.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toDescribeBuckets", []))

    @jsii.member(jsii_name="toDescribeClassificationJob")
    def to_describe_classification_job(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve information about the status and settings for a classification job.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/jobs-jobid.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toDescribeClassificationJob", []))

    @jsii.member(jsii_name="toDescribeOrganizationConfiguration")
    def to_describe_organization_configuration(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve information about the Amazon Macie configuration settings for an AWS organization.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/admin-configuration.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toDescribeOrganizationConfiguration", []))

    @jsii.member(jsii_name="toDisableMacie")
    def to_disable_macie(self) -> "Macie2":
        '''(experimental) Grants permission to disable an Amazon Macie account, which also deletes Macie resources for the account.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/macie.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toDisableMacie", []))

    @jsii.member(jsii_name="toDisableOrganizationAdminAccount")
    def to_disable_organization_admin_account(self) -> "Macie2":
        '''(experimental) Grants permission to disable an account as a delegated administrator of Amazon Macie for an AWS organization.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/admin.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toDisableOrganizationAdminAccount", []))

    @jsii.member(jsii_name="toDisassociateFromMasterAccount")
    def to_disassociate_from_master_account(self) -> "Macie2":
        '''(experimental) Grants an Amazon Macie member account with permission to disassociate from its master account.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/master-disassociate.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toDisassociateFromMasterAccount", []))

    @jsii.member(jsii_name="toDisassociateMember")
    def to_disassociate_member(self) -> "Macie2":
        '''(experimental) Grants an Amazon Macie master account with permission to disassociate from a member account.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/members-disassociate-id.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toDisassociateMember", []))

    @jsii.member(jsii_name="toEnableMacie")
    def to_enable_macie(self) -> "Macie2":
        '''(experimental) Grants permission to enable and specify the configuration settings for a new Amazon Macie account.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/macie.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toEnableMacie", []))

    @jsii.member(jsii_name="toEnableOrganizationAdminAccount")
    def to_enable_organization_admin_account(self) -> "Macie2":
        '''(experimental) Grants permission to enable an account as a delegated administrator of Amazon Macie for an AWS organization.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/admin.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toEnableOrganizationAdminAccount", []))

    @jsii.member(jsii_name="toGetBucketStatistics")
    def to_get_bucket_statistics(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve aggregated statistical data for all the S3 buckets that Amazon Macie monitors and analyzes.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/datasources-s3-statistics.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toGetBucketStatistics", []))

    @jsii.member(jsii_name="toGetClassificationExportConfiguration")
    def to_get_classification_export_configuration(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve the settings for exporting data classification results.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/classification-export-configuration.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toGetClassificationExportConfiguration", []))

    @jsii.member(jsii_name="toGetCustomDataIdentifier")
    def to_get_custom_data_identifier(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve information about the settings for a custom data identifier.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/custom-data-identifiers-id.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toGetCustomDataIdentifier", []))

    @jsii.member(jsii_name="toGetFindings")
    def to_get_findings(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve information about one or more findings.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/findings-describe.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toGetFindings", []))

    @jsii.member(jsii_name="toGetFindingsFilter")
    def to_get_findings_filter(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve information about the settings for a findings filter.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/findingsfilters-id.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toGetFindingsFilter", []))

    @jsii.member(jsii_name="toGetFindingStatistics")
    def to_get_finding_statistics(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve aggregated statistical data about findings.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/findings-statistics.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toGetFindingStatistics", []))

    @jsii.member(jsii_name="toGetInvitationsCount")
    def to_get_invitations_count(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve the count of Amazon Macie membership invitations that were received by an account.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/invitations-count.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toGetInvitationsCount", []))

    @jsii.member(jsii_name="toGetMacieSession")
    def to_get_macie_session(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve information about the status and configuration settings for an Amazon Macie account.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/macie.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toGetMacieSession", []))

    @jsii.member(jsii_name="toGetMasterAccount")
    def to_get_master_account(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve information about the Amazon Macie master account for an account.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/master.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toGetMasterAccount", []))

    @jsii.member(jsii_name="toGetMember")
    def to_get_member(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve information about an account that's associated with an Amazon Macie master account.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/members-id.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toGetMember", []))

    @jsii.member(jsii_name="toGetUsageStatistics")
    def to_get_usage_statistics(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve quotas and aggregated usage data for one or more accounts.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/usage-statistics.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toGetUsageStatistics", []))

    @jsii.member(jsii_name="toGetUsageTotals")
    def to_get_usage_totals(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve aggregated usage data for an account.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/usage.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toGetUsageTotals", []))

    @jsii.member(jsii_name="toListClassificationJobs")
    def to_list_classification_jobs(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve information about the status and settings for one or more classification jobs.

        Access Level: List

        https://docs.aws.amazon.com/macie/latest/APIReference/jobs-list.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toListClassificationJobs", []))

    @jsii.member(jsii_name="toListCustomDataIdentifiers")
    def to_list_custom_data_identifiers(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve information about all custom data identifiers.

        Access Level: List

        https://docs.aws.amazon.com/macie/latest/APIReference/custom-data-identifiers-list.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toListCustomDataIdentifiers", []))

    @jsii.member(jsii_name="toListFindings")
    def to_list_findings(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve a subset of information about one or more findings.

        Access Level: List

        https://docs.aws.amazon.com/macie/latest/APIReference/findings.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toListFindings", []))

    @jsii.member(jsii_name="toListFindingsFilters")
    def to_list_findings_filters(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve information about all findings filters.

        Access Level: List

        https://docs.aws.amazon.com/macie/latest/APIReference/findingsfilters.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toListFindingsFilters", []))

    @jsii.member(jsii_name="toListInvitations")
    def to_list_invitations(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve information about all the Amazon Macie membership invitations that were received by an account.

        Access Level: List

        https://docs.aws.amazon.com/macie/latest/APIReference/invitations.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toListInvitations", []))

    @jsii.member(jsii_name="toListMembers")
    def to_list_members(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve information about all the accounts that are associated with an Amazon Macie master account.

        Access Level: List

        https://docs.aws.amazon.com/macie/latest/APIReference/members.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toListMembers", []))

    @jsii.member(jsii_name="toListOrganizationAdminAccounts")
    def to_list_organization_admin_accounts(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve information about the delegated, Amazon Macie administrator account for an AWS organization.

        Access Level: List

        https://docs.aws.amazon.com/macie/latest/APIReference/admin.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toListOrganizationAdminAccounts", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve the tags for an Amazon Macie resource or member account.

        Access Level: List

        https://docs.aws.amazon.com/macie/latest/APIReference/tags-resourcearn.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutClassificationExportConfiguration")
    def to_put_classification_export_configuration(self) -> "Macie2":
        '''(experimental) Grants permission to create or update the settings for exporting data classification results.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/classification-export-configuration.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toPutClassificationExportConfiguration", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Macie2":
        '''(experimental) Grants permission to add or update the tags for an Amazon Macie resource or member account.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/macie/latest/APIReference/tags-resourcearn.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTestCustomDataIdentifier")
    def to_test_custom_data_identifier(self) -> "Macie2":
        '''(experimental) Grants permission to test a custom data identifier.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/custom-data-identifiers-test.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toTestCustomDataIdentifier", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Macie2":
        '''(experimental) Grants permission to remove tags from an Amazon Macie resource or member account.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/macie/latest/APIReference/tags-resourcearn.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateClassificationJob")
    def to_update_classification_job(self) -> "Macie2":
        '''(experimental) Grants permission to cancel a classification job.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/macie/latest/APIReference/jobs-jobid.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toUpdateClassificationJob", []))

    @jsii.member(jsii_name="toUpdateFindingsFilter")
    def to_update_findings_filter(self) -> "Macie2":
        '''(experimental) Grants permission to update the settings for a findings filter.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/macie/latest/APIReference/findingsfilters-id.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toUpdateFindingsFilter", []))

    @jsii.member(jsii_name="toUpdateMacieSession")
    def to_update_macie_session(self) -> "Macie2":
        '''(experimental) Grants permission to suspend or re-enable an Amazon Macie account, or update the configuration settings for a Macie account.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/macie.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toUpdateMacieSession", []))

    @jsii.member(jsii_name="toUpdateMemberSession")
    def to_update_member_session(self) -> "Macie2":
        '''(experimental) Grants an Amazon Macie master account with permission to suspend or re-enable a member account.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/macie-members-id.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toUpdateMemberSession", []))

    @jsii.member(jsii_name="toUpdateOrganizationConfiguration")
    def to_update_organization_configuration(self) -> "Macie2":
        '''(experimental) Grants permission to update Amazon Macie configuration settings for an AWS organization.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/admin-configuration.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toUpdateOrganizationConfiguration", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Managedblockchain(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Managedblockchain",
):
    '''(experimental) Statement provider for service `managedblockchain <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmanagedblockchain.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `managedblockchain <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmanagedblockchain.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Managedblockchain, self, [sid])

    @jsii.member(jsii_name="onInvitation")
    def on_invitation(
        self,
        invitation_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Managedblockchain":
        '''(experimental) Adds a resource of type invitation to the statement.

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_Invitation.html

        :param invitation_id: - Identifier for the invitationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "onInvitation", [invitation_id, account, region, partition]))

    @jsii.member(jsii_name="onMember")
    def on_member(
        self,
        member_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Managedblockchain":
        '''(experimental) Adds a resource of type member to the statement.

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_Member.html

        :param member_id: - Identifier for the memberId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "onMember", [member_id, account, region, partition]))

    @jsii.member(jsii_name="onNetwork")
    def on_network(
        self,
        network_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Managedblockchain":
        '''(experimental) Adds a resource of type network to the statement.

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_Network.html

        :param network_id: - Identifier for the networkId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "onNetwork", [network_id, region, partition]))

    @jsii.member(jsii_name="onNode")
    def on_node(
        self,
        node_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Managedblockchain":
        '''(experimental) Adds a resource of type node to the statement.

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_Node.html

        :param node_id: - Identifier for the nodeId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "onNode", [node_id, account, region, partition]))

    @jsii.member(jsii_name="onProposal")
    def on_proposal(
        self,
        proposal_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Managedblockchain":
        '''(experimental) Adds a resource of type proposal to the statement.

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_Proposal.html

        :param proposal_id: - Identifier for the proposalId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "onProposal", [proposal_id, region, partition]))

    @jsii.member(jsii_name="toCreateMember")
    def to_create_member(self) -> "Managedblockchain":
        '''(experimental) Grants permission to create a member of an Amazon Managed Blockchain network.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_CreateMember.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toCreateMember", []))

    @jsii.member(jsii_name="toCreateNetwork")
    def to_create_network(self) -> "Managedblockchain":
        '''(experimental) Grants permission to create an Amazon Managed Blockchain network.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_CreateNetwork.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toCreateNetwork", []))

    @jsii.member(jsii_name="toCreateNode")
    def to_create_node(self) -> "Managedblockchain":
        '''(experimental) Grants permission to create a node within a member of an Amazon Managed Blockchain network.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_CreateNode.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toCreateNode", []))

    @jsii.member(jsii_name="toCreateProposal")
    def to_create_proposal(self) -> "Managedblockchain":
        '''(experimental) Grants permission to create a proposal that other blockchain network members can vote on to add or remove a member in an Amazon Managed Blockchain network.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_CreateProposal.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toCreateProposal", []))

    @jsii.member(jsii_name="toDeleteMember")
    def to_delete_member(self) -> "Managedblockchain":
        '''(experimental) Grants permission to delete a member and all associated resources from an Amazon Managed Blockchain network.

        Access Level: Write

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_DeleteMember.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toDeleteMember", []))

    @jsii.member(jsii_name="toDeleteNode")
    def to_delete_node(self) -> "Managedblockchain":
        '''(experimental) Grants permission to delete a node from a member of an Amazon Managed Blockchain network.

        Access Level: Write

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_DeleteNode.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toDeleteNode", []))

    @jsii.member(jsii_name="toGetMember")
    def to_get_member(self) -> "Managedblockchain":
        '''(experimental) Grants permission to return detailed information about a member of an Amazon Managed Blockchain network.

        Access Level: Read

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_GetMember.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toGetMember", []))

    @jsii.member(jsii_name="toGetNetwork")
    def to_get_network(self) -> "Managedblockchain":
        '''(experimental) Grants permission to return detailed information about an Amazon Managed Blockchain network.

        Access Level: Read

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_GetNetwork.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toGetNetwork", []))

    @jsii.member(jsii_name="toGetNode")
    def to_get_node(self) -> "Managedblockchain":
        '''(experimental) Grants permission to return detailed information about a node within a member of an Amazon Managed Blockchain network.

        Access Level: Read

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_GetNode.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toGetNode", []))

    @jsii.member(jsii_name="toGetProposal")
    def to_get_proposal(self) -> "Managedblockchain":
        '''(experimental) Grants permission to return detailed information about a proposal of an Amazon Managed Blockchain network.

        Access Level: Read

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_GetProposal.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toGetProposal", []))

    @jsii.member(jsii_name="toListInvitations")
    def to_list_invitations(self) -> "Managedblockchain":
        '''(experimental) Grants permission to list the invitations extended to the active AWS account from any Managed Blockchain network.

        Access Level: List

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_ListInvitations.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toListInvitations", []))

    @jsii.member(jsii_name="toListMembers")
    def to_list_members(self) -> "Managedblockchain":
        '''(experimental) Grants permission to list the members of an Amazon Managed Blockchain network and the properties of their memberships.

        Access Level: List

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_ListMembers.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toListMembers", []))

    @jsii.member(jsii_name="toListNetworks")
    def to_list_networks(self) -> "Managedblockchain":
        '''(experimental) Grants permission to list the Amazon Managed Blockchain networks in which the current AWS account participates.

        Access Level: List

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_ListNetworks.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toListNetworks", []))

    @jsii.member(jsii_name="toListNodes")
    def to_list_nodes(self) -> "Managedblockchain":
        '''(experimental) Grants permission to list the nodes within a member of an Amazon Managed Blockchain network.

        Access Level: List

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_ListNodes.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toListNodes", []))

    @jsii.member(jsii_name="toListProposals")
    def to_list_proposals(self) -> "Managedblockchain":
        '''(experimental) Grants permission to list proposals for the given Amazon Managed Blockchain network.

        Access Level: List

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_ListProposals.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toListProposals", []))

    @jsii.member(jsii_name="toListProposalVotes")
    def to_list_proposal_votes(self) -> "Managedblockchain":
        '''(experimental) Grants permission to list all votes for a proposal, including the value of the vote and the unique identifier of the member that cast the vote for the given Amazon Managed Blockchain network.

        Access Level: Read

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_ListProposalVotes.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toListProposalVotes", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Managedblockchain":
        '''(experimental) Grants permission to view tags associated with an Amazon Managed Blockchain resource.

        Access Level: Read

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toRejectInvitation")
    def to_reject_invitation(self) -> "Managedblockchain":
        '''(experimental) Grants permission to reject the invitation to join the blockchain network.

        Access Level: Write

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_RejectInvitation.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toRejectInvitation", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Managedblockchain":
        '''(experimental) Grants permission to add tags to an Amazon Managed Blockchain resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Managedblockchain":
        '''(experimental) Grants permission to remove tags from an Amazon Managed Blockchain resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateMember")
    def to_update_member(self) -> "Managedblockchain":
        '''(experimental) Grants permission to update a member of an Amazon Managed Blockchain network.

        Access Level: Write

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_UpdateMember.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toUpdateMember", []))

    @jsii.member(jsii_name="toUpdateNode")
    def to_update_node(self) -> "Managedblockchain":
        '''(experimental) Grants permission to update a node from a member of an Amazon Managed Blockchain network.

        Access Level: Write

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_UpdateNode.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toUpdateNode", []))

    @jsii.member(jsii_name="toVoteOnProposal")
    def to_vote_on_proposal(self) -> "Managedblockchain":
        '''(experimental) Grants permission to cast a vote for a proposal on behalf of the blockchain network member specified.

        Access Level: Write

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_VoteOnProposal.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toVoteOnProposal", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Marketplacecommerceanalytics(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Marketplacecommerceanalytics",
):
    '''(experimental) Statement provider for service `marketplacecommerceanalytics <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplacecommerceanalyticsservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `marketplacecommerceanalytics <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplacecommerceanalyticsservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Marketplacecommerceanalytics, self, [sid])

    @jsii.member(jsii_name="toGenerateDataSet")
    def to_generate_data_set(self) -> "Marketplacecommerceanalytics":
        '''(experimental) Request a data set to be published to your Amazon S3 bucket.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Marketplacecommerceanalytics", jsii.invoke(self, "toGenerateDataSet", []))

    @jsii.member(jsii_name="toStartSupportDataExport")
    def to_start_support_data_export(self) -> "Marketplacecommerceanalytics":
        '''(experimental) Request a support data set to be published to your Amazon S3 bucket.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Marketplacecommerceanalytics", jsii.invoke(self, "toStartSupportDataExport", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Mechanicalturk(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Mechanicalturk",
):
    '''(experimental) Statement provider for service `mechanicalturk <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmechanicalturk.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `mechanicalturk <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmechanicalturk.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Mechanicalturk, self, [sid])

    @jsii.member(jsii_name="toAcceptQualificationRequest")
    def to_accept_qualification_request(self) -> "Mechanicalturk":
        '''(experimental) The AcceptQualificationRequest operation grants a Worker's request for a Qualification.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_AcceptQualificationRequestOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toAcceptQualificationRequest", []))

    @jsii.member(jsii_name="toApproveAssignment")
    def to_approve_assignment(self) -> "Mechanicalturk":
        '''(experimental) The ApproveAssignment operation approves the results of a completed assignment.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_ApproveAssignmentOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toApproveAssignment", []))

    @jsii.member(jsii_name="toAssociateQualificationWithWorker")
    def to_associate_qualification_with_worker(self) -> "Mechanicalturk":
        '''(experimental) The AssociateQualificationWithWorker operation gives a Worker a Qualification.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_AssociateQualificationWithWorkerOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toAssociateQualificationWithWorker", []))

    @jsii.member(jsii_name="toCreateAdditionalAssignmentsForHIT")
    def to_create_additional_assignments_for_hit(self) -> "Mechanicalturk":
        '''(experimental) The CreateAdditionalAssignmentsForHIT operation increases the maximum number of assignments of an existing HIT.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_CreateAdditionalAssignmentsForHITOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toCreateAdditionalAssignmentsForHIT", []))

    @jsii.member(jsii_name="toCreateHIT")
    def to_create_hit(self) -> "Mechanicalturk":
        '''(experimental) The CreateHIT operation creates a new HIT (Human Intelligence Task).

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_CreateHITOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toCreateHIT", []))

    @jsii.member(jsii_name="toCreateHITType")
    def to_create_hit_type(self) -> "Mechanicalturk":
        '''(experimental) The CreateHITType operation creates a new HIT type.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_CreateHITTypeOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toCreateHITType", []))

    @jsii.member(jsii_name="toCreateHITWithHITType")
    def to_create_hit_with_hit_type(self) -> "Mechanicalturk":
        '''(experimental) The CreateHITWithHITType operation creates a new Human Intelligence Task (HIT) using an existing HITTypeID generated by the CreateHITType operation.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_CreateHITWithHITTypeOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toCreateHITWithHITType", []))

    @jsii.member(jsii_name="toCreateQualificationType")
    def to_create_qualification_type(self) -> "Mechanicalturk":
        '''(experimental) The CreateQualificationType operation creates a new Qualification type, which is represented by a QualificationType data structure.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_CreateQualificationTypeOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toCreateQualificationType", []))

    @jsii.member(jsii_name="toCreateWorkerBlock")
    def to_create_worker_block(self) -> "Mechanicalturk":
        '''(experimental) The CreateWorkerBlock operation allows you to prevent a Worker from working on your HITs.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_CreateWorkerBlockOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toCreateWorkerBlock", []))

    @jsii.member(jsii_name="toDeleteHIT")
    def to_delete_hit(self) -> "Mechanicalturk":
        '''(experimental) The DeleteHIT operation disposes of a HIT that is no longer needed.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_DeleteHITOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toDeleteHIT", []))

    @jsii.member(jsii_name="toDeleteQualificationType")
    def to_delete_qualification_type(self) -> "Mechanicalturk":
        '''(experimental) The DeleteQualificationType disposes a Qualification type and disposes any HIT types that are associated with the Qualification type.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_DeleteQualificationTypeOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toDeleteQualificationType", []))

    @jsii.member(jsii_name="toDeleteWorkerBlock")
    def to_delete_worker_block(self) -> "Mechanicalturk":
        '''(experimental) The DeleteWorkerBlock operation allows you to reinstate a blocked Worker to work on your HITs.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_DeleteWorkerBlockOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toDeleteWorkerBlock", []))

    @jsii.member(jsii_name="toDisassociateQualificationFromWorker")
    def to_disassociate_qualification_from_worker(self) -> "Mechanicalturk":
        '''(experimental) The DisassociateQualificationFromWorker revokes a previously granted Qualification from a user.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_DisassociateQualificationFromWorkerOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toDisassociateQualificationFromWorker", []))

    @jsii.member(jsii_name="toGetAccountBalance")
    def to_get_account_balance(self) -> "Mechanicalturk":
        '''(experimental) The GetAccountBalance operation retrieves the amount of money in your Amazon Mechanical Turk account.

        Access Level: Read

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_GetAccountBalanceOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toGetAccountBalance", []))

    @jsii.member(jsii_name="toGetAssignment")
    def to_get_assignment(self) -> "Mechanicalturk":
        '''(experimental) The GetAssignment retrieves an assignment with an AssignmentStatus value of Submitted, Approved, or Rejected, using the assignment's ID.

        Access Level: Read

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_GetAssignmentOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toGetAssignment", []))

    @jsii.member(jsii_name="toGetFileUploadURL")
    def to_get_file_upload_url(self) -> "Mechanicalturk":
        '''(experimental) The GetFileUploadURL operation generates and returns a temporary URL.

        Access Level: Read

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_GetFileUploadURLOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toGetFileUploadURL", []))

    @jsii.member(jsii_name="toGetHIT")
    def to_get_hit(self) -> "Mechanicalturk":
        '''(experimental) The GetHIT operation retrieves the details of the specified HIT.

        Access Level: Read

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_GetHITOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toGetHIT", []))

    @jsii.member(jsii_name="toGetQualificationScore")
    def to_get_qualification_score(self) -> "Mechanicalturk":
        '''(experimental) The GetQualificationScore operation returns the value of a Worker's Qualification for a given Qualification type.

        Access Level: Read

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_GetQualificationScoreOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toGetQualificationScore", []))

    @jsii.member(jsii_name="toGetQualificationType")
    def to_get_qualification_type(self) -> "Mechanicalturk":
        '''(experimental) The GetQualificationType operation retrieves information about a Qualification type using its ID.

        Access Level: Read

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_GetQualificationTypeOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toGetQualificationType", []))

    @jsii.member(jsii_name="toListAssignmentsForHIT")
    def to_list_assignments_for_hit(self) -> "Mechanicalturk":
        '''(experimental) The ListAssignmentsForHIT operation retrieves completed assignments for a HIT.

        Access Level: List

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_ListAssignmentsForHITOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toListAssignmentsForHIT", []))

    @jsii.member(jsii_name="toListBonusPayments")
    def to_list_bonus_payments(self) -> "Mechanicalturk":
        '''(experimental) The ListBonusPayments operation retrieves the amounts of bonuses you have paid to Workers for a given HIT or assignment.

        Access Level: List

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_ListBonusPaymentsOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toListBonusPayments", []))

    @jsii.member(jsii_name="toListHITs")
    def to_list_hi_ts(self) -> "Mechanicalturk":
        '''(experimental) The ListHITs operation returns all of a Requester's HITs.

        Access Level: List

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_ListHITsOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toListHITs", []))

    @jsii.member(jsii_name="toListHITsForQualificationType")
    def to_list_hi_ts_for_qualification_type(self) -> "Mechanicalturk":
        '''(experimental) The ListHITsForQualificationType operation returns the HITs that use the given QualififcationType for a QualificationRequirement.

        Access Level: List

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_ListHITsForQualificationTypeOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toListHITsForQualificationType", []))

    @jsii.member(jsii_name="toListQualificationRequests")
    def to_list_qualification_requests(self) -> "Mechanicalturk":
        '''(experimental) The ListQualificationRequests operation retrieves requests for Qualifications of a particular Qualification type.

        Access Level: List

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_ListQualificationRequestsOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toListQualificationRequests", []))

    @jsii.member(jsii_name="toListQualificationTypes")
    def to_list_qualification_types(self) -> "Mechanicalturk":
        '''(experimental) The ListQualificationTypes operation searches for Qualification types using the specified search query, and returns a list of Qualification types.

        Access Level: List

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_ListQualificationTypesOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toListQualificationTypes", []))

    @jsii.member(jsii_name="toListReviewableHITs")
    def to_list_reviewable_hi_ts(self) -> "Mechanicalturk":
        '''(experimental) The ListReviewableHITs operation returns all of a Requester's HITs that have not been approved or rejected.

        Access Level: List

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_ListReviewableHITsOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toListReviewableHITs", []))

    @jsii.member(jsii_name="toListReviewPolicyResultsForHIT")
    def to_list_review_policy_results_for_hit(self) -> "Mechanicalturk":
        '''(experimental) The ListReviewPolicyResultsForHIT operation retrieves the computed results and the actions taken in the course of executing your Review Policies during a CreateHIT operation.

        Access Level: List

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_ListReviewPolicyResultsForHITOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toListReviewPolicyResultsForHIT", []))

    @jsii.member(jsii_name="toListWorkerBlocks")
    def to_list_worker_blocks(self) -> "Mechanicalturk":
        '''(experimental) The ListWorkersBlocks operation retrieves a list of Workers who are blocked from working on your HITs.

        Access Level: List

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_ListWorkerBlocksOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toListWorkerBlocks", []))

    @jsii.member(jsii_name="toListWorkersWithQualificationType")
    def to_list_workers_with_qualification_type(self) -> "Mechanicalturk":
        '''(experimental) The ListWorkersWithQualificationType operation returns all of the Workers with a given Qualification type.

        Access Level: List

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_ListWorkersWithQualificationTypeOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toListWorkersWithQualificationType", []))

    @jsii.member(jsii_name="toNotifyWorkers")
    def to_notify_workers(self) -> "Mechanicalturk":
        '''(experimental) The NotifyWorkers operation sends an email to one or more Workers that you specify with the Worker ID.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_NotifyWorkersOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toNotifyWorkers", []))

    @jsii.member(jsii_name="toRejectAssignment")
    def to_reject_assignment(self) -> "Mechanicalturk":
        '''(experimental) The RejectAssignment operation rejects the results of a completed assignment.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_RejectAssignmentOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toRejectAssignment", []))

    @jsii.member(jsii_name="toRejectQualificationRequest")
    def to_reject_qualification_request(self) -> "Mechanicalturk":
        '''(experimental) The RejectQualificationRequest operation rejects a user's request for a Qualification.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_RejectQualificationRequestOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toRejectQualificationRequest", []))

    @jsii.member(jsii_name="toSendBonus")
    def to_send_bonus(self) -> "Mechanicalturk":
        '''(experimental) The SendBonus operation issues a payment of money from your account to a Worker.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_SendBonusOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toSendBonus", []))

    @jsii.member(jsii_name="toSendTestEventNotification")
    def to_send_test_event_notification(self) -> "Mechanicalturk":
        '''(experimental) The SendTestEventNotification operation causes Amazon Mechanical Turk to send a notification message as if a HIT event occurred, according to the provided notification specification.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_SendTestEventNotificationOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toSendTestEventNotification", []))

    @jsii.member(jsii_name="toUpdateExpirationForHIT")
    def to_update_expiration_for_hit(self) -> "Mechanicalturk":
        '''(experimental) The UpdateExpirationForHIT operation allows you extend the expiration time of a HIT beyond is current expiration or expire a HIT immediately.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_UpdateExpirationForHITOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toUpdateExpirationForHIT", []))

    @jsii.member(jsii_name="toUpdateHITReviewStatus")
    def to_update_hit_review_status(self) -> "Mechanicalturk":
        '''(experimental) The UpdateHITReviewStatus operation toggles the status of a HIT.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_UpdateHITReviewStatusOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toUpdateHITReviewStatus", []))

    @jsii.member(jsii_name="toUpdateHITTypeOfHIT")
    def to_update_hit_type_of_hit(self) -> "Mechanicalturk":
        '''(experimental) The UpdateHITTypeOfHIT operation allows you to change the HITType properties of a HIT.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_UpdateHITTypeOfHITOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toUpdateHITTypeOfHIT", []))

    @jsii.member(jsii_name="toUpdateNotificationSettings")
    def to_update_notification_settings(self) -> "Mechanicalturk":
        '''(experimental) The UpdateNotificationSettings operation creates, updates, disables or re-enables notifications for a HIT type.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_UpdateNotificationSettingsOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toUpdateNotificationSettings", []))

    @jsii.member(jsii_name="toUpdateQualificationType")
    def to_update_qualification_type(self) -> "Mechanicalturk":
        '''(experimental) The UpdateQualificationType operation modifies the attributes of an existing Qualification type, which is represented by a QualificationType data structure.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_UpdateQualificationTypeOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toUpdateQualificationType", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Mediaconnect(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Mediaconnect",
):
    '''(experimental) Statement provider for service `mediaconnect <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalmediaconnect.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `mediaconnect <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalmediaconnect.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Mediaconnect, self, [sid])

    @jsii.member(jsii_name="onEntitlement")
    def on_entitlement(
        self,
        flow_id: builtins.str,
        entitlement_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mediaconnect":
        '''(experimental) Adds a resource of type Entitlement to the statement.

        https://docs.aws.amazon.com/mediaconnect/latest/ug/entitlements.html

        :param flow_id: - Identifier for the flowId.
        :param entitlement_name: - Identifier for the entitlementName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "onEntitlement", [flow_id, entitlement_name, account, region, partition]))

    @jsii.member(jsii_name="onFlow")
    def on_flow(
        self,
        flow_id: builtins.str,
        flow_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mediaconnect":
        '''(experimental) Adds a resource of type Flow to the statement.

        https://docs.aws.amazon.com/mediaconnect/latest/ug/flows.html

        :param flow_id: - Identifier for the flowId.
        :param flow_name: - Identifier for the flowName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "onFlow", [flow_id, flow_name, account, region, partition]))

    @jsii.member(jsii_name="onOutput")
    def on_output(
        self,
        output_id: builtins.str,
        output_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mediaconnect":
        '''(experimental) Adds a resource of type Output to the statement.

        https://docs.aws.amazon.com/mediaconnect/latest/ug/outputs.html

        :param output_id: - Identifier for the outputId.
        :param output_name: - Identifier for the outputName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "onOutput", [output_id, output_name, account, region, partition]))

    @jsii.member(jsii_name="onSource")
    def on_source(
        self,
        source_id: builtins.str,
        source_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mediaconnect":
        '''(experimental) Adds a resource of type Source to the statement.

        https://docs.aws.amazon.com/mediaconnect/latest/ug/sources.html

        :param source_id: - Identifier for the sourceId.
        :param source_name: - Identifier for the sourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "onSource", [source_id, source_name, account, region, partition]))

    @jsii.member(jsii_name="toAddFlowOutputs")
    def to_add_flow_outputs(self) -> "Mediaconnect":
        '''(experimental) Grants permission to add outputs to any flow.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-flows-flowarn-outputs.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toAddFlowOutputs", []))

    @jsii.member(jsii_name="toCreateFlow")
    def to_create_flow(self) -> "Mediaconnect":
        '''(experimental) Grants permission to create flows.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-flows.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toCreateFlow", []))

    @jsii.member(jsii_name="toDeleteFlow")
    def to_delete_flow(self) -> "Mediaconnect":
        '''(experimental) Grants permission to delete flows.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-flows-flowarn.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toDeleteFlow", []))

    @jsii.member(jsii_name="toDescribeFlow")
    def to_describe_flow(self) -> "Mediaconnect":
        '''(experimental) Grants permission to display the details of a flow including the flow ARN, name, and Availability Zone, as well as details about the source, outputs, and entitlements.

        Access Level: Read

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-flows-flowarn.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toDescribeFlow", []))

    @jsii.member(jsii_name="toGrantFlowEntitlements")
    def to_grant_flow_entitlements(self) -> "Mediaconnect":
        '''(experimental) Grants permission to grant entitlements on any flow.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-flows-flowarn-entitlements.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toGrantFlowEntitlements", []))

    @jsii.member(jsii_name="toListEntitlements")
    def to_list_entitlements(self) -> "Mediaconnect":
        '''(experimental) Grants permission to display a list of all entitlements that have been granted to the account.

        Access Level: List

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-entitlements.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toListEntitlements", []))

    @jsii.member(jsii_name="toListFlows")
    def to_list_flows(self) -> "Mediaconnect":
        '''(experimental) Grants permission to display a list of flows that are associated with this account.

        Access Level: List

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-flows.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toListFlows", []))

    @jsii.member(jsii_name="toRemoveFlowOutput")
    def to_remove_flow_output(self) -> "Mediaconnect":
        '''(experimental) Grants permission to remove outputs from any flow.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-flows-flowarn-outputs-outputarn.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toRemoveFlowOutput", []))

    @jsii.member(jsii_name="toRevokeFlowEntitlement")
    def to_revoke_flow_entitlement(self) -> "Mediaconnect":
        '''(experimental) Grants permission to revoke entitlements on any flow.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-flows-flowarn-entitlements-entitlementarn.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toRevokeFlowEntitlement", []))

    @jsii.member(jsii_name="toStartFlow")
    def to_start_flow(self) -> "Mediaconnect":
        '''(experimental) Grants permission to start flows.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-flows-start-flowarn.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toStartFlow", []))

    @jsii.member(jsii_name="toStopFlow")
    def to_stop_flow(self) -> "Mediaconnect":
        '''(experimental) Grants permission to stop flows.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-flows-stop-flowarn.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toStopFlow", []))

    @jsii.member(jsii_name="toUpdateFlowEntitlement")
    def to_update_flow_entitlement(self) -> "Mediaconnect":
        '''(experimental) Grants permission to update entitlements on any flow.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-flows-flowarn-entitlements-entitlementarn.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toUpdateFlowEntitlement", []))

    @jsii.member(jsii_name="toUpdateFlowOutput")
    def to_update_flow_output(self) -> "Mediaconnect":
        '''(experimental) Grants permission to update outputs on any flow.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-flows-flowarn-outputs-outputarn.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toUpdateFlowOutput", []))

    @jsii.member(jsii_name="toUpdateFlowSource")
    def to_update_flow_source(self) -> "Mediaconnect":
        '''(experimental) Grants permission to update the source of any flow.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-flows-flowarn-source-sourcearn.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toUpdateFlowSource", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Mediaconvert(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Mediaconvert",
):
    '''(experimental) Statement provider for service `mediaconvert <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalmediaconvert.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `mediaconvert <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalmediaconvert.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Mediaconvert, self, [sid])

    @jsii.member(jsii_name="onCertificateAssociation")
    def on_certificate_association(
        self,
        certificate_arn: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mediaconvert":
        '''(experimental) Adds a resource of type CertificateAssociation to the statement.

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/certificates.html

        :param certificate_arn: - Identifier for the certificateArn.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "onCertificateAssociation", [certificate_arn, account, region, partition]))

    @jsii.member(jsii_name="onJob")
    def on_job(
        self,
        job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mediaconvert":
        '''(experimental) Adds a resource of type Job to the statement.

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/jobs.html

        :param job_id: - Identifier for the jobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "onJob", [job_id, account, region, partition]))

    @jsii.member(jsii_name="onJobTemplate")
    def on_job_template(
        self,
        job_template_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mediaconvert":
        '''(experimental) Adds a resource of type JobTemplate to the statement.

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/jobtemplates.html

        :param job_template_name: - Identifier for the jobTemplateName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "onJobTemplate", [job_template_name, account, region, partition]))

    @jsii.member(jsii_name="onPreset")
    def on_preset(
        self,
        preset_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mediaconvert":
        '''(experimental) Adds a resource of type Preset to the statement.

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/presets.html

        :param preset_name: - Identifier for the presetName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "onPreset", [preset_name, account, region, partition]))

    @jsii.member(jsii_name="onQueue")
    def on_queue(
        self,
        queue_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mediaconvert":
        '''(experimental) Adds a resource of type Queue to the statement.

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/queues.html

        :param queue_name: - Identifier for the queueName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "onQueue", [queue_name, account, region, partition]))

    @jsii.member(jsii_name="toAssociateCertificate")
    def to_associate_certificate(self) -> "Mediaconvert":
        '''(experimental) Grants permission to associate an AWS Certificate Manager (ACM) Amazon Resource Name (ARN) with AWS Elemental MediaConvert.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/certificates.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toAssociateCertificate", []))

    @jsii.member(jsii_name="toCancelJob")
    def to_cancel_job(self) -> "Mediaconvert":
        '''(experimental) Grants permission to cancel an AWS Elemental MediaConvert job that is waiting in queue.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/jobs-id.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toCancelJob", []))

    @jsii.member(jsii_name="toCreateJob")
    def to_create_job(self) -> "Mediaconvert":
        '''(experimental) Grants permission to create and submit an AWS Elemental MediaConvert job.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/jobs.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toCreateJob", []))

    @jsii.member(jsii_name="toCreateJobTemplate")
    def to_create_job_template(self) -> "Mediaconvert":
        '''(experimental) Grants permission to create an AWS Elemental MediaConvert custom job template.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/jobs-id.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toCreateJobTemplate", []))

    @jsii.member(jsii_name="toCreatePreset")
    def to_create_preset(self) -> "Mediaconvert":
        '''(experimental) Grants permission to create an AWS Elemental MediaConvert custom output preset.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/presets.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toCreatePreset", []))

    @jsii.member(jsii_name="toCreateQueue")
    def to_create_queue(self) -> "Mediaconvert":
        '''(experimental) Grants permission to create an AWS Elemental MediaConvert job queue.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/queues.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toCreateQueue", []))

    @jsii.member(jsii_name="toDeleteJobTemplate")
    def to_delete_job_template(self) -> "Mediaconvert":
        '''(experimental) Grants permission to delete an AWS Elemental MediaConvert custom job template.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/jobtemplates-name.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toDeleteJobTemplate", []))

    @jsii.member(jsii_name="toDeletePreset")
    def to_delete_preset(self) -> "Mediaconvert":
        '''(experimental) Grants permission to delete an AWS Elemental MediaConvert custom output preset.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/presets-name.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toDeletePreset", []))

    @jsii.member(jsii_name="toDeleteQueue")
    def to_delete_queue(self) -> "Mediaconvert":
        '''(experimental) Grants permission to delete an AWS Elemental MediaConvert job queue.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/queues-name.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toDeleteQueue", []))

    @jsii.member(jsii_name="toDescribeEndpoints")
    def to_describe_endpoints(self) -> "Mediaconvert":
        '''(experimental) Grants permission to subscribe to the AWS Elemental MediaConvert service, by sending a request for an account-specific endpoint.

        All transcoding requests must be sent to the endpoint that the service returns.

        Access Level: List

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/endpoints.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toDescribeEndpoints", []))

    @jsii.member(jsii_name="toDisassociateCertificate")
    def to_disassociate_certificate(self) -> "Mediaconvert":
        '''(experimental) Grants permission to remove an association between the Amazon Resource Name (ARN) of an AWS Certificate Manager (ACM) certificate and an AWS Elemental MediaConvert resource.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/certificates-arn.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toDisassociateCertificate", []))

    @jsii.member(jsii_name="toGetJob")
    def to_get_job(self) -> "Mediaconvert":
        '''(experimental) Grants permission to get an AWS Elemental MediaConvert job.

        Access Level: Read

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/jobs-id.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toGetJob", []))

    @jsii.member(jsii_name="toGetJobTemplate")
    def to_get_job_template(self) -> "Mediaconvert":
        '''(experimental) Grants permission to get an AWS Elemental MediaConvert job template.

        Access Level: Read

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/jobtemplates-name.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toGetJobTemplate", []))

    @jsii.member(jsii_name="toGetPreset")
    def to_get_preset(self) -> "Mediaconvert":
        '''(experimental) Grants permission to get an AWS Elemental MediaConvert output preset.

        Access Level: Read

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/presets-name.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toGetPreset", []))

    @jsii.member(jsii_name="toGetQueue")
    def to_get_queue(self) -> "Mediaconvert":
        '''(experimental) Grants permission to get an AWS Elemental MediaConvert job queue.

        Access Level: Read

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/queues-name.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toGetQueue", []))

    @jsii.member(jsii_name="toListJobs")
    def to_list_jobs(self) -> "Mediaconvert":
        '''(experimental) Grants permission to list AWS Elemental MediaConvert jobs.

        Access Level: List

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/jobs.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toListJobs", []))

    @jsii.member(jsii_name="toListJobTemplates")
    def to_list_job_templates(self) -> "Mediaconvert":
        '''(experimental) Grants permission to list AWS Elemental MediaConvert job templates.

        Access Level: List

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/jobtemplates.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toListJobTemplates", []))

    @jsii.member(jsii_name="toListPresets")
    def to_list_presets(self) -> "Mediaconvert":
        '''(experimental) Grants permission to list AWS Elemental MediaConvert output presets.

        Access Level: List

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/presets.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toListPresets", []))

    @jsii.member(jsii_name="toListQueues")
    def to_list_queues(self) -> "Mediaconvert":
        '''(experimental) Grants permission to list AWS Elemental MediaConvert job queues.

        Access Level: List

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/queues.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toListQueues", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Mediaconvert":
        '''(experimental) Grants permission to retrieve the tags for a MediaConvert queue, preset, or job template.

        Access Level: Read

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/tags-arn.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Mediaconvert":
        '''(experimental) Grants permission to add tags to a MediaConvert queue, preset, or job template.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/tags.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Mediaconvert":
        '''(experimental) Grants permission to remove tags from a MediaConvert queue, preset, or job template.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/tags-arn.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateJobTemplate")
    def to_update_job_template(self) -> "Mediaconvert":
        '''(experimental) Grants permission to update an AWS Elemental MediaConvert custom job template.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/jobtemplates-name.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toUpdateJobTemplate", []))

    @jsii.member(jsii_name="toUpdatePreset")
    def to_update_preset(self) -> "Mediaconvert":
        '''(experimental) Grants permission to update an AWS Elemental MediaConvert custom output preset.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/presets-name.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toUpdatePreset", []))

    @jsii.member(jsii_name="toUpdateQueue")
    def to_update_queue(self) -> "Mediaconvert":
        '''(experimental) Grants permission to update an AWS Elemental MediaConvert job queue.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/queues-name.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toUpdateQueue", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Medialive(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Medialive",
):
    '''(experimental) Statement provider for service `medialive <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalmedialive.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `medialive <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalmedialive.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Medialive, self, [sid])

    @jsii.member(jsii_name="onChannel")
    def on_channel(
        self,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Medialive":
        '''(experimental) Adds a resource of type channel to the statement.

        https://docs.aws.amazon.com/medialive/latest/ug/channels.html

        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "onChannel", [resource_name, account, region, partition]))

    @jsii.member(jsii_name="onInput")
    def on_input(
        self,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Medialive":
        '''(experimental) Adds a resource of type input to the statement.

        https://docs.aws.amazon.com/medialive/latest/ug/inputs.html

        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "onInput", [resource_name, account, region, partition]))

    @jsii.member(jsii_name="onInputDevice")
    def on_input_device(
        self,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Medialive":
        '''(experimental) Adds a resource of type input-device to the statement.

        https://docs.aws.amazon.com/medialive/latest/ug/inputdevices.html

        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "onInputDevice", [resource_name, account, region, partition]))

    @jsii.member(jsii_name="onInputSecurityGroup")
    def on_input_security_group(
        self,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Medialive":
        '''(experimental) Adds a resource of type input-security-group to the statement.

        https://docs.aws.amazon.com/medialive/latest/ug/inputsecuritygroups.html

        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "onInputSecurityGroup", [resource_name, account, region, partition]))

    @jsii.member(jsii_name="onMultiplex")
    def on_multiplex(
        self,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Medialive":
        '''(experimental) Adds a resource of type multiplex to the statement.

        https://docs.aws.amazon.com/medialive/latest/ug/multiplexes.html

        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "onMultiplex", [resource_name, account, region, partition]))

    @jsii.member(jsii_name="onOffering")
    def on_offering(
        self,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Medialive":
        '''(experimental) Adds a resource of type offering to the statement.

        https://docs.aws.amazon.com/medialive/latest/ug/input-output-reservations.html

        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "onOffering", [resource_name, account, region, partition]))

    @jsii.member(jsii_name="onReservation")
    def on_reservation(
        self,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Medialive":
        '''(experimental) Adds a resource of type reservation to the statement.

        https://docs.aws.amazon.com/medialive/latest/ug/reservations.html

        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "onReservation", [resource_name, account, region, partition]))

    @jsii.member(jsii_name="toAcceptInputDeviceTransfer")
    def to_accept_input_device_transfer(self) -> "Medialive":
        '''(experimental) Grants permission to accept an input device transfer.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/eml-devices.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toAcceptInputDeviceTransfer", []))

    @jsii.member(jsii_name="toBatchDelete")
    def to_batch_delete(self) -> "Medialive":
        '''(experimental) Grants permission to delete channels, inputs, input security groups, and multiplexes.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/editing-deleting-channel.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toBatchDelete", []))

    @jsii.member(jsii_name="toBatchStart")
    def to_batch_start(self) -> "Medialive":
        '''(experimental) Grants permission to start channels and multiplexes.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/starting-stopping-deleting-a-channel.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toBatchStart", []))

    @jsii.member(jsii_name="toBatchStop")
    def to_batch_stop(self) -> "Medialive":
        '''(experimental) Grants permission to stop channels and multiplexes.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/starting-stopping-deleting-a-channel.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toBatchStop", []))

    @jsii.member(jsii_name="toBatchUpdateSchedule")
    def to_batch_update_schedule(self) -> "Medialive":
        '''(experimental) Grants permission to add and remove actions from a channel's schedule.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/batching-actions.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toBatchUpdateSchedule", []))

    @jsii.member(jsii_name="toCancelInputDeviceTransfer")
    def to_cancel_input_device_transfer(self) -> "Medialive":
        '''(experimental) Grants permission to cancel an input device transfer.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/eml-devices.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toCancelInputDeviceTransfer", []))

    @jsii.member(jsii_name="toCreateChannel")
    def to_create_channel(self) -> "Medialive":
        '''(experimental) Grants permission to create a channel.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/medialive/latest/ug/creating-channel-scratch.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toCreateChannel", []))

    @jsii.member(jsii_name="toCreateInput")
    def to_create_input(self) -> "Medialive":
        '''(experimental) Grants permission to create an input.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/medialive/latest/ug/creating-input.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toCreateInput", []))

    @jsii.member(jsii_name="toCreateInputSecurityGroup")
    def to_create_input_security_group(self) -> "Medialive":
        '''(experimental) Grants permission to create an input security group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/medialive/latest/ug/working-with-input-security-groups.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toCreateInputSecurityGroup", []))

    @jsii.member(jsii_name="toCreateMultiplex")
    def to_create_multiplex(self) -> "Medialive":
        '''(experimental) Grants permission to create a multiplex.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/medialive/latest/ug/creating-multiplex.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toCreateMultiplex", []))

    @jsii.member(jsii_name="toCreateMultiplexProgram")
    def to_create_multiplex_program(self) -> "Medialive":
        '''(experimental) Grants permission to create a multiplex program.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/multiplex-create.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toCreateMultiplexProgram", []))

    @jsii.member(jsii_name="toCreateTags")
    def to_create_tags(self) -> "Medialive":
        '''(experimental) Grants permission to create tags for channels, inputs, input security groups, multiplexes, and reservations.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/medialive/latest/ug/tagging.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toCreateTags", []))

    @jsii.member(jsii_name="toDeleteChannel")
    def to_delete_channel(self) -> "Medialive":
        '''(experimental) Grants permission to delete a channel.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/editing-deleting-channel.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toDeleteChannel", []))

    @jsii.member(jsii_name="toDeleteInput")
    def to_delete_input(self) -> "Medialive":
        '''(experimental) Grants permission to delete an input.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/delete-input.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toDeleteInput", []))

    @jsii.member(jsii_name="toDeleteInputSecurityGroup")
    def to_delete_input_security_group(self) -> "Medialive":
        '''(experimental) Grants permission to delete an input security group.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/delete-input-security-group.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toDeleteInputSecurityGroup", []))

    @jsii.member(jsii_name="toDeleteMultiplex")
    def to_delete_multiplex(self) -> "Medialive":
        '''(experimental) Grants permission to delete a multiplex.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/delete-multiplex.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toDeleteMultiplex", []))

    @jsii.member(jsii_name="toDeleteMultiplexProgram")
    def to_delete_multiplex_program(self) -> "Medialive":
        '''(experimental) Grants permission to delete a multiplex program.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/delete-multiplex-program.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toDeleteMultiplexProgram", []))

    @jsii.member(jsii_name="toDeleteReservation")
    def to_delete_reservation(self) -> "Medialive":
        '''(experimental) Grants permission to delete an expired reservation.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/deleting-reservations.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toDeleteReservation", []))

    @jsii.member(jsii_name="toDeleteSchedule")
    def to_delete_schedule(self) -> "Medialive":
        '''(experimental) Grants permission to delete all schedule actions for a channel.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/schedule-using-console-delete.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toDeleteSchedule", []))

    @jsii.member(jsii_name="toDeleteTags")
    def to_delete_tags(self) -> "Medialive":
        '''(experimental) Grants permission to delete tags from channels, inputs, input security groups, multiplexes, and reservations.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/medialive/latest/ug/tagging.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toDeleteTags", []))

    @jsii.member(jsii_name="toDescribeChannel")
    def to_describe_channel(self) -> "Medialive":
        '''(experimental) Grants permission to get details about a channel.

        Access Level: Read

        https://docs.aws.amazon.com/medialive/latest/ug/viewing-channel-configuration.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toDescribeChannel", []))

    @jsii.member(jsii_name="toDescribeInput")
    def to_describe_input(self) -> "Medialive":
        '''(experimental) Grants permission to describe an input.

        Access Level: Read

        https://docs.aws.amazon.com/medialive/latest/ug/edit-input.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toDescribeInput", []))

    @jsii.member(jsii_name="toDescribeInputDevice")
    def to_describe_input_device(self) -> "Medialive":
        '''(experimental) Grants permission to describe an input device.

        Access Level: Read

        https://docs.aws.amazon.com/medialive/latest/ug/edit-input-device.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toDescribeInputDevice", []))

    @jsii.member(jsii_name="toDescribeInputDeviceThumbnail")
    def to_describe_input_device_thumbnail(self) -> "Medialive":
        '''(experimental) Grants permission to describe an input device thumbnail.

        Access Level: Read

        https://docs.aws.amazon.com/medialive/latest/ug/edit-input-device.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toDescribeInputDeviceThumbnail", []))

    @jsii.member(jsii_name="toDescribeInputSecurityGroup")
    def to_describe_input_security_group(self) -> "Medialive":
        '''(experimental) Grants permission to describe an input security group.

        Access Level: Read

        https://docs.aws.amazon.com/medialive/latest/ug/edit-input-security-group.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toDescribeInputSecurityGroup", []))

    @jsii.member(jsii_name="toDescribeMultiplex")
    def to_describe_multiplex(self) -> "Medialive":
        '''(experimental) Grants permission to describe a multiplex.

        Access Level: Read

        https://docs.aws.amazon.com/medialive/latest/ug/viewing-multiplex-configuration.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toDescribeMultiplex", []))

    @jsii.member(jsii_name="toDescribeMultiplexProgram")
    def to_describe_multiplex_program(self) -> "Medialive":
        '''(experimental) Grants permission to describe a multiplex program.

        Access Level: Read

        https://docs.aws.amazon.com/medialive/latest/ug/monitoring-multiplex-console.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toDescribeMultiplexProgram", []))

    @jsii.member(jsii_name="toDescribeOffering")
    def to_describe_offering(self) -> "Medialive":
        '''(experimental) Grants permission to get details about a reservation offering.

        Access Level: Read

        https://docs.aws.amazon.com/medialive/latest/ug/purchasing-reservations.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toDescribeOffering", []))

    @jsii.member(jsii_name="toDescribeReservation")
    def to_describe_reservation(self) -> "Medialive":
        '''(experimental) Grants permission to get details about a reservation.

        Access Level: Read

        https://docs.aws.amazon.com/medialive/latest/ug/view-reservations.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toDescribeReservation", []))

    @jsii.member(jsii_name="toDescribeSchedule")
    def to_describe_schedule(self) -> "Medialive":
        '''(experimental) Grants permission to view a list of actions scheduled on a channel.

        Access Level: Read

        https://docs.aws.amazon.com/medialive/latest/ug/viewing-actions-schedule.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toDescribeSchedule", []))

    @jsii.member(jsii_name="toListChannels")
    def to_list_channels(self) -> "Medialive":
        '''(experimental) Grants permission to list channels.

        Access Level: List

        https://docs.aws.amazon.com/medialive/latest/ug/viewing-channel-configuration.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toListChannels", []))

    @jsii.member(jsii_name="toListInputDevices")
    def to_list_input_devices(self) -> "Medialive":
        '''(experimental) Grants permission to list input devices.

        Access Level: List

        https://docs.aws.amazon.com/medialive/latest/ug/edit-input-device.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toListInputDevices", []))

    @jsii.member(jsii_name="toListInputDeviceTransfers")
    def to_list_input_device_transfers(self) -> "Medialive":
        '''(experimental) Grants permission to list input device transfers.

        Access Level: List

        https://docs.aws.amazon.com/medialive/latest/ug/eml-devices.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toListInputDeviceTransfers", []))

    @jsii.member(jsii_name="toListInputs")
    def to_list_inputs(self) -> "Medialive":
        '''(experimental) Grants permission to list inputs.

        Access Level: List

        https://docs.aws.amazon.com/medialive/latest/ug/edit-input.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toListInputs", []))

    @jsii.member(jsii_name="toListInputSecurityGroups")
    def to_list_input_security_groups(self) -> "Medialive":
        '''(experimental) Grants permission to list input security groups.

        Access Level: List

        https://docs.aws.amazon.com/medialive/latest/ug/edit-input-security-group.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toListInputSecurityGroups", []))

    @jsii.member(jsii_name="toListMultiplexes")
    def to_list_multiplexes(self) -> "Medialive":
        '''(experimental) Grants permission to list multiplexes.

        Access Level: List

        https://docs.aws.amazon.com/medialive/latest/ug/viewing-multiplex-configuration.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toListMultiplexes", []))

    @jsii.member(jsii_name="toListMultiplexPrograms")
    def to_list_multiplex_programs(self) -> "Medialive":
        '''(experimental) Grants permission to list multiplex programs.

        Access Level: List

        https://docs.aws.amazon.com/medialive/latest/ug/monitoring-multiplex-console.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toListMultiplexPrograms", []))

    @jsii.member(jsii_name="toListOfferings")
    def to_list_offerings(self) -> "Medialive":
        '''(experimental) Grants permission to list reservation offerings.

        Access Level: List

        https://docs.aws.amazon.com/medialive/latest/ug/purchasing-reservations.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toListOfferings", []))

    @jsii.member(jsii_name="toListReservations")
    def to_list_reservations(self) -> "Medialive":
        '''(experimental) Grants permission to list reservations.

        Access Level: List

        https://docs.aws.amazon.com/medialive/latest/ug/view-reservations.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toListReservations", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Medialive":
        '''(experimental) Grants permission to list tags for channels, inputs, input security groups, multiplexes, and reservations.

        Access Level: List

        https://docs.aws.amazon.com/medialive/latest/ug/tagging.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPurchaseOffering")
    def to_purchase_offering(self) -> "Medialive":
        '''(experimental) Grants permission to purchase a reservation offering.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/medialive/latest/ug/purchasing-reservations.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toPurchaseOffering", []))

    @jsii.member(jsii_name="toRejectInputDeviceTransfer")
    def to_reject_input_device_transfer(self) -> "Medialive":
        '''(experimental) Grants permission to reject an input device transfer.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/eml-devices.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toRejectInputDeviceTransfer", []))

    @jsii.member(jsii_name="toStartChannel")
    def to_start_channel(self) -> "Medialive":
        '''(experimental) Grants permission to start a channel.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/starting-stopping-deleting-a-channel.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toStartChannel", []))

    @jsii.member(jsii_name="toStartMultiplex")
    def to_start_multiplex(self) -> "Medialive":
        '''(experimental) Grants permission to start a multiplex.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/starting-stopping-a-multiplex.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toStartMultiplex", []))

    @jsii.member(jsii_name="toStopChannel")
    def to_stop_channel(self) -> "Medialive":
        '''(experimental) Grants permission to stop a channel.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/starting-stopping-deleting-a-channel.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toStopChannel", []))

    @jsii.member(jsii_name="toStopMultiplex")
    def to_stop_multiplex(self) -> "Medialive":
        '''(experimental) Grants permission to stop a multiplex.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/starting-stopping-a-multiplex.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toStopMultiplex", []))

    @jsii.member(jsii_name="toTransferInputDevice")
    def to_transfer_input_device(self) -> "Medialive":
        '''(experimental) Grants permission to transfer an input device.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/eml-devices.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toTransferInputDevice", []))

    @jsii.member(jsii_name="toUpdateChannel")
    def to_update_channel(self) -> "Medialive":
        '''(experimental) Grants permission to update a channel.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/editing-deleting-channel.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toUpdateChannel", []))

    @jsii.member(jsii_name="toUpdateChannelClass")
    def to_update_channel_class(self) -> "Medialive":
        '''(experimental) Grants permission to update the class of a channel.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/editing-deleting-channel.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toUpdateChannelClass", []))

    @jsii.member(jsii_name="toUpdateInput")
    def to_update_input(self) -> "Medialive":
        '''(experimental) Grants permission to update an input.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/edit-input.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toUpdateInput", []))

    @jsii.member(jsii_name="toUpdateInputDevice")
    def to_update_input_device(self) -> "Medialive":
        '''(experimental) Grants permission to update an input device.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/edit-input-device.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toUpdateInputDevice", []))

    @jsii.member(jsii_name="toUpdateInputSecurityGroup")
    def to_update_input_security_group(self) -> "Medialive":
        '''(experimental) Grants permission to update an input security group.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/edit-input-security-group.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toUpdateInputSecurityGroup", []))

    @jsii.member(jsii_name="toUpdateMultiplex")
    def to_update_multiplex(self) -> "Medialive":
        '''(experimental) Grants permission to update a multiplex.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/edit-multiplex.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toUpdateMultiplex", []))

    @jsii.member(jsii_name="toUpdateMultiplexProgram")
    def to_update_multiplex_program(self) -> "Medialive":
        '''(experimental) Grants permission to update a multiplex program.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/edit-multiplex-program-channel.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toUpdateMultiplexProgram", []))

    @jsii.member(jsii_name="toUpdateReservation")
    def to_update_reservation(self) -> "Medialive":
        '''(experimental) Grants permission to update a reservation.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/reservations.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toUpdateReservation", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Mediapackage(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Mediapackage",
):
    '''(experimental) Statement provider for service `mediapackage <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalmediapackage.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `mediapackage <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalmediapackage.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Mediapackage, self, [sid])

    @jsii.member(jsii_name="onChannels")
    def on_channels(
        self,
        channel_identifier: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mediapackage":
        '''(experimental) Adds a resource of type channels to the statement.

        https://docs.aws.amazon.com/mediapackage/latest/ug/channels.html

        :param channel_identifier: - Identifier for the channelIdentifier.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "onChannels", [channel_identifier, account, region, partition]))

    @jsii.member(jsii_name="onHarvestJobs")
    def on_harvest_jobs(
        self,
        harvest_job_identifier: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mediapackage":
        '''(experimental) Adds a resource of type harvest_jobs to the statement.

        https://docs.aws.amazon.com/mediapackage/latest/ug/harvest-jobs.html

        :param harvest_job_identifier: - Identifier for the harvestJobIdentifier.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "onHarvestJobs", [harvest_job_identifier, account, region, partition]))

    @jsii.member(jsii_name="onOriginEndpoints")
    def on_origin_endpoints(
        self,
        origin_endpoint_identifier: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mediapackage":
        '''(experimental) Adds a resource of type origin_endpoints to the statement.

        https://docs.aws.amazon.com/mediapackage/latest/ug/endpoints.html

        :param origin_endpoint_identifier: - Identifier for the originEndpointIdentifier.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "onOriginEndpoints", [origin_endpoint_identifier, account, region, partition]))

    @jsii.member(jsii_name="toCreateChannel")
    def to_create_channel(self) -> "Mediapackage":
        '''(experimental) Grants permission to create a channel in AWS Elemental MediaPackage.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediapackage/latest/apireference/channels.html#channelspost

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "toCreateChannel", []))

    @jsii.member(jsii_name="toCreateHarvestJob")
    def to_create_harvest_job(self) -> "Mediapackage":
        '''(experimental) Grants permission to create a harvest job in AWS Elemental MediaPackage.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediapackage/latest/apireference/harvest_jobs.html#harvest_jobspost

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "toCreateHarvestJob", []))

    @jsii.member(jsii_name="toCreateOriginEndpoint")
    def to_create_origin_endpoint(self) -> "Mediapackage":
        '''(experimental) Grants permission to create an endpoint in AWS Elemental MediaPackage.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediapackage/latest/apireference/origin_endpoints.html#origin_endpointspost

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "toCreateOriginEndpoint", []))

    @jsii.member(jsii_name="toDeleteChannel")
    def to_delete_channel(self) -> "Mediapackage":
        '''(experimental) Grants permission to delete a channel in AWS Elemental MediaPackage.

        Access Level: Write

        https://docs.aws.amazon.com/mediapackage/latest/apireference/channels-id.html#channels-iddelete

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "toDeleteChannel", []))

    @jsii.member(jsii_name="toDeleteOriginEndpoint")
    def to_delete_origin_endpoint(self) -> "Mediapackage":
        '''(experimental) Grants permission to delete an endpoint in AWS Elemental MediaPackage.

        Access Level: Write

        https://docs.aws.amazon.com/mediapackage/latest/apireference/origin_endpoints-id.html#origin_endpoints-iddelete

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "toDeleteOriginEndpoint", []))

    @jsii.member(jsii_name="toDescribeChannel")
    def to_describe_channel(self) -> "Mediapackage":
        '''(experimental) Grants permission to view the details of a channel in AWS Elemental MediaPackage.

        Access Level: Read

        https://docs.aws.amazon.com/mediapackage/latest/apireference/channels-id.html#channels-idget

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "toDescribeChannel", []))

    @jsii.member(jsii_name="toDescribeHarvestJob")
    def to_describe_harvest_job(self) -> "Mediapackage":
        '''(experimental) Grants permission to view the details of a harvest job in AWS Elemental MediaPackage.

        Access Level: Read

        https://docs.aws.amazon.com/mediapackage/latest/apireference/harvest_jobs-id.html#harvest_jobs-idget

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "toDescribeHarvestJob", []))

    @jsii.member(jsii_name="toDescribeOriginEndpoint")
    def to_describe_origin_endpoint(self) -> "Mediapackage":
        '''(experimental) Grants permission to view the details of an endpoint in AWS Elemental MediaPackage.

        Access Level: Read

        https://docs.aws.amazon.com/mediapackage/latest/apireference/origin_endpoints-id.html#origin_endpoints-idget

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "toDescribeOriginEndpoint", []))

    @jsii.member(jsii_name="toListChannels")
    def to_list_channels(self) -> "Mediapackage":
        '''(experimental) Grants permission to view a list of channels in AWS Elemental MediaPackage.

        Access Level: Read

        https://docs.aws.amazon.com/mediapackage/latest/apireference/channels.html#channelsget

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "toListChannels", []))

    @jsii.member(jsii_name="toListHarvestJobs")
    def to_list_harvest_jobs(self) -> "Mediapackage":
        '''(experimental) Grants permission to view a list of harvest jobs in AWS Elemental MediaPackage.

        Access Level: Read

        https://docs.aws.amazon.com/mediapackage/latest/apireference/harvest_jobs.html#harvest_jobsget

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "toListHarvestJobs", []))

    @jsii.member(jsii_name="toListOriginEndpoints")
    def to_list_origin_endpoints(self) -> "Mediapackage":
        '''(experimental) Grants permission to view a list of endpoints in AWS Elemental MediaPackage.

        Access Level: Read

        https://docs.aws.amazon.com/mediapackage/latest/apireference/origin_endpoints.html#origin_endpointsget

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "toListOriginEndpoints", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Mediapackage":
        '''(experimental) Grants permission to list the tags assigned to a Channel or OriginEndpoint.

        Access Level: Read

        https://docs.aws.amazon.com/mediapackage/latest/apireference/tags-resource-arn.html#tags-resource-arnget

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toRotateIngestEndpointCredentials")
    def to_rotate_ingest_endpoint_credentials(self) -> "Mediapackage":
        '''(experimental) Grants permission to rotate IngestEndpoint credentials for a Channel in AWS Elemental MediaPackage.

        Access Level: Write

        https://docs.aws.amazon.com/mediapackage/latest/apireference/channels-id-ingest_endpoints-ingest_endpoint_id-credentials.html#channels-id-ingest_endpoints-ingest_endpoint_id-credentialsput

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "toRotateIngestEndpointCredentials", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Mediapackage":
        '''(experimental) Access Level: Write.

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediapackage/latest/apireference/hj-create.html

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Mediapackage":
        '''(experimental) Grants permission to delete tags to a Channel or OriginEndpoint.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediapackage/latest/apireference/tags-resource-arn.html#tags-resource-arndelete

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateChannel")
    def to_update_channel(self) -> "Mediapackage":
        '''(experimental) Grants permission to make changes to a channel in AWS Elemental MediaPackage.

        Access Level: Write

        https://docs.aws.amazon.com/mediapackage/latest/apireference/channels-id.html#channels-idput

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "toUpdateChannel", []))

    @jsii.member(jsii_name="toUpdateOriginEndpoint")
    def to_update_origin_endpoint(self) -> "Mediapackage":
        '''(experimental) Grants permission to make changes to an endpoint in AWS Elemental MediaPackage.

        Access Level: Write

        https://docs.aws.amazon.com/mediapackage/latest/apireference/origin_endpoints-id.html#origin_endpoints-idput

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "toUpdateOriginEndpoint", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class MediapackageVod(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.MediapackageVod",
):
    '''(experimental) Statement provider for service `mediapackage-vod <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalmediapackagevod.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `mediapackage-vod <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalmediapackagevod.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(MediapackageVod, self, [sid])

    @jsii.member(jsii_name="onAssets")
    def on_assets(
        self,
        asset_identifier: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "MediapackageVod":
        '''(experimental) Adds a resource of type assets to the statement.

        https://docs.aws.amazon.com/mediapackage/latest/ug/asset.html

        :param asset_identifier: - Identifier for the assetIdentifier.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("MediapackageVod", jsii.invoke(self, "onAssets", [asset_identifier, account, region, partition]))

    @jsii.member(jsii_name="onPackagingConfigurations")
    def on_packaging_configurations(
        self,
        packaging_configuration_identifier: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "MediapackageVod":
        '''(experimental) Adds a resource of type packaging-configurations to the statement.

        https://docs.aws.amazon.com/mediapackage/latest/ug/pkg-cfig.html

        :param packaging_configuration_identifier: - Identifier for the packagingConfigurationIdentifier.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("MediapackageVod", jsii.invoke(self, "onPackagingConfigurations", [packaging_configuration_identifier, account, region, partition]))

    @jsii.member(jsii_name="onPackagingGroups")
    def on_packaging_groups(
        self,
        packaging_group_identifier: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "MediapackageVod":
        '''(experimental) Adds a resource of type packaging-groups to the statement.

        https://docs.aws.amazon.com/mediapackage/latest/ug/pkg-group.html

        :param packaging_group_identifier: - Identifier for the packagingGroupIdentifier.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("MediapackageVod", jsii.invoke(self, "onPackagingGroups", [packaging_group_identifier, account, region, partition]))

    @jsii.member(jsii_name="toCreateAsset")
    def to_create_asset(self) -> "MediapackageVod":
        '''(experimental) Grants permission to create an asset in AWS Elemental MediaPackage.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediapackage-vod/latest/apireference/assets.html#assetspost

        :stability: experimental
        '''
        return typing.cast("MediapackageVod", jsii.invoke(self, "toCreateAsset", []))

    @jsii.member(jsii_name="toCreatePackagingConfiguration")
    def to_create_packaging_configuration(self) -> "MediapackageVod":
        '''(experimental) Grants permission to create a packaging configuration in AWS Elemental MediaPackage.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediapackage-vod/latest/apireference/packaging_configurations.html#packaging_configurationspost

        :stability: experimental
        '''
        return typing.cast("MediapackageVod", jsii.invoke(self, "toCreatePackagingConfiguration", []))

    @jsii.member(jsii_name="toCreatePackagingGroup")
    def to_create_packaging_group(self) -> "MediapackageVod":
        '''(experimental) Grants permission to create a packaging group in AWS Elemental MediaPackage.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediapackage-vod/latest/apireference/packaging_groups.html#packaging_groupspost

        :stability: experimental
        '''
        return typing.cast("MediapackageVod", jsii.invoke(self, "toCreatePackagingGroup", []))

    @jsii.member(jsii_name="toDeleteAsset")
    def to_delete_asset(self) -> "MediapackageVod":
        '''(experimental) Grants permission to delete an asset in AWS Elemental MediaPackage.

        Access Level: Write

        https://docs.aws.amazon.com/mediapackage-vod/latest/apireference/assets-id.html#assets-iddelete

        :stability: experimental
        '''
        return typing.cast("MediapackageVod", jsii.invoke(self, "toDeleteAsset", []))

    @jsii.member(jsii_name="toDeletePackagingConfiguration")
    def to_delete_packaging_configuration(self) -> "MediapackageVod":
        '''(experimental) Grants permission to delete a packaging configuration in AWS Elemental MediaPackage.

        Access Level: Write

        https://docs.aws.amazon.com/mediapackage-vod/latest/apireference/packaging_configurations-id.html#packaging_configurations-iddelete

        :stability: experimental
        '''
        return typing.cast("MediapackageVod", jsii.invoke(self, "toDeletePackagingConfiguration", []))

    @jsii.member(jsii_name="toDeletePackagingGroup")
    def to_delete_packaging_group(self) -> "MediapackageVod":
        '''(experimental) Grants permission to delete a packaging group in AWS Elemental MediaPackage.

        Access Level: Write

        https://docs.aws.amazon.com/mediapackage-vod/latest/apireference/packaging_groups-id.html#packaging_groups-iddelete

        :stability: experimental
        '''
        return typing.cast("MediapackageVod", jsii.invoke(self, "toDeletePackagingGroup", []))

    @jsii.member(jsii_name="toDescribeAsset")
    def to_describe_asset(self) -> "MediapackageVod":
        '''(experimental) Grants permission to view the details of an asset in AWS Elemental MediaPackage.

        Access Level: Read

        https://docs.aws.amazon.com/mediapackage-vod/latest/apireference/assets-id.html#assets-idget

        :stability: experimental
        '''
        return typing.cast("MediapackageVod", jsii.invoke(self, "toDescribeAsset", []))

    @jsii.member(jsii_name="toDescribePackagingConfiguration")
    def to_describe_packaging_configuration(self) -> "MediapackageVod":
        '''(experimental) Grants permission to view the details of a packaging configuration in AWS Elemental MediaPackage.

        Access Level: Read

        https://docs.aws.amazon.com/mediapackage-vod/latest/apireference/packaging_configurations-id.html#packaging_configurations-idget

        :stability: experimental
        '''
        return typing.cast("MediapackageVod", jsii.invoke(self, "toDescribePackagingConfiguration", []))

    @jsii.member(jsii_name="toDescribePackagingGroup")
    def to_describe_packaging_group(self) -> "MediapackageVod":
        '''(experimental) Grants permission to view the details of a packaging group in AWS Elemental MediaPackage.

        Access Level: Read

        https://docs.aws.amazon.com/mediapackage-vod/latest/apireference/packaging_groups-id.html#packaging_groups-idget

        :stability: experimental
        '''
        return typing.cast("MediapackageVod", jsii.invoke(self, "toDescribePackagingGroup", []))

    @jsii.member(jsii_name="toListAssets")
    def to_list_assets(self) -> "MediapackageVod":
        '''(experimental) Grants permission to view a list of assets in AWS Elemental MediaPackage.

        Access Level: List

        https://docs.aws.amazon.com/mediapackage-vod/latest/apireference/assets.html#assetsget

        :stability: experimental
        '''
        return typing.cast("MediapackageVod", jsii.invoke(self, "toListAssets", []))

    @jsii.member(jsii_name="toListPackagingConfigurations")
    def to_list_packaging_configurations(self) -> "MediapackageVod":
        '''(experimental) Grants permission to view a list of packaging configurations in AWS Elemental MediaPackage.

        Access Level: List

        https://docs.aws.amazon.com/mediapackage-vod/latest/apireference/packaging_configurations.html#packaging_configurationsget

        :stability: experimental
        '''
        return typing.cast("MediapackageVod", jsii.invoke(self, "toListPackagingConfigurations", []))

    @jsii.member(jsii_name="toListPackagingGroups")
    def to_list_packaging_groups(self) -> "MediapackageVod":
        '''(experimental) Grants permission to view a list of packaging groups in AWS Elemental MediaPackage.

        Access Level: List

        https://docs.aws.amazon.com/mediapackage-vod/latest/apireference/packaging_groups.html#packaging_groupsget

        :stability: experimental
        '''
        return typing.cast("MediapackageVod", jsii.invoke(self, "toListPackagingGroups", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "MediapackageVod":
        '''(experimental) Grants permission to list the tags assigned to a PackagingGroup, PackagingConfiguration, or Asset.

        Access Level: Read

        https://docs.aws.amazon.com/mediapackage-vod/latest/apireference/tags-resource-arn.html#tags-resource-arnget

        :stability: experimental
        '''
        return typing.cast("MediapackageVod", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "MediapackageVod":
        '''(experimental) Grants permission to assign tags to a PackagingGroup, PackagingConfiguration, or Asset.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediapackage-vod/latest/apireference/tags-resource-arn.html#tags-resource-arnpost

        :stability: experimental
        '''
        return typing.cast("MediapackageVod", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "MediapackageVod":
        '''(experimental) Grants permission to delete tags from a PackagingGroup, PackagingConfiguration, or Asset.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediapackage-vod/latest/apireference/tags-resource-arn.html#tags-resource-arndelete

        :stability: experimental
        '''
        return typing.cast("MediapackageVod", jsii.invoke(self, "toUntagResource", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Mediastore(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Mediastore",
):
    '''(experimental) Statement provider for service `mediastore <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalmediastore.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `mediastore <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalmediastore.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Mediastore, self, [sid])

    @jsii.member(jsii_name="onContainer")
    def on_container(
        self,
        container_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mediastore":
        '''(experimental) Adds a resource of type container to the statement.

        https://docs.aws.amazon.com/mediastore/latest/ug/containers.html

        :param container_name: - Identifier for the containerName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "onContainer", [container_name, account, region, partition]))

    @jsii.member(jsii_name="toCreateContainer")
    def to_create_container(self) -> "Mediastore":
        '''(experimental) Grants permission to create containers.

        Access Level: Write

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_CreateContainer.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toCreateContainer", []))

    @jsii.member(jsii_name="toDeleteContainer")
    def to_delete_container(self) -> "Mediastore":
        '''(experimental) Grants permission to delete any container in the current account.

        Access Level: Write

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_DeleteContainer.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toDeleteContainer", []))

    @jsii.member(jsii_name="toDeleteContainerPolicy")
    def to_delete_container_policy(self) -> "Mediastore":
        '''(experimental) Grants permission to delete the access policy of any container in the current account.

        Access Level: Permissions management

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_DeleteContainerPolicy.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toDeleteContainerPolicy", []))

    @jsii.member(jsii_name="toDeleteCorsPolicy")
    def to_delete_cors_policy(self) -> "Mediastore":
        '''(experimental) Grants permission to delete the CORS policy from any container in the current account.

        Access Level: Write

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_DeleteCorsPolicy.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toDeleteCorsPolicy", []))

    @jsii.member(jsii_name="toDeleteLifecyclePolicy")
    def to_delete_lifecycle_policy(self) -> "Mediastore":
        '''(experimental) Grants permission to delete the lifecycle policy from any container in the current account.

        Access Level: Write

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_DeleteLifecyclePolicy.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toDeleteLifecyclePolicy", []))

    @jsii.member(jsii_name="toDeleteMetricPolicy")
    def to_delete_metric_policy(self) -> "Mediastore":
        '''(experimental) Grants permission to delete the metric policy from any container in the current account.

        Access Level: Write

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_DeleteMetricPolicy.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toDeleteMetricPolicy", []))

    @jsii.member(jsii_name="toDeleteObject")
    def to_delete_object(self) -> "Mediastore":
        '''(experimental) Grants permission to delete objects.

        Access Level: Write

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_objstore_DeleteObject.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toDeleteObject", []))

    @jsii.member(jsii_name="toDescribeContainer")
    def to_describe_container(self) -> "Mediastore":
        '''(experimental) Grants permission to retrieve details on any container in the current account.

        Access Level: List

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_DescribeContainer.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toDescribeContainer", []))

    @jsii.member(jsii_name="toDescribeObject")
    def to_describe_object(self) -> "Mediastore":
        '''(experimental) Grants permission to retrieve object metadata.

        Access Level: List

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_objstore_DescribeObject.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toDescribeObject", []))

    @jsii.member(jsii_name="toGetContainerPolicy")
    def to_get_container_policy(self) -> "Mediastore":
        '''(experimental) Grants permission to retrieve the access policy of any container in the current account.

        Access Level: Read

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_GetContainerPolicy.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toGetContainerPolicy", []))

    @jsii.member(jsii_name="toGetCorsPolicy")
    def to_get_cors_policy(self) -> "Mediastore":
        '''(experimental) Grants permission to retrieve the CORS policy of any container in the current account.

        Access Level: Read

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_GetCorsPolicy.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toGetCorsPolicy", []))

    @jsii.member(jsii_name="toGetLifecyclePolicy")
    def to_get_lifecycle_policy(self) -> "Mediastore":
        '''(experimental) Grants permission to retrieve the lifecycle policy that is assigned to any container in the current account.

        Access Level: Read

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_GetLifecyclePolicy.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toGetLifecyclePolicy", []))

    @jsii.member(jsii_name="toGetMetricPolicy")
    def to_get_metric_policy(self) -> "Mediastore":
        '''(experimental) Grants permission to retrieve the metric policy that is assigned to any container in the current account.

        Access Level: Read

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_GetMetricPolicy.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toGetMetricPolicy", []))

    @jsii.member(jsii_name="toGetObject")
    def to_get_object(self) -> "Mediastore":
        '''(experimental) Grants permission to retrieve objects.

        Access Level: Read

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_objstore_GetObject.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toGetObject", []))

    @jsii.member(jsii_name="toListContainers")
    def to_list_containers(self) -> "Mediastore":
        '''(experimental) Grants permission to retrieve a list of containers in the current account.

        Access Level: List

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_ListContainers.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toListContainers", []))

    @jsii.member(jsii_name="toListItems")
    def to_list_items(self) -> "Mediastore":
        '''(experimental) Grants permission to retrieve a list of objects and folders in the current account.

        Access Level: List

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_objstore_ListItems.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toListItems", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Mediastore":
        '''(experimental) Grants permission to list tags on any container in the current account.

        Access Level: Read

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutContainerPolicy")
    def to_put_container_policy(self) -> "Mediastore":
        '''(experimental) Grants permission to create or replace the access policy of any container in the current account.

        Access Level: Permissions management

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_PutContainerPolicy.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toPutContainerPolicy", []))

    @jsii.member(jsii_name="toPutCorsPolicy")
    def to_put_cors_policy(self) -> "Mediastore":
        '''(experimental) Grants permission to add or modify the CORS policy of any container in the current account.

        Access Level: Write

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_PutCorsPolicy.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toPutCorsPolicy", []))

    @jsii.member(jsii_name="toPutLifecyclePolicy")
    def to_put_lifecycle_policy(self) -> "Mediastore":
        '''(experimental) Grants permission to add or modify the lifecycle policy that is assigned to any container in the current account.

        Access Level: Write

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_PutLifecyclePolicy.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toPutLifecyclePolicy", []))

    @jsii.member(jsii_name="toPutMetricPolicy")
    def to_put_metric_policy(self) -> "Mediastore":
        '''(experimental) Grants permission to add or modify the metric policy that is assigned to any container in the current account.

        Access Level: Write

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_PutMetricPolicy.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toPutMetricPolicy", []))

    @jsii.member(jsii_name="toPutObject")
    def to_put_object(self) -> "Mediastore":
        '''(experimental) Grants permission to upload objects.

        Access Level: Write

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_objstore_PutObject.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toPutObject", []))

    @jsii.member(jsii_name="toStartAccessLogging")
    def to_start_access_logging(self) -> "Mediastore":
        '''(experimental) Grants permission to enable access logging on any container in the current account.

        Access Level: Write

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_StartAccessLogging.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toStartAccessLogging", []))

    @jsii.member(jsii_name="toStopAccessLogging")
    def to_stop_access_logging(self) -> "Mediastore":
        '''(experimental) Grants permission to disable access logging on any container in the current account.

        Access Level: Write

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_StopAccessLogging.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toStopAccessLogging", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Mediastore":
        '''(experimental) Grants permission to add tags to any container in the current account.

        Access Level: Tagging

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Mediastore":
        '''(experimental) Grants permission to remove tags from any container in the current account.

        Access Level: Tagging

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toUntagResource", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Mediatailor(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Mediatailor",
):
    '''(experimental) Statement provider for service `mediatailor <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalmediatailor.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `mediatailor <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalmediatailor.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Mediatailor, self, [sid])

    @jsii.member(jsii_name="onPlaybackConfiguration")
    def on_playback_configuration(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mediatailor":
        '''(experimental) Adds a resource of type playbackConfiguration to the statement.

        https://docs.aws.amazon.com/mediatailor/latest/apireference/playbackconfiguration.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "onPlaybackConfiguration", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toDeletePlaybackConfiguration")
    def to_delete_playback_configuration(self) -> "Mediatailor":
        '''(experimental) Deletes the playback configuration for the specified name.

        Access Level: Write

        https://docs.aws.amazon.com/mediatailor/latest/apireference/playbackconfiguration-name.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toDeletePlaybackConfiguration", []))

    @jsii.member(jsii_name="toGetPlaybackConfiguration")
    def to_get_playback_configuration(self) -> "Mediatailor":
        '''(experimental) Grants permission to retrieve the configuration for the specified name.

        Access Level: Read

        https://docs.aws.amazon.com/mediatailor/latest/apireference/playbackconfiguration-name.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toGetPlaybackConfiguration", []))

    @jsii.member(jsii_name="toListPlaybackConfigurations")
    def to_list_playback_configurations(self) -> "Mediatailor":
        '''(experimental) Grants permission to retrieve the list of available configurations.

        Access Level: List

        https://docs.aws.amazon.com/mediatailor/latest/apireference/playbackconfigurations.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toListPlaybackConfigurations", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Mediatailor":
        '''(experimental) Returns a list of the tags assigned to the specified playback configuration resource.

        Access Level: Read

        https://docs.aws.amazon.com/mediatailor/latest/apireference/tags-resourcearn.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutPlaybackConfiguration")
    def to_put_playback_configuration(self) -> "Mediatailor":
        '''(experimental) Grants permission to add a new configuration.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediatailor/latest/apireference/playbackconfiguration.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toPutPlaybackConfiguration", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Mediatailor":
        '''(experimental) Adds tags to the specified playback configuration resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediatailor/latest/apireference/tags-resourcearn.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Mediatailor":
        '''(experimental) Removes tags from the specified playback configuration resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediatailor/latest/apireference/tags-resourcearn.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toUntagResource", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Mgh(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Mgh"):
    '''(experimental) Statement provider for service `mgh <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmigrationhub.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `mgh <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmigrationhub.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Mgh, self, [sid])

    @jsii.member(jsii_name="onMigrationTask")
    def on_migration_task(
        self,
        stream: builtins.str,
        task: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mgh":
        '''(experimental) Adds a resource of type migrationTask to the statement.

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_MigrationTask.html

        :param stream: - Identifier for the stream.
        :param task: - Identifier for the task.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "onMigrationTask", [stream, task, account, region, partition]))

    @jsii.member(jsii_name="onProgressUpdateStream")
    def on_progress_update_stream(
        self,
        stream: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mgh":
        '''(experimental) Adds a resource of type progressUpdateStream to the statement.

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_ProgressUpdateStreamSummary.html

        :param stream: - Identifier for the stream.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "onProgressUpdateStream", [stream, account, region, partition]))

    @jsii.member(jsii_name="toAssociateCreatedArtifact")
    def to_associate_created_artifact(self) -> "Mgh":
        '''(experimental) Associate a given AWS artifact to a MigrationTask.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_AssociateCreatedArtifact.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toAssociateCreatedArtifact", []))

    @jsii.member(jsii_name="toAssociateDiscoveredResource")
    def to_associate_discovered_resource(self) -> "Mgh":
        '''(experimental) Associate a given ADS resource to a MigrationTask.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_AssociateDiscoveredResource.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toAssociateDiscoveredResource", []))

    @jsii.member(jsii_name="toCreateHomeRegionControl")
    def to_create_home_region_control(self) -> "Mgh":
        '''(experimental) Create a Migration Hub Home Region Control.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_CreateHomeRegionControl.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toCreateHomeRegionControl", []))

    @jsii.member(jsii_name="toCreateProgressUpdateStream")
    def to_create_progress_update_stream(self) -> "Mgh":
        '''(experimental) Create a ProgressUpdateStream.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_CreateProgressUpdateStream.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toCreateProgressUpdateStream", []))

    @jsii.member(jsii_name="toDeleteProgressUpdateStream")
    def to_delete_progress_update_stream(self) -> "Mgh":
        '''(experimental) Delete a ProgressUpdateStream.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_DeleteProgressUpdateStream.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toDeleteProgressUpdateStream", []))

    @jsii.member(jsii_name="toDescribeApplicationState")
    def to_describe_application_state(self) -> "Mgh":
        '''(experimental) Get an Application Discovery Service Application's state.

        Access Level: Read

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_DescribeApplicationState.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toDescribeApplicationState", []))

    @jsii.member(jsii_name="toDescribeHomeRegionControls")
    def to_describe_home_region_controls(self) -> "Mgh":
        '''(experimental) List Home Region Controls.

        Access Level: List

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_DescribeHomeRegionControls.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toDescribeHomeRegionControls", []))

    @jsii.member(jsii_name="toDescribeMigrationTask")
    def to_describe_migration_task(self) -> "Mgh":
        '''(experimental) Describe a MigrationTask.

        Access Level: Read

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_DescribeMigrationTask.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toDescribeMigrationTask", []))

    @jsii.member(jsii_name="toDisassociateCreatedArtifact")
    def to_disassociate_created_artifact(self) -> "Mgh":
        '''(experimental) Disassociate a given AWS artifact from a MigrationTask.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_DisassociateCreatedArtifact.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toDisassociateCreatedArtifact", []))

    @jsii.member(jsii_name="toDisassociateDiscoveredResource")
    def to_disassociate_discovered_resource(self) -> "Mgh":
        '''(experimental) Disassociate a given ADS resource from a MigrationTask.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_DisassociateDiscoveredResource.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toDisassociateDiscoveredResource", []))

    @jsii.member(jsii_name="toGetHomeRegion")
    def to_get_home_region(self) -> "Mgh":
        '''(experimental) Get the Migration Hub Home Region.

        Access Level: Read

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_GetHomeRegion.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toGetHomeRegion", []))

    @jsii.member(jsii_name="toImportMigrationTask")
    def to_import_migration_task(self) -> "Mgh":
        '''(experimental) Import a MigrationTask.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_ImportMigrationTask.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toImportMigrationTask", []))

    @jsii.member(jsii_name="toListCreatedArtifacts")
    def to_list_created_artifacts(self) -> "Mgh":
        '''(experimental) List associated created artifacts for a MigrationTask.

        Access Level: List

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_ListCreatedArtifacts.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toListCreatedArtifacts", []))

    @jsii.member(jsii_name="toListDiscoveredResources")
    def to_list_discovered_resources(self) -> "Mgh":
        '''(experimental) List associated ADS resources from MigrationTask.

        Access Level: List

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_ListDiscoveredResources.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toListDiscoveredResources", []))

    @jsii.member(jsii_name="toListMigrationTasks")
    def to_list_migration_tasks(self) -> "Mgh":
        '''(experimental) List MigrationTasks.

        Access Level: List

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_ListMigrationTasks.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toListMigrationTasks", []))

    @jsii.member(jsii_name="toListProgressUpdateStreams")
    def to_list_progress_update_streams(self) -> "Mgh":
        '''(experimental) List ProgressUpdateStreams.

        Access Level: List

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_ListProgressUpdateStreams.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toListProgressUpdateStreams", []))

    @jsii.member(jsii_name="toNotifyApplicationState")
    def to_notify_application_state(self) -> "Mgh":
        '''(experimental) Update an Application Discovery Service Application's state.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_NotifyApplicationState.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toNotifyApplicationState", []))

    @jsii.member(jsii_name="toNotifyMigrationTaskState")
    def to_notify_migration_task_state(self) -> "Mgh":
        '''(experimental) Notify latest MigrationTask state.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_NotifyMigrationTaskState.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toNotifyMigrationTaskState", []))

    @jsii.member(jsii_name="toPutResourceAttributes")
    def to_put_resource_attributes(self) -> "Mgh":
        '''(experimental) Put ResourceAttributes.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_PutResourceAttributes.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toPutResourceAttributes", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Mgn(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Mgn"):
    '''(experimental) Statement provider for service `mgn <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsapplicationmigrationservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `mgn <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsapplicationmigrationservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Mgn, self, [sid])

    @jsii.member(jsii_name="onJobResource")
    def on_job_resource(
        self,
        job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mgn":
        '''(experimental) Adds a resource of type JobResource to the statement.

        https://docs.aws.amazon.com/ApplicationMigrationService/latest/ug/launching-target-servers.html

        :param job_id: - Identifier for the jobID.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "onJobResource", [job_id, account, region, partition]))

    @jsii.member(jsii_name="onReplicationConfigurationTemplateResource")
    def on_replication_configuration_template_resource(
        self,
        replication_configuration_template_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mgn":
        '''(experimental) Adds a resource of type ReplicationConfigurationTemplateResource to the statement.

        https://docs.aws.amazon.com/ApplicationMigrationService/latest/ug/replication-settings-template.html

        :param replication_configuration_template_id: - Identifier for the replicationConfigurationTemplateID.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "onReplicationConfigurationTemplateResource", [replication_configuration_template_id, account, region, partition]))

    @jsii.member(jsii_name="onSourceServerResource")
    def on_source_server_resource(
        self,
        source_server_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mgn":
        '''(experimental) Adds a resource of type SourceServerResource to the statement.

        https://docs.aws.amazon.com/ApplicationMigrationService/latest/ug/source-servers.html

        :param source_server_id: - Identifier for the sourceServerID.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "onSourceServerResource", [source_server_id, account, region, partition]))

    @jsii.member(jsii_name="toBatchCreateVolumeSnapshotGroupForMgn")
    def to_batch_create_volume_snapshot_group_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to create volume snapshot group.

        Access Level: Write

        https://docs.aws.amazon.com/ApplicationMigrationService/latest/ug/

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toBatchCreateVolumeSnapshotGroupForMgn", []))

    @jsii.member(jsii_name="toBatchDeleteSnapshotRequestForMgn")
    def to_batch_delete_snapshot_request_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to batch delete snapshot request.

        Access Level: Write

        https://docs.aws.amazon.com/ApplicationMigrationService/latest/ug/

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toBatchDeleteSnapshotRequestForMgn", []))

    @jsii.member(jsii_name="toChangeServerLifeCycleState")
    def to_change_server_life_cycle_state(self) -> "Mgn":
        '''(experimental) Grants permission to change source server life cycle state.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_ChangeServerLifeCycleState.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toChangeServerLifeCycleState", []))

    @jsii.member(jsii_name="toCreateReplicationConfigurationTemplate")
    def to_create_replication_configuration_template(self) -> "Mgn":
        '''(experimental) Grants permission to create replication configuration template.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_CreateReplicationConfigurationTemplate.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toCreateReplicationConfigurationTemplate", []))

    @jsii.member(jsii_name="toDeleteJob")
    def to_delete_job(self) -> "Mgn":
        '''(experimental) Grants permission to delete job.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_DeleteJob.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toDeleteJob", []))

    @jsii.member(jsii_name="toDeleteReplicationConfigurationTemplate")
    def to_delete_replication_configuration_template(self) -> "Mgn":
        '''(experimental) Grants permission to delete replication configuration template.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_DeleteReplicationConfigurationTemplate.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toDeleteReplicationConfigurationTemplate", []))

    @jsii.member(jsii_name="toDeleteSourceServer")
    def to_delete_source_server(self) -> "Mgn":
        '''(experimental) Grants permission to delete source server.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_DeleteSourceServer.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toDeleteSourceServer", []))

    @jsii.member(jsii_name="toDescribeJobLogItems")
    def to_describe_job_log_items(self) -> "Mgn":
        '''(experimental) Grants permission to describe job log items.

        Access Level: Read

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_DescribeJobLogItems.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toDescribeJobLogItems", []))

    @jsii.member(jsii_name="toDescribeJobs")
    def to_describe_jobs(self) -> "Mgn":
        '''(experimental) Grants permission to describe jobs.

        Access Level: List

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_DescribeJobs.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toDescribeJobs", []))

    @jsii.member(jsii_name="toDescribeReplicationConfigurationTemplates")
    def to_describe_replication_configuration_templates(self) -> "Mgn":
        '''(experimental) Grants permission to describe replication configuration template.

        Access Level: List

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_DescribeReplicationConfigurationTemplates.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toDescribeReplicationConfigurationTemplates", []))

    @jsii.member(jsii_name="toDescribeReplicationServerAssociationsForMgn")
    def to_describe_replication_server_associations_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to describe replication server associations.

        Access Level: Read

        https://docs.aws.amazon.com/ApplicationMigrationService/latest/ug/

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toDescribeReplicationServerAssociationsForMgn", []))

    @jsii.member(jsii_name="toDescribeSnapshotRequestsForMgn")
    def to_describe_snapshot_requests_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to describe snapshots requests.

        Access Level: Read

        https://docs.aws.amazon.com/ApplicationMigrationService/latest/ug/

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toDescribeSnapshotRequestsForMgn", []))

    @jsii.member(jsii_name="toDescribeSourceServers")
    def to_describe_source_servers(self) -> "Mgn":
        '''(experimental) Grants permission to describe source servers.

        Access Level: List

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_DescribeSourceServers.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toDescribeSourceServers", []))

    @jsii.member(jsii_name="toDisconnectFromService")
    def to_disconnect_from_service(self) -> "Mgn":
        '''(experimental) Grants permission to disconnect source server from service.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_DisconnectFromService.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toDisconnectFromService", []))

    @jsii.member(jsii_name="toFinalizeCutover")
    def to_finalize_cutover(self) -> "Mgn":
        '''(experimental) Grants permission to finalize cutover.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_FinalizeCutover.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toFinalizeCutover", []))

    @jsii.member(jsii_name="toGetAgentCommandForMgn")
    def to_get_agent_command_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to get agent command.

        Access Level: Read

        https://docs.aws.amazon.com/ApplicationMigrationService/latest/ug/

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toGetAgentCommandForMgn", []))

    @jsii.member(jsii_name="toGetAgentConfirmedResumeInfoForMgn")
    def to_get_agent_confirmed_resume_info_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to get agent confirmed resume info.

        Access Level: Read

        https://docs.aws.amazon.com/ApplicationMigrationService/latest/ug/

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toGetAgentConfirmedResumeInfoForMgn", []))

    @jsii.member(jsii_name="toGetAgentInstallationAssetsForMgn")
    def to_get_agent_installation_assets_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to get agent installation assets.

        Access Level: Read

        https://docs.aws.amazon.com/ApplicationMigrationService/latest/ug/

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toGetAgentInstallationAssetsForMgn", []))

    @jsii.member(jsii_name="toGetAgentReplicationInfoForMgn")
    def to_get_agent_replication_info_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to get agent replication info.

        Access Level: Read

        https://docs.aws.amazon.com/ApplicationMigrationService/latest/ug/

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toGetAgentReplicationInfoForMgn", []))

    @jsii.member(jsii_name="toGetAgentRuntimeConfigurationForMgn")
    def to_get_agent_runtime_configuration_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to get agent runtime configuration.

        Access Level: Read

        https://docs.aws.amazon.com/ApplicationMigrationService/latest/ug/

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toGetAgentRuntimeConfigurationForMgn", []))

    @jsii.member(jsii_name="toGetAgentSnapshotCreditsForMgn")
    def to_get_agent_snapshot_credits_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to get agent snapshots credits.

        Access Level: Read

        https://docs.aws.amazon.com/ApplicationMigrationService/latest/ug/

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toGetAgentSnapshotCreditsForMgn", []))

    @jsii.member(jsii_name="toGetChannelCommandsForMgn")
    def to_get_channel_commands_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to get channel commands.

        Access Level: Read

        https://docs.aws.amazon.com/ApplicationMigrationService/latest/ug/

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toGetChannelCommandsForMgn", []))

    @jsii.member(jsii_name="toGetLaunchConfiguration")
    def to_get_launch_configuration(self) -> "Mgn":
        '''(experimental) Grants permission to get launch configuration.

        Access Level: Read

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_GetLaunchConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toGetLaunchConfiguration", []))

    @jsii.member(jsii_name="toGetReplicationConfiguration")
    def to_get_replication_configuration(self) -> "Mgn":
        '''(experimental) Grants permission to get replication configuration.

        Access Level: Read

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_GetReplicationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toGetReplicationConfiguration", []))

    @jsii.member(jsii_name="toInitializeService")
    def to_initialize_service(self) -> "Mgn":
        '''(experimental) Grants permission to initialize service.

        Access Level: Write

        Dependent actions:

        - iam:AddRoleToInstanceProfile
        - iam:CreateInstanceProfile
        - iam:CreateServiceLinkedRole
        - iam:GetInstanceProfile

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_InitializeService.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toInitializeService", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Mgn":
        '''(experimental) Grants permission to list tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toMarkAsArchived")
    def to_mark_as_archived(self) -> "Mgn":
        '''(experimental) Grants permission to mark source server as archived.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_MarkAsArchived.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toMarkAsArchived", []))

    @jsii.member(jsii_name="toNotifyAgentAuthenticationForMgn")
    def to_notify_agent_authentication_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to notify agent authentication.

        Access Level: Write

        https://docs.aws.amazon.com/ApplicationMigrationService/latest/ug/

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toNotifyAgentAuthenticationForMgn", []))

    @jsii.member(jsii_name="toNotifyAgentConnectedForMgn")
    def to_notify_agent_connected_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to notify agent is connected.

        Access Level: Write

        https://docs.aws.amazon.com/ApplicationMigrationService/latest/ug/

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toNotifyAgentConnectedForMgn", []))

    @jsii.member(jsii_name="toNotifyAgentDisconnectedForMgn")
    def to_notify_agent_disconnected_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to notify agent is disconnected.

        Access Level: Write

        https://docs.aws.amazon.com/ApplicationMigrationService/latest/ug/

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toNotifyAgentDisconnectedForMgn", []))

    @jsii.member(jsii_name="toNotifyAgentReplicationProgressForMgn")
    def to_notify_agent_replication_progress_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to notify agent replication progress.

        Access Level: Write

        https://docs.aws.amazon.com/ApplicationMigrationService/latest/ug/

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toNotifyAgentReplicationProgressForMgn", []))

    @jsii.member(jsii_name="toRegisterAgentForMgn")
    def to_register_agent_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to register agent.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/ApplicationMigrationService/latest/ug/

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toRegisterAgentForMgn", []))

    @jsii.member(jsii_name="toRetryDataReplication")
    def to_retry_data_replication(self) -> "Mgn":
        '''(experimental) Grants permission to retry replication.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_RetryDataReplication.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toRetryDataReplication", []))

    @jsii.member(jsii_name="toSendAgentLogsForMgn")
    def to_send_agent_logs_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to send agent logs.

        Access Level: Write

        https://docs.aws.amazon.com/ApplicationMigrationService/latest/ug/

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toSendAgentLogsForMgn", []))

    @jsii.member(jsii_name="toSendAgentMetricsForMgn")
    def to_send_agent_metrics_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to send agent metrics.

        Access Level: Write

        https://docs.aws.amazon.com/ApplicationMigrationService/latest/ug/

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toSendAgentMetricsForMgn", []))

    @jsii.member(jsii_name="toSendChannelCommandResultForMgn")
    def to_send_channel_command_result_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to send channel command result.

        Access Level: Write

        https://docs.aws.amazon.com/ApplicationMigrationService/latest/ug/

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toSendChannelCommandResultForMgn", []))

    @jsii.member(jsii_name="toSendClientLogsForMgn")
    def to_send_client_logs_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to send client logs.

        Access Level: Write

        https://docs.aws.amazon.com/ApplicationMigrationService/latest/ug/

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toSendClientLogsForMgn", []))

    @jsii.member(jsii_name="toSendClientMetricsForMgn")
    def to_send_client_metrics_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to send client metrics.

        Access Level: Write

        https://docs.aws.amazon.com/ApplicationMigrationService/latest/ug/

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toSendClientMetricsForMgn", []))

    @jsii.member(jsii_name="toStartCutover")
    def to_start_cutover(self) -> "Mgn":
        '''(experimental) Grants permission to start cutover.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - ec2:AttachVolume
        - ec2:AuthorizeSecurityGroupEgress
        - ec2:AuthorizeSecurityGroupIngress
        - ec2:CreateLaunchTemplate
        - ec2:CreateLaunchTemplateVersion
        - ec2:CreateSecurityGroup
        - ec2:CreateSnapshot
        - ec2:CreateTags
        - ec2:CreateVolume
        - ec2:DeleteLaunchTemplateVersions
        - ec2:DeleteSnapshot
        - ec2:DeleteVolume
        - ec2:DescribeAccountAttributes
        - ec2:DescribeAvailabilityZones
        - ec2:DescribeImages
        - ec2:DescribeInstanceAttribute
        - ec2:DescribeInstanceStatus
        - ec2:DescribeInstanceTypes
        - ec2:DescribeInstances
        - ec2:DescribeLaunchTemplateVersions
        - ec2:DescribeLaunchTemplates
        - ec2:DescribeSecurityGroups
        - ec2:DescribeSnapshots
        - ec2:DescribeSubnets
        - ec2:DescribeVolumes
        - ec2:DetachVolume
        - ec2:ModifyInstanceAttribute
        - ec2:ModifyLaunchTemplate
        - ec2:ReportInstanceStatus
        - ec2:RevokeSecurityGroupEgress
        - ec2:RunInstances
        - ec2:StartInstances
        - ec2:StopInstances
        - ec2:TerminateInstances
        - iam:PassRole
        - mgn:ListTagsForResource

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_StartCutover.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toStartCutover", []))

    @jsii.member(jsii_name="toStartTest")
    def to_start_test(self) -> "Mgn":
        '''(experimental) Grants permission to start test.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - ec2:AttachVolume
        - ec2:AuthorizeSecurityGroupEgress
        - ec2:AuthorizeSecurityGroupIngress
        - ec2:CreateLaunchTemplate
        - ec2:CreateLaunchTemplateVersion
        - ec2:CreateSecurityGroup
        - ec2:CreateSnapshot
        - ec2:CreateTags
        - ec2:CreateVolume
        - ec2:DeleteLaunchTemplateVersions
        - ec2:DeleteSnapshot
        - ec2:DeleteVolume
        - ec2:DescribeAccountAttributes
        - ec2:DescribeAvailabilityZones
        - ec2:DescribeImages
        - ec2:DescribeInstanceAttribute
        - ec2:DescribeInstanceStatus
        - ec2:DescribeInstanceTypes
        - ec2:DescribeInstances
        - ec2:DescribeLaunchTemplateVersions
        - ec2:DescribeLaunchTemplates
        - ec2:DescribeSecurityGroups
        - ec2:DescribeSnapshots
        - ec2:DescribeSubnets
        - ec2:DescribeVolumes
        - ec2:DetachVolume
        - ec2:ModifyInstanceAttribute
        - ec2:ModifyLaunchTemplate
        - ec2:ReportInstanceStatus
        - ec2:RevokeSecurityGroupEgress
        - ec2:RunInstances
        - ec2:StartInstances
        - ec2:StopInstances
        - ec2:TerminateInstances
        - iam:PassRole
        - mgn:ListTagsForResource

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_StartTest.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toStartTest", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Mgn":
        '''(experimental) Grants permission to assign a resource tag.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTerminateTargetInstances")
    def to_terminate_target_instances(self) -> "Mgn":
        '''(experimental) Grants permission to terminate target instances.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - ec2:DeleteVolume
        - ec2:DescribeInstances
        - ec2:DescribeVolumes
        - ec2:TerminateInstances

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_TerminateTargetInstances.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toTerminateTargetInstances", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Mgn":
        '''(experimental) Grants permission to untag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAgentBacklogForMgn")
    def to_update_agent_backlog_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to update agent backlog.

        Access Level: Write

        https://docs.aws.amazon.com/ApplicationMigrationService/latest/ug/

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toUpdateAgentBacklogForMgn", []))

    @jsii.member(jsii_name="toUpdateAgentConversionInfoForMgn")
    def to_update_agent_conversion_info_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to update agent conversion info.

        Access Level: Write

        https://docs.aws.amazon.com/ApplicationMigrationService/latest/ug/

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toUpdateAgentConversionInfoForMgn", []))

    @jsii.member(jsii_name="toUpdateAgentReplicationInfoForMgn")
    def to_update_agent_replication_info_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to update agent replication info.

        Access Level: Write

        https://docs.aws.amazon.com/ApplicationMigrationService/latest/ug/

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toUpdateAgentReplicationInfoForMgn", []))

    @jsii.member(jsii_name="toUpdateAgentReplicationProcessStateForMgn")
    def to_update_agent_replication_process_state_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to update agent replication process state.

        Access Level: Write

        https://docs.aws.amazon.com/ApplicationMigrationService/latest/ug/

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toUpdateAgentReplicationProcessStateForMgn", []))

    @jsii.member(jsii_name="toUpdateAgentSourcePropertiesForMgn")
    def to_update_agent_source_properties_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to update agent source properties.

        Access Level: Write

        https://docs.aws.amazon.com/ApplicationMigrationService/latest/ug/

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toUpdateAgentSourcePropertiesForMgn", []))

    @jsii.member(jsii_name="toUpdateLaunchConfiguration")
    def to_update_launch_configuration(self) -> "Mgn":
        '''(experimental) Grants permission to update launch configuration.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_UpdateLaunchConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toUpdateLaunchConfiguration", []))

    @jsii.member(jsii_name="toUpdateReplicationConfiguration")
    def to_update_replication_configuration(self) -> "Mgn":
        '''(experimental) Grants permission to update replication configuration.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_UpdateReplicationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toUpdateReplicationConfiguration", []))

    @jsii.member(jsii_name="toUpdateReplicationConfigurationTemplate")
    def to_update_replication_configuration_template(self) -> "Mgn":
        '''(experimental) Grants permission to update replication configuration template.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_UpdateReplicationConfigurationTemplate.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toUpdateReplicationConfigurationTemplate", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Mobileanalytics(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Mobileanalytics",
):
    '''(experimental) Statement provider for service `mobileanalytics <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmobileanalytics.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `mobileanalytics <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmobileanalytics.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Mobileanalytics, self, [sid])

    @jsii.member(jsii_name="toGetFinancialReports")
    def to_get_financial_reports(self) -> "Mobileanalytics":
        '''(experimental) Grant access to financial metrics for an app.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Mobileanalytics", jsii.invoke(self, "toGetFinancialReports", []))

    @jsii.member(jsii_name="toGetReports")
    def to_get_reports(self) -> "Mobileanalytics":
        '''(experimental) Grant access to standard metrics for an app.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Mobileanalytics", jsii.invoke(self, "toGetReports", []))

    @jsii.member(jsii_name="toPutEvents")
    def to_put_events(self) -> "Mobileanalytics":
        '''(experimental) The PutEvents operation records one or more events.

        Access Level: Write

        https://docs.aws.amazon.com/mobileanalytics/latest/ug/PutEvents.html

        :stability: experimental
        '''
        return typing.cast("Mobileanalytics", jsii.invoke(self, "toPutEvents", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Mobilehub(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Mobilehub",
):
    '''(experimental) Statement provider for service `mobilehub <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmobilehub.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `mobilehub <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmobilehub.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Mobilehub, self, [sid])

    @jsii.member(jsii_name="onProject")
    def on_project(
        self,
        project_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mobilehub":
        '''(experimental) Adds a resource of type project to the statement.

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/reference-mobile-hub-iam-managed-policies.html

        :param project_id: - Identifier for the projectId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "onProject", [project_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateProject")
    def to_create_project(self) -> "Mobilehub":
        '''(experimental) Create a project.

        Access Level: Write

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toCreateProject", []))

    @jsii.member(jsii_name="toCreateServiceRole")
    def to_create_service_role(self) -> "Mobilehub":
        '''(experimental) Enable AWS Mobile Hub in the account by creating the required service role.

        Access Level: Write

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toCreateServiceRole", []))

    @jsii.member(jsii_name="toDeleteProject")
    def to_delete_project(self) -> "Mobilehub":
        '''(experimental) Delete the specified project.

        Access Level: Write

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toDeleteProject", []))

    @jsii.member(jsii_name="toDeleteProjectSnapshot")
    def to_delete_project_snapshot(self) -> "Mobilehub":
        '''(experimental) Delete a saved snapshot of project configuration.

        Access Level: Write

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toDeleteProjectSnapshot", []))

    @jsii.member(jsii_name="toDeployToStage")
    def to_deploy_to_stage(self) -> "Mobilehub":
        '''(experimental) Deploy changes to the specified stage.

        Access Level: Write

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toDeployToStage", []))

    @jsii.member(jsii_name="toDescribeBundle")
    def to_describe_bundle(self) -> "Mobilehub":
        '''(experimental) Describe the download bundle.

        Access Level: Read

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toDescribeBundle", []))

    @jsii.member(jsii_name="toExportBundle")
    def to_export_bundle(self) -> "Mobilehub":
        '''(experimental) Export the download bundle.

        Access Level: Read

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toExportBundle", []))

    @jsii.member(jsii_name="toExportProject")
    def to_export_project(self) -> "Mobilehub":
        '''(experimental) Export the project configuration.

        Access Level: Read

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toExportProject", []))

    @jsii.member(jsii_name="toGenerateProjectParameters")
    def to_generate_project_parameters(self) -> "Mobilehub":
        '''(experimental) Generate project parameters required for code generation.

        Access Level: Read

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toGenerateProjectParameters", []))

    @jsii.member(jsii_name="toGetProject")
    def to_get_project(self) -> "Mobilehub":
        '''(experimental) Get project configuration and resources.

        Access Level: Read

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toGetProject", []))

    @jsii.member(jsii_name="toGetProjectSnapshot")
    def to_get_project_snapshot(self) -> "Mobilehub":
        '''(experimental) Fetch the previously exported project configuration snapshot.

        Access Level: Read

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toGetProjectSnapshot", []))

    @jsii.member(jsii_name="toImportProject")
    def to_import_project(self) -> "Mobilehub":
        '''(experimental) Create a new project from the previously exported project configuration.

        Access Level: Write

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toImportProject", []))

    @jsii.member(jsii_name="toInstallBundle")
    def to_install_bundle(self) -> "Mobilehub":
        '''(experimental) Install a bundle in the project deployments S3 bucket.

        Access Level: Write

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toInstallBundle", []))

    @jsii.member(jsii_name="toListAvailableConnectors")
    def to_list_available_connectors(self) -> "Mobilehub":
        '''(experimental) List the available SaaS (Software as a Service) connectors.

        Access Level: List

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toListAvailableConnectors", []))

    @jsii.member(jsii_name="toListAvailableFeatures")
    def to_list_available_features(self) -> "Mobilehub":
        '''(experimental) List available features.

        Access Level: List

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toListAvailableFeatures", []))

    @jsii.member(jsii_name="toListAvailableRegions")
    def to_list_available_regions(self) -> "Mobilehub":
        '''(experimental) List available regions for projects.

        Access Level: List

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toListAvailableRegions", []))

    @jsii.member(jsii_name="toListBundles")
    def to_list_bundles(self) -> "Mobilehub":
        '''(experimental) List the available download bundles.

        Access Level: List

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toListBundles", []))

    @jsii.member(jsii_name="toListProjects")
    def to_list_projects(self) -> "Mobilehub":
        '''(experimental) List projects.

        Access Level: List

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toListProjects", []))

    @jsii.member(jsii_name="toListProjectSnapshots")
    def to_list_project_snapshots(self) -> "Mobilehub":
        '''(experimental) List saved snapshots of project configuration.

        Access Level: List

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toListProjectSnapshots", []))

    @jsii.member(jsii_name="toSynchronizeProject")
    def to_synchronize_project(self) -> "Mobilehub":
        '''(experimental) Synchronize state of resources into project.

        Access Level: Write

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toSynchronizeProject", []))

    @jsii.member(jsii_name="toUpdateProject")
    def to_update_project(self) -> "Mobilehub":
        '''(experimental) Update project.

        Access Level: Write

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toUpdateProject", []))

    @jsii.member(jsii_name="toValidateProject")
    def to_validate_project(self) -> "Mobilehub":
        '''(experimental) Validate a mobile hub project.

        Access Level: Read

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toValidateProject", []))

    @jsii.member(jsii_name="toVerifyServiceRole")
    def to_verify_service_role(self) -> "Mobilehub":
        '''(experimental) Verify AWS Mobile Hub is enabled in the account.

        Access Level: Read

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toVerifyServiceRole", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Mobiletargeting(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Mobiletargeting",
):
    '''(experimental) Statement provider for service `mobiletargeting <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonpinpoint.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `mobiletargeting <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonpinpoint.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Mobiletargeting, self, [sid])

    @jsii.member(jsii_name="onApps")
    def on_apps(
        self,
        app_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mobiletargeting":
        '''(experimental) Adds a resource of type apps to the statement.

        https://docs.aws.amazon.com/pinpoint/latest/developerguide/gettingstarted.html#gettingstarted-addapp

        :param app_id: - Identifier for the appId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "onApps", [app_id, account, region, partition]))

    @jsii.member(jsii_name="onCampaigns")
    def on_campaigns(
        self,
        app_id: builtins.str,
        campaign_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mobiletargeting":
        '''(experimental) Adds a resource of type campaigns to the statement.

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-campaigns.html

        :param app_id: - Identifier for the appId.
        :param campaign_id: - Identifier for the campaignId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "onCampaigns", [app_id, campaign_id, account, region, partition]))

    @jsii.member(jsii_name="onJourneys")
    def on_journeys(
        self,
        app_id: builtins.str,
        journey_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mobiletargeting":
        '''(experimental) Adds a resource of type journeys to the statement.

        https://docs.aws.amazon.com/pinpoint/latest/apireference/apps-application-id-journeys.html

        :param app_id: - Identifier for the appId.
        :param journey_id: - Identifier for the journeyId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "onJourneys", [app_id, journey_id, account, region, partition]))

    @jsii.member(jsii_name="onRecommenders")
    def on_recommenders(
        self,
        recommender_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mobiletargeting":
        '''(experimental) Adds a resource of type recommenders to the statement.

        https://docs.aws.amazon.com/pinpoint/latest/apireference/recommenders.html

        :param recommender_id: - Identifier for the recommenderId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "onRecommenders", [recommender_id, account, region, partition]))

    @jsii.member(jsii_name="onSegments")
    def on_segments(
        self,
        app_id: builtins.str,
        segment_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mobiletargeting":
        '''(experimental) Adds a resource of type segments to the statement.

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-segments.html

        :param app_id: - Identifier for the appId.
        :param segment_id: - Identifier for the segmentId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "onSegments", [app_id, segment_id, account, region, partition]))

    @jsii.member(jsii_name="onTemplates")
    def on_templates(
        self,
        template_name: builtins.str,
        channel_type: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mobiletargeting":
        '''(experimental) Adds a resource of type templates to the statement.

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates.html

        :param template_name: - Identifier for the templateName.
        :param channel_type: - Identifier for the channelType.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "onTemplates", [template_name, channel_type, account, region, partition]))

    @jsii.member(jsii_name="toCreateApp")
    def to_create_app(self) -> "Mobiletargeting":
        '''(experimental) Create an app.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-app.html#rest-api-app-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toCreateApp", []))

    @jsii.member(jsii_name="toCreateCampaign")
    def to_create_campaign(self) -> "Mobiletargeting":
        '''(experimental) Create a campaign for an app.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-campaigns.html#rest-api-campaigns-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toCreateCampaign", []))

    @jsii.member(jsii_name="toCreateEmailTemplate")
    def to_create_email_template(self) -> "Mobiletargeting":
        '''(experimental) Create an email template.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-email.html#templates-template-name-email-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toCreateEmailTemplate", []))

    @jsii.member(jsii_name="toCreateExportJob")
    def to_create_export_job(self) -> "Mobiletargeting":
        '''(experimental) Create an export job that exports endpoint definitions to Amazon S3.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-export-jobs.html#rest-api-export-jobs-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toCreateExportJob", []))

    @jsii.member(jsii_name="toCreateImportJob")
    def to_create_import_job(self) -> "Mobiletargeting":
        '''(experimental) Import endpoint definitions from to create a segment.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-import-jobs.html#rest-api-import-jobs-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toCreateImportJob", []))

    @jsii.member(jsii_name="toCreateJourney")
    def to_create_journey(self) -> "Mobiletargeting":
        '''(experimental) Create a Journey for an app.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/apps-application-id-journeys-journey-id.html#apps-application-id-journeys-journey-id-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toCreateJourney", []))

    @jsii.member(jsii_name="toCreatePushTemplate")
    def to_create_push_template(self) -> "Mobiletargeting":
        '''(experimental) Create a push notification template.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-push.html#templates-template-name-push-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toCreatePushTemplate", []))

    @jsii.member(jsii_name="toCreateRecommenderConfiguration")
    def to_create_recommender_configuration(self) -> "Mobiletargeting":
        '''(experimental) Create an Amazon Pinpoint configuration for a recommender model.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/recommenders.html#CreateRecommenderConfiguration

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toCreateRecommenderConfiguration", []))

    @jsii.member(jsii_name="toCreateSegment")
    def to_create_segment(self) -> "Mobiletargeting":
        '''(experimental) Create a segment that is based on endpoint data reported to Pinpoint by your app.

        To allow a user to create a segment by importing endpoint data from outside of Pinpoint, allow the mobiletargeting:CreateImportJob action.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-segments.html#rest-api-segments-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toCreateSegment", []))

    @jsii.member(jsii_name="toCreateSmsTemplate")
    def to_create_sms_template(self) -> "Mobiletargeting":
        '''(experimental) Create an sms message template.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-sms.html#templates-template-name-sms-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toCreateSmsTemplate", []))

    @jsii.member(jsii_name="toCreateVoiceTemplate")
    def to_create_voice_template(self) -> "Mobiletargeting":
        '''(experimental) Create a voice message template.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-voice.html#templates-template-name-voice-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toCreateVoiceTemplate", []))

    @jsii.member(jsii_name="toDeleteAdmChannel")
    def to_delete_adm_channel(self) -> "Mobiletargeting":
        '''(experimental) Delete the ADM channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-adm-channel.html#rest-api-adm-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteAdmChannel", []))

    @jsii.member(jsii_name="toDeleteApnsChannel")
    def to_delete_apns_channel(self) -> "Mobiletargeting":
        '''(experimental) Delete the APNs channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-apns-channel.html#rest-api-apns-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteApnsChannel", []))

    @jsii.member(jsii_name="toDeleteApnsSandboxChannel")
    def to_delete_apns_sandbox_channel(self) -> "Mobiletargeting":
        '''(experimental) Delete the APNs sandbox channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-apns-sandbox-channel.html#rest-api-apns-sandbox-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteApnsSandboxChannel", []))

    @jsii.member(jsii_name="toDeleteApnsVoipChannel")
    def to_delete_apns_voip_channel(self) -> "Mobiletargeting":
        '''(experimental) Delete the APNs VoIP channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-apns-voip-channel.html#rest-api-apns-voip-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteApnsVoipChannel", []))

    @jsii.member(jsii_name="toDeleteApnsVoipSandboxChannel")
    def to_delete_apns_voip_sandbox_channel(self) -> "Mobiletargeting":
        '''(experimental) Delete the APNs VoIP sandbox channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-apns-voip-sandbox-channel.html#rest-api-apns-voip-sandbox-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteApnsVoipSandboxChannel", []))

    @jsii.member(jsii_name="toDeleteApp")
    def to_delete_app(self) -> "Mobiletargeting":
        '''(experimental) Delete a specific campaign.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-app.html#rest-api-app-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteApp", []))

    @jsii.member(jsii_name="toDeleteBaiduChannel")
    def to_delete_baidu_channel(self) -> "Mobiletargeting":
        '''(experimental) Delete the Baidu channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-baidu-channel.html#rest-api-baidu-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteBaiduChannel", []))

    @jsii.member(jsii_name="toDeleteCampaign")
    def to_delete_campaign(self) -> "Mobiletargeting":
        '''(experimental) Delete a specific campaign.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-campaign.html#rest-api-campaign-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteCampaign", []))

    @jsii.member(jsii_name="toDeleteEmailChannel")
    def to_delete_email_channel(self) -> "Mobiletargeting":
        '''(experimental) Delete the email channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-email-channel.html#rest-api-email-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteEmailChannel", []))

    @jsii.member(jsii_name="toDeleteEmailTemplate")
    def to_delete_email_template(self) -> "Mobiletargeting":
        '''(experimental) Delete an email template or an email template version.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-email.html#templates-template-name-email-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteEmailTemplate", []))

    @jsii.member(jsii_name="toDeleteEndpoint")
    def to_delete_endpoint(self) -> "Mobiletargeting":
        '''(experimental) Delete an endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-endpoint.html#rest-api-endpoint-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteEndpoint", []))

    @jsii.member(jsii_name="toDeleteEventStream")
    def to_delete_event_stream(self) -> "Mobiletargeting":
        '''(experimental) Delete the event stream for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-event-stream.html#rest-api-event-stream-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteEventStream", []))

    @jsii.member(jsii_name="toDeleteGcmChannel")
    def to_delete_gcm_channel(self) -> "Mobiletargeting":
        '''(experimental) Delete the GCM channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-gcm-channel.html#rest-api-gcm-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteGcmChannel", []))

    @jsii.member(jsii_name="toDeleteJourney")
    def to_delete_journey(self) -> "Mobiletargeting":
        '''(experimental) Delete a specific journey.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/apps-application-id-journeys-journey-id.html#apps-application-id-journeys-journey-id-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteJourney", []))

    @jsii.member(jsii_name="toDeletePushTemplate")
    def to_delete_push_template(self) -> "Mobiletargeting":
        '''(experimental) Delete a push notification template or a push notification template version.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-push.html#templates-template-name-push-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeletePushTemplate", []))

    @jsii.member(jsii_name="toDeleteRecommenderConfiguration")
    def to_delete_recommender_configuration(self) -> "Mobiletargeting":
        '''(experimental) Delete an Amazon Pinpoint configuration for a recommender model.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/recommenders-recommender-id.html#DeleteRecommenderConfiguration

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteRecommenderConfiguration", []))

    @jsii.member(jsii_name="toDeleteSegment")
    def to_delete_segment(self) -> "Mobiletargeting":
        '''(experimental) Delete a specific segment.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-segment.html#rest-api-segment-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteSegment", []))

    @jsii.member(jsii_name="toDeleteSmsChannel")
    def to_delete_sms_channel(self) -> "Mobiletargeting":
        '''(experimental) Delete the SMS channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-sms-channel.html#rest-api-sms-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteSmsChannel", []))

    @jsii.member(jsii_name="toDeleteSmsTemplate")
    def to_delete_sms_template(self) -> "Mobiletargeting":
        '''(experimental) Delete an sms message template or an sms message template version.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-sms.html#templates-template-name-sms-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteSmsTemplate", []))

    @jsii.member(jsii_name="toDeleteUserEndpoints")
    def to_delete_user_endpoints(self) -> "Mobiletargeting":
        '''(experimental) Delete all of the endpoints that are associated with a user ID.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-user.html#rest-api-user-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteUserEndpoints", []))

    @jsii.member(jsii_name="toDeleteVoiceChannel")
    def to_delete_voice_channel(self) -> "Mobiletargeting":
        '''(experimental) Delete the Voice channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-voice-channel.html#rest-api-voice-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteVoiceChannel", []))

    @jsii.member(jsii_name="toDeleteVoiceTemplate")
    def to_delete_voice_template(self) -> "Mobiletargeting":
        '''(experimental) Delete a voice message template or a voice message template version.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-voice.html#templates-template-name-voice-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteVoiceTemplate", []))

    @jsii.member(jsii_name="toGetAdmChannel")
    def to_get_adm_channel(self) -> "Mobiletargeting":
        '''(experimental) Retrieve information about the Amazon Device Messaging (ADM) channel for an app.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-adm-channel.html#rest-api-adm-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetAdmChannel", []))

    @jsii.member(jsii_name="toGetApnsChannel")
    def to_get_apns_channel(self) -> "Mobiletargeting":
        '''(experimental) Retrieve information about the APNs channel for an app.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-apns-channel.html#rest-api-apns-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetApnsChannel", []))

    @jsii.member(jsii_name="toGetApnsSandboxChannel")
    def to_get_apns_sandbox_channel(self) -> "Mobiletargeting":
        '''(experimental) Retrieve information about the APNs sandbox channel for an app.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-apns-sandbox-channel.html#rest-api-apns-sandbox-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetApnsSandboxChannel", []))

    @jsii.member(jsii_name="toGetApnsVoipChannel")
    def to_get_apns_voip_channel(self) -> "Mobiletargeting":
        '''(experimental) Retrieve information about the APNs VoIP channel for an app.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-apns-voip-channel.html#rest-api-apns-voip-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetApnsVoipChannel", []))

    @jsii.member(jsii_name="toGetApnsVoipSandboxChannel")
    def to_get_apns_voip_sandbox_channel(self) -> "Mobiletargeting":
        '''(experimental) Retrieve information about the APNs VoIP sandbox channel for an app.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-apns-voip-sandbox-channel.html#rest-api-apns-voip-sandbox-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetApnsVoipSandboxChannel", []))

    @jsii.member(jsii_name="toGetApp")
    def to_get_app(self) -> "Mobiletargeting":
        '''(experimental) Retrieve information about a specific app in your Amazon Pinpoint account.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-app.html#rest-api-app-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetApp", []))

    @jsii.member(jsii_name="toGetApplicationSettings")
    def to_get_application_settings(self) -> "Mobiletargeting":
        '''(experimental) Retrieve the default settings for an app.

        Access Level: List

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-settings.html#rest-api-settings-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetApplicationSettings", []))

    @jsii.member(jsii_name="toGetApps")
    def to_get_apps(self) -> "Mobiletargeting":
        '''(experimental) Retrieve a list of apps in your Amazon Pinpoint account.

        Access Level: List

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-apps.html#rest-api-apps-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetApps", []))

    @jsii.member(jsii_name="toGetBaiduChannel")
    def to_get_baidu_channel(self) -> "Mobiletargeting":
        '''(experimental) Retrieve information about the Baidu channel for an app.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-baidu-channel.html#rest-api-baidu-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetBaiduChannel", []))

    @jsii.member(jsii_name="toGetCampaign")
    def to_get_campaign(self) -> "Mobiletargeting":
        '''(experimental) Retrieve information about a specific campaign.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-campaign.html#rest-api-campaign-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetCampaign", []))

    @jsii.member(jsii_name="toGetCampaignActivities")
    def to_get_campaign_activities(self) -> "Mobiletargeting":
        '''(experimental) Retrieve information about the activities performed by a campaign.

        Access Level: List

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-campaign-activities.html#rest-api-campaign-activities-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetCampaignActivities", []))

    @jsii.member(jsii_name="toGetCampaigns")
    def to_get_campaigns(self) -> "Mobiletargeting":
        '''(experimental) Retrieve information about all campaigns for an app.

        Access Level: List

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-campaigns.html#rest-api-campaigns-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetCampaigns", []))

    @jsii.member(jsii_name="toGetCampaignVersion")
    def to_get_campaign_version(self) -> "Mobiletargeting":
        '''(experimental) Retrieve information about a specific campaign version.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-campaign-version.html#rest-api-campaign-version-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetCampaignVersion", []))

    @jsii.member(jsii_name="toGetCampaignVersions")
    def to_get_campaign_versions(self) -> "Mobiletargeting":
        '''(experimental) Retrieve information about the current and prior versions of a campaign.

        Access Level: List

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-campaign-versions.html#rest-api-campaign-versions-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetCampaignVersions", []))

    @jsii.member(jsii_name="toGetChannels")
    def to_get_channels(self) -> "Mobiletargeting":
        '''(experimental) Get all channels information for your app.

        Access Level: List

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-channels.html#rest-api-channels-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetChannels", []))

    @jsii.member(jsii_name="toGetEmailChannel")
    def to_get_email_channel(self) -> "Mobiletargeting":
        '''(experimental) Obtain information about the email channel in an app.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-email-channel.html#rest-api-email-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetEmailChannel", []))

    @jsii.member(jsii_name="toGetEmailTemplate")
    def to_get_email_template(self) -> "Mobiletargeting":
        '''(experimental) Retrieve information about a specific or the active version of an email template.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-email.html#templates-template-name-email-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetEmailTemplate", []))

    @jsii.member(jsii_name="toGetEndpoint")
    def to_get_endpoint(self) -> "Mobiletargeting":
        '''(experimental) Retrieve information about a specific endpoint.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-endpoint.html#rest-api-endpoint-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetEndpoint", []))

    @jsii.member(jsii_name="toGetEventStream")
    def to_get_event_stream(self) -> "Mobiletargeting":
        '''(experimental) Retrieve information about the event stream for an app.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-event-stream.html#rest-api-event-stream-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetEventStream", []))

    @jsii.member(jsii_name="toGetExportJob")
    def to_get_export_job(self) -> "Mobiletargeting":
        '''(experimental) Obtain information about a specific export job.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-export-jobs.html#rest-api-export-jobs-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetExportJob", []))

    @jsii.member(jsii_name="toGetExportJobs")
    def to_get_export_jobs(self) -> "Mobiletargeting":
        '''(experimental) Retrieve a list of all of the export jobs for an app.

        Access Level: List

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-export-jobs.html#rest-api-export-jobs-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetExportJobs", []))

    @jsii.member(jsii_name="toGetGcmChannel")
    def to_get_gcm_channel(self) -> "Mobiletargeting":
        '''(experimental) Retrieve information about the GCM channel for an app.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-gcm-channel.html#rest-api-gcm-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetGcmChannel", []))

    @jsii.member(jsii_name="toGetImportJob")
    def to_get_import_job(self) -> "Mobiletargeting":
        '''(experimental) Retrieve information about a specific import job.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-import-job.html#rest-api-import-job-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetImportJob", []))

    @jsii.member(jsii_name="toGetImportJobs")
    def to_get_import_jobs(self) -> "Mobiletargeting":
        '''(experimental) Retrieve information about all import jobs for an app.

        Access Level: List

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-import-jobs.html#rest-api-import-jobs-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetImportJobs", []))

    @jsii.member(jsii_name="toGetJourney")
    def to_get_journey(self) -> "Mobiletargeting":
        '''(experimental) Retrieve information about a specific journey.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/apps-application-id-journeys-journey-id.html#apps-application-id-journeys-journey-id-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetJourney", []))

    @jsii.member(jsii_name="toGetPushTemplate")
    def to_get_push_template(self) -> "Mobiletargeting":
        '''(experimental) Retrieve information about a specific or the active version of an push notification template.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-push.html#templates-template-name-push-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetPushTemplate", []))

    @jsii.member(jsii_name="toGetRecommenderConfiguration")
    def to_get_recommender_configuration(self) -> "Mobiletargeting":
        '''(experimental) Retrieve information about an Amazon Pinpoint configuration for a recommender model.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/recommenders-recommender-id.html#GetRecommenderConfiguration

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetRecommenderConfiguration", []))

    @jsii.member(jsii_name="toGetRecommenderConfigurations")
    def to_get_recommender_configurations(self) -> "Mobiletargeting":
        '''(experimental) Retrieve information about all the recommender model configurations that are associated with an Amazon Pinpoint account.

        Access Level: List

        https://docs.aws.amazon.com/pinpoint/latest/apireference/recommenders.html#GetRecommenderConfigurations

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetRecommenderConfigurations", []))

    @jsii.member(jsii_name="toGetSegment")
    def to_get_segment(self) -> "Mobiletargeting":
        '''(experimental) Retrieve information about a specific segment.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-segment.html#rest-api-segment-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetSegment", []))

    @jsii.member(jsii_name="toGetSegmentExportJobs")
    def to_get_segment_export_jobs(self) -> "Mobiletargeting":
        '''(experimental) Retrieve information about jobs that export endpoint definitions from segments to Amazon S3.

        Access Level: List

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-export-jobs.html#rest-api-export-jobs-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetSegmentExportJobs", []))

    @jsii.member(jsii_name="toGetSegmentImportJobs")
    def to_get_segment_import_jobs(self) -> "Mobiletargeting":
        '''(experimental) Retrieve information about jobs that create segments by importing endpoint definitions from .

        Access Level: List

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-import-jobs.html#rest-api-import-jobs-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetSegmentImportJobs", []))

    @jsii.member(jsii_name="toGetSegments")
    def to_get_segments(self) -> "Mobiletargeting":
        '''(experimental) Retrieve information about the segments for an app.

        Access Level: List

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-segments.html#rest-api-segments-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetSegments", []))

    @jsii.member(jsii_name="toGetSegmentVersion")
    def to_get_segment_version(self) -> "Mobiletargeting":
        '''(experimental) Retrieve information about a specific segment version.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-segment-version.html#rest-api-segment-version-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetSegmentVersion", []))

    @jsii.member(jsii_name="toGetSegmentVersions")
    def to_get_segment_versions(self) -> "Mobiletargeting":
        '''(experimental) Retrieve information about the current and prior versions of a segment.

        Access Level: List

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-segment-versions.html#rest-api-segment-versions-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetSegmentVersions", []))

    @jsii.member(jsii_name="toGetSmsChannel")
    def to_get_sms_channel(self) -> "Mobiletargeting":
        '''(experimental) Obtain information about the SMS channel in an app.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-sms-channel.html#rest-api-sms-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetSmsChannel", []))

    @jsii.member(jsii_name="toGetSmsTemplate")
    def to_get_sms_template(self) -> "Mobiletargeting":
        '''(experimental) Retrieve information about a specific or the active version of an sms message template.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-sms.html#templates-template-name-sms-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetSmsTemplate", []))

    @jsii.member(jsii_name="toGetUserEndpoints")
    def to_get_user_endpoints(self) -> "Mobiletargeting":
        '''(experimental) Retrieve information about the endpoints that are associated with a user ID.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-user.html#rest-api-user-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetUserEndpoints", []))

    @jsii.member(jsii_name="toGetVoiceChannel")
    def to_get_voice_channel(self) -> "Mobiletargeting":
        '''(experimental) Obtain information about the Voice channel in an app.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-voice-channel.html#rest-api-voice-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetVoiceChannel", []))

    @jsii.member(jsii_name="toGetVoiceTemplate")
    def to_get_voice_template(self) -> "Mobiletargeting":
        '''(experimental) Retrieve information about a specific or the active version of a voice message template.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-voice.html#templates-template-name-voice-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetVoiceTemplate", []))

    @jsii.member(jsii_name="toListJourneys")
    def to_list_journeys(self) -> "Mobiletargeting":
        '''(experimental) Retrieve information about all journeys for an app.

        Access Level: List

        https://docs.aws.amazon.com/pinpoint/latest/apireference/apps-application-id-journeys.html#apps-application-id-journeys-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toListJourneys", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Mobiletargeting":
        '''(experimental) List tags for a resource.

        Access Level: List

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-tags.html#rest-api-tags-methods-get

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTemplates")
    def to_list_templates(self) -> "Mobiletargeting":
        '''(experimental) Retrieve metadata about the queried templates.

        Access Level: List

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates.html#templates-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toListTemplates", []))

    @jsii.member(jsii_name="toListTemplateVersions")
    def to_list_template_versions(self) -> "Mobiletargeting":
        '''(experimental) Retrieve all versions about a specific template.

        Access Level: List

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-template-type-versions.html#templates-template-name-template-type-versions-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toListTemplateVersions", []))

    @jsii.member(jsii_name="toPhoneNumberValidate")
    def to_phone_number_validate(self) -> "Mobiletargeting":
        '''(experimental) Obtain metadata for a phone number, such as the number type (mobile, landline, or VoIP), location, and provider.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-phone-number-validate.html#rest-api-phone-number-validate-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toPhoneNumberValidate", []))

    @jsii.member(jsii_name="toPutEvents")
    def to_put_events(self) -> "Mobiletargeting":
        '''(experimental) Create or update events for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-events.html#rest-api-events-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toPutEvents", []))

    @jsii.member(jsii_name="toPutEventStream")
    def to_put_event_stream(self) -> "Mobiletargeting":
        '''(experimental) Create or update an event stream for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-event-stream.html#rest-api-event-stream-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toPutEventStream", []))

    @jsii.member(jsii_name="toRemoveAttributes")
    def to_remove_attributes(self) -> "Mobiletargeting":
        '''(experimental) Used to remove the attributes for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-app.html#rest-api-app-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toRemoveAttributes", []))

    @jsii.member(jsii_name="toSendMessages")
    def to_send_messages(self) -> "Mobiletargeting":
        '''(experimental) Send an SMS message or push notification to specific endpoints.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-messages.html#rest-api-messages-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toSendMessages", []))

    @jsii.member(jsii_name="toSendUsersMessages")
    def to_send_users_messages(self) -> "Mobiletargeting":
        '''(experimental) Send an SMS message or push notification to all endpoints that are associated with a specific user ID.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-users-messages.html#rest-api-users-messages-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toSendUsersMessages", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Mobiletargeting":
        '''(experimental) Adds tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-tags.html#rest-api-tags-methods-post

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Mobiletargeting":
        '''(experimental) Removes tags from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-tags.html#rest-api-tags-methods-delete

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAdmChannel")
    def to_update_adm_channel(self) -> "Mobiletargeting":
        '''(experimental) Update the Amazon Device Messaging (ADM) channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-adm-channel.html#rest-api-adm-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateAdmChannel", []))

    @jsii.member(jsii_name="toUpdateApnsChannel")
    def to_update_apns_channel(self) -> "Mobiletargeting":
        '''(experimental) Update the Apple Push Notification service (APNs) channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-apns-channel.html#rest-api-apns-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateApnsChannel", []))

    @jsii.member(jsii_name="toUpdateApnsSandboxChannel")
    def to_update_apns_sandbox_channel(self) -> "Mobiletargeting":
        '''(experimental) Update the Apple Push Notification service (APNs) sandbox channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-apns-sandbox-channel.html#rest-api-apns-sandbox-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateApnsSandboxChannel", []))

    @jsii.member(jsii_name="toUpdateApnsVoipChannel")
    def to_update_apns_voip_channel(self) -> "Mobiletargeting":
        '''(experimental) Update the Apple Push Notification service (APNs) VoIP channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-apns-voip-channel.html#rest-api-apns-voip-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateApnsVoipChannel", []))

    @jsii.member(jsii_name="toUpdateApnsVoipSandboxChannel")
    def to_update_apns_voip_sandbox_channel(self) -> "Mobiletargeting":
        '''(experimental) Update the Apple Push Notification service (APNs) VoIP sandbox channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-apns-voip-sandbox-channel.html#rest-api-apns-voip-sandbox-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateApnsVoipSandboxChannel", []))

    @jsii.member(jsii_name="toUpdateApplicationSettings")
    def to_update_application_settings(self) -> "Mobiletargeting":
        '''(experimental) Update the default settings for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-settings.html#rest-api-settings-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateApplicationSettings", []))

    @jsii.member(jsii_name="toUpdateBaiduChannel")
    def to_update_baidu_channel(self) -> "Mobiletargeting":
        '''(experimental) Update the Baidu channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-baidu-channel.html#rest-api-baidu-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateBaiduChannel", []))

    @jsii.member(jsii_name="toUpdateCampaign")
    def to_update_campaign(self) -> "Mobiletargeting":
        '''(experimental) Update a specific campaign.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-campaign.html#rest-api-campaign-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateCampaign", []))

    @jsii.member(jsii_name="toUpdateEmailChannel")
    def to_update_email_channel(self) -> "Mobiletargeting":
        '''(experimental) Update the email channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-email-channel.html#rest-api-email-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateEmailChannel", []))

    @jsii.member(jsii_name="toUpdateEmailTemplate")
    def to_update_email_template(self) -> "Mobiletargeting":
        '''(experimental) Update a specific email template under the same version or generate a new version.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-email.html#templates-template-name-email-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateEmailTemplate", []))

    @jsii.member(jsii_name="toUpdateEndpoint")
    def to_update_endpoint(self) -> "Mobiletargeting":
        '''(experimental) Create an endpoint or update the information for an endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-endpoint.html#rest-api-endpoint-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateEndpoint", []))

    @jsii.member(jsii_name="toUpdateEndpointsBatch")
    def to_update_endpoints_batch(self) -> "Mobiletargeting":
        '''(experimental) Create or update endpoints as a batch operation.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-endpoints.html#rest-api-endpoints-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateEndpointsBatch", []))

    @jsii.member(jsii_name="toUpdateGcmChannel")
    def to_update_gcm_channel(self) -> "Mobiletargeting":
        '''(experimental) Update the Firebase Cloud Messaging (FCM) or Google Cloud Messaging (GCM) API key that allows to send push notifications to your Android app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-gcm-channel.html#rest-api-gcm-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateGcmChannel", []))

    @jsii.member(jsii_name="toUpdateJourney")
    def to_update_journey(self) -> "Mobiletargeting":
        '''(experimental) Update a specific journey.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/apps-application-id-journeys-journey-id.html#apps-application-id-journeys-journey-id-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateJourney", []))

    @jsii.member(jsii_name="toUpdateJourneyState")
    def to_update_journey_state(self) -> "Mobiletargeting":
        '''(experimental) Update a specific journey state.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/apps-application-id-journeys-journey-id-state.html#apps-application-id-journeys-journey-id-state-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateJourneyState", []))

    @jsii.member(jsii_name="toUpdatePushTemplate")
    def to_update_push_template(self) -> "Mobiletargeting":
        '''(experimental) Update a specific push notification template under the same version or generate a new version.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-push.html#templates-template-name-push-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdatePushTemplate", []))

    @jsii.member(jsii_name="toUpdateRecommenderConfiguration")
    def to_update_recommender_configuration(self) -> "Mobiletargeting":
        '''(experimental) Update an Amazon Pinpoint configuration for a recommender model.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/recommenders-recommender-id.html#UpdateRecommenderConfiguration

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateRecommenderConfiguration", []))

    @jsii.member(jsii_name="toUpdateSegment")
    def to_update_segment(self) -> "Mobiletargeting":
        '''(experimental) Update a specific segment.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-segment.html#rest-api-segment-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateSegment", []))

    @jsii.member(jsii_name="toUpdateSmsChannel")
    def to_update_sms_channel(self) -> "Mobiletargeting":
        '''(experimental) Update the SMS channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-sms-channel.html#rest-api-sms-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateSmsChannel", []))

    @jsii.member(jsii_name="toUpdateSmsTemplate")
    def to_update_sms_template(self) -> "Mobiletargeting":
        '''(experimental) Update a specific sms message template under the same version or generate a new version.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-sms.html#templates-template-name-sms-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateSmsTemplate", []))

    @jsii.member(jsii_name="toUpdateTemplateActiveVersion")
    def to_update_template_active_version(self) -> "Mobiletargeting":
        '''(experimental) Upate the active version parameter of a specific template.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-template-type-versions.html#templates-template-name-template-type-versions-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateTemplateActiveVersion", []))

    @jsii.member(jsii_name="toUpdateVoiceChannel")
    def to_update_voice_channel(self) -> "Mobiletargeting":
        '''(experimental) Update the Voice channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-voice-channel.html#rest-api-voice-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateVoiceChannel", []))

    @jsii.member(jsii_name="toUpdateVoiceTemplate")
    def to_update_voice_template(self) -> "Mobiletargeting":
        '''(experimental) Update a specific voice message template under the same version or generate a new version.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-voice.html#templates-template-name-voice-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateVoiceTemplate", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Monitron(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Monitron",
):
    '''(experimental) Statement provider for service `monitron <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmonitron.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `monitron <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmonitron.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Monitron, self, [sid])

    @jsii.member(jsii_name="onProject")
    def on_project(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Monitron":
        '''(experimental) Adds a resource of type project to the statement.

        https://docs.aws.amazon.com/Monitron/latest/admin-guide/projects-chapter.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Monitron", jsii.invoke(self, "onProject", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toAssociateProjectAdminUser")
    def to_associate_project_admin_user(self) -> "Monitron":
        '''(experimental) Grants permission to associate a user with the project as an administrator.

        Access Level: Permissions management

        Dependent actions:

        - sso-directory:DescribeUsers
        - sso:AssociateProfile
        - sso:GetManagedApplicationInstance
        - sso:GetProfile
        - sso:ListDirectoryAssociations
        - sso:ListProfiles

        https://docs.aws.amazon.com/Monitron/latest/admin-guide/user-management-chapter.html

        :stability: experimental
        '''
        return typing.cast("Monitron", jsii.invoke(self, "toAssociateProjectAdminUser", []))

    @jsii.member(jsii_name="toCreateProject")
    def to_create_project(self) -> "Monitron":
        '''(experimental) Grants permission to create a project.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:CreateServiceLinkedRole
        - kms:CreateGrant
        - sso:CreateManagedApplicationInstance
        - sso:DeleteManagedApplicationInstance

        https://docs.aws.amazon.com/Monitron/latest/admin-guide/mp-creating-project.html

        :stability: experimental
        '''
        return typing.cast("Monitron", jsii.invoke(self, "toCreateProject", []))

    @jsii.member(jsii_name="toDeleteProject")
    def to_delete_project(self) -> "Monitron":
        '''(experimental) Grants permission to delete a project.

        Access Level: Write

        Dependent actions:

        - sso:DeleteManagedApplicationInstance

        https://docs.aws.amazon.com/Monitron/latest/admin-guide/mp-delete-project.html

        :stability: experimental
        '''
        return typing.cast("Monitron", jsii.invoke(self, "toDeleteProject", []))

    @jsii.member(jsii_name="toDisassociateProjectAdminUser")
    def to_disassociate_project_admin_user(self) -> "Monitron":
        '''(experimental) Grants permission to disassociate an administrator from the project.

        Access Level: Permissions management

        Dependent actions:

        - sso-directory:DescribeUsers
        - sso:DisassociateProfile
        - sso:GetManagedApplicationInstance
        - sso:GetProfile
        - sso:ListDirectoryAssociations
        - sso:ListProfiles

        https://docs.aws.amazon.com/Monitron/latest/admin-guide/mu-remove-project-admin.html

        :stability: experimental
        '''
        return typing.cast("Monitron", jsii.invoke(self, "toDisassociateProjectAdminUser", []))

    @jsii.member(jsii_name="toGetProject")
    def to_get_project(self) -> "Monitron":
        '''(experimental) Grants permission to get information about a project.

        Access Level: Read

        https://docs.aws.amazon.com/Monitron/latest/admin-guide/mp-project-tasks.html

        :stability: experimental
        '''
        return typing.cast("Monitron", jsii.invoke(self, "toGetProject", []))

    @jsii.member(jsii_name="toGetProjectAdminUser")
    def to_get_project_admin_user(self) -> "Monitron":
        '''(experimental) Grants permission to describe an administrator who is associated with the project.

        Access Level: Read

        Dependent actions:

        - sso-directory:DescribeUsers
        - sso:GetManagedApplicationInstance

        https://docs.aws.amazon.com/Monitron/latest/admin-guide/mp-project-tasks.html

        :stability: experimental
        '''
        return typing.cast("Monitron", jsii.invoke(self, "toGetProjectAdminUser", []))

    @jsii.member(jsii_name="toListProjectAdminUsers")
    def to_list_project_admin_users(self) -> "Monitron":
        '''(experimental) Grants permission to list all administrators associated with the project.

        Access Level: Permissions management

        Dependent actions:

        - sso-directory:DescribeUsers
        - sso:GetManagedApplicationInstance

        https://docs.aws.amazon.com/Monitron/latest/admin-guide/user-management-chapter.html

        :stability: experimental
        '''
        return typing.cast("Monitron", jsii.invoke(self, "toListProjectAdminUsers", []))

    @jsii.member(jsii_name="toListProjects")
    def to_list_projects(self) -> "Monitron":
        '''(experimental) Grants permission to list all projects.

        Access Level: List

        https://docs.aws.amazon.com/Monitron/latest/admin-guide/mp-project-tasks.html

        :stability: experimental
        '''
        return typing.cast("Monitron", jsii.invoke(self, "toListProjects", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Monitron":
        '''(experimental) Grants permission to list all tags for a resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/Monitron/latest/admin-guide/tagging.html

        :stability: experimental
        '''
        return typing.cast("Monitron", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Monitron":
        '''(experimental) Grants permission to tag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/Monitron/latest/admin-guide/tagging.html

        :stability: experimental
        '''
        return typing.cast("Monitron", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Monitron":
        '''(experimental) Grants permission to untag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/Monitron/latest/admin-guide/tagging.html#modify-tag-1

        :stability: experimental
        '''
        return typing.cast("Monitron", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateProject")
    def to_update_project(self) -> "Monitron":
        '''(experimental) Grants permission to update a project.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/Monitron/latest/admin-guide/mp-updating-project.html

        :stability: experimental
        '''
        return typing.cast("Monitron", jsii.invoke(self, "toUpdateProject", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Mq(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Mq"):
    '''(experimental) Statement provider for service `mq <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmq.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `mq <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmq.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Mq, self, [sid])

    @jsii.member(jsii_name="onBrokers")
    def on_brokers(
        self,
        broker_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mq":
        '''(experimental) Adds a resource of type brokers to the statement.

        https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/amazon-mq-how-it-works.html

        :param broker_id: - Identifier for the brokerId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "onBrokers", [broker_id, account, region, partition]))

    @jsii.member(jsii_name="onConfigurations")
    def on_configurations(
        self,
        configuration_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mq":
        '''(experimental) Adds a resource of type configurations to the statement.

        https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/amazon-mq-how-it-works.html

        :param configuration_id: - Identifier for the configurationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "onConfigurations", [configuration_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateBroker")
    def to_create_broker(self) -> "Mq":
        '''(experimental) Grants permission to create a broker.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:CreateNetworkInterfacePermission
        - ec2:CreateSecurityGroup
        - ec2:CreateVpcEndpoint
        - ec2:DescribeInternetGateways
        - ec2:DescribeNetworkInterfacePermissions
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSecurityGroups
        - ec2:DescribeSubnets
        - ec2:DescribeVpcEndpoints
        - ec2:DescribeVpcs
        - ec2:ModifyNetworkInterfaceAttribute
        - iam:CreateServiceLinkedRole
        - route53:AssociateVPCWithHostedZone

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-brokers.html#rest-api-brokers-methods-post

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toCreateBroker", []))

    @jsii.member(jsii_name="toCreateConfiguration")
    def to_create_configuration(self) -> "Mq":
        '''(experimental) Grants permission to create a new configuration for the specified configuration name.

        Amazon MQ uses the default configuration (the engine type and engine version)

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-configurations.html#rest-api-configurations-methods-post

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toCreateConfiguration", []))

    @jsii.member(jsii_name="toCreateTags")
    def to_create_tags(self) -> "Mq":
        '''(experimental) Grants permission to create tags.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-tags.html#rest-api-tags-methods-post

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toCreateTags", []))

    @jsii.member(jsii_name="toCreateUser")
    def to_create_user(self) -> "Mq":
        '''(experimental) Grants permission to create an ActiveMQ user.

        Access Level: Write

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-username.html#rest-api-username-methods-post

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toCreateUser", []))

    @jsii.member(jsii_name="toDeleteBroker")
    def to_delete_broker(self) -> "Mq":
        '''(experimental) Grants permission to delete a broker.

        Access Level: Write

        Dependent actions:

        - ec2:DeleteNetworkInterface
        - ec2:DeleteNetworkInterfacePermission
        - ec2:DeleteVpcEndpoints
        - ec2:DetachNetworkInterface

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-broker.html#rest-api-broker-methods-delete

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toDeleteBroker", []))

    @jsii.member(jsii_name="toDeleteTags")
    def to_delete_tags(self) -> "Mq":
        '''(experimental) Grants permission to delete tags.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-tags.html#rest-api-tags-methods-delete

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toDeleteTags", []))

    @jsii.member(jsii_name="toDeleteUser")
    def to_delete_user(self) -> "Mq":
        '''(experimental) Grants permission to delete an ActiveMQ user.

        Access Level: Write

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-username.html#rest-api-username-methods-delete

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toDeleteUser", []))

    @jsii.member(jsii_name="toDescribeBroker")
    def to_describe_broker(self) -> "Mq":
        '''(experimental) Grants permission to return information about the specified broker.

        Access Level: Read

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-broker.html#rest-api-broker-methods-get

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toDescribeBroker", []))

    @jsii.member(jsii_name="toDescribeBrokerEngineTypes")
    def to_describe_broker_engine_types(self) -> "Mq":
        '''(experimental) Grants permission to return information about broker engines.

        Access Level: Read

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/broker-engine-types.html#broker-engine-types-http-methods

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toDescribeBrokerEngineTypes", []))

    @jsii.member(jsii_name="toDescribeBrokerInstanceOptions")
    def to_describe_broker_instance_options(self) -> "Mq":
        '''(experimental) Grants permission to return information about the broker instance options.

        Access Level: Read

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/broker-instance-options.html#broker-engine-types-http-methods

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toDescribeBrokerInstanceOptions", []))

    @jsii.member(jsii_name="toDescribeConfiguration")
    def to_describe_configuration(self) -> "Mq":
        '''(experimental) Grants permission to return information about the specified configuration.

        Access Level: Read

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-configuration.html#rest-api-configuration-methods-get

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toDescribeConfiguration", []))

    @jsii.member(jsii_name="toDescribeConfigurationRevision")
    def to_describe_configuration_revision(self) -> "Mq":
        '''(experimental) Grants permission to return the specified configuration revision for the specified configuration.

        Access Level: Read

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-configuration-revision.html#rest-api-configuration-revision-methods-get

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toDescribeConfigurationRevision", []))

    @jsii.member(jsii_name="toDescribeUser")
    def to_describe_user(self) -> "Mq":
        '''(experimental) Grants permission to return information about an ActiveMQ user.

        Access Level: Read

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-username.html#rest-api-username-methods-get

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toDescribeUser", []))

    @jsii.member(jsii_name="toListBrokers")
    def to_list_brokers(self) -> "Mq":
        '''(experimental) Grants permission to return a list of all brokers.

        Access Level: List

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-brokers.html#rest-api-brokers-methods-get

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toListBrokers", []))

    @jsii.member(jsii_name="toListConfigurationRevisions")
    def to_list_configuration_revisions(self) -> "Mq":
        '''(experimental) Grants permission to return a list of all existing revisions for the specified configuration.

        Access Level: List

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-revisions.html#rest-api-revisions-methods-get

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toListConfigurationRevisions", []))

    @jsii.member(jsii_name="toListConfigurations")
    def to_list_configurations(self) -> "Mq":
        '''(experimental) Grants permission to return a list of all configurations.

        Access Level: List

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-configurations.html#rest-api-configurations-methods-get

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toListConfigurations", []))

    @jsii.member(jsii_name="toListTags")
    def to_list_tags(self) -> "Mq":
        '''(experimental) Grants permission to return a list of tags.

        Access Level: List

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-tags.html#rest-api-tags-methods-get

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toListTags", []))

    @jsii.member(jsii_name="toListUsers")
    def to_list_users(self) -> "Mq":
        '''(experimental) Grants permission to return a list of all ActiveMQ users.

        Access Level: List

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-users.html#rest-api-users-methods-get

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toListUsers", []))

    @jsii.member(jsii_name="toRebootBroker")
    def to_reboot_broker(self) -> "Mq":
        '''(experimental) Grants permission to reboot a broker.

        Access Level: Write

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-restart.html#rest-api-reboot-methods-post

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toRebootBroker", []))

    @jsii.member(jsii_name="toUpdateBroker")
    def to_update_broker(self) -> "Mq":
        '''(experimental) Grants permission to add a pending configuration change to a broker.

        Access Level: Write

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-broker.html#rest-api-broker-methods-get

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toUpdateBroker", []))

    @jsii.member(jsii_name="toUpdateConfiguration")
    def to_update_configuration(self) -> "Mq":
        '''(experimental) Grants permission to update the specified configuration.

        Access Level: Write

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-configuration.html#rest-api-configuration-methods-put

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toUpdateConfiguration", []))

    @jsii.member(jsii_name="toUpdateUser")
    def to_update_user(self) -> "Mq":
        '''(experimental) Grants permission to update the information for an ActiveMQ user.

        Access Level: Write

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-username.html#rest-api-username-methods-put

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toUpdateUser", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class NeptuneDb(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.NeptuneDb",
):
    '''(experimental) Statement provider for service `neptune-db <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonneptune.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `neptune-db <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonneptune.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(NeptuneDb, self, [sid])

    @jsii.member(jsii_name="onDatabase")
    def on_database(
        self,
        cluster: builtins.str,
        database: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "NeptuneDb":
        '''(experimental) Adds a resource of type database to the statement.

        https://docs.aws.amazon.com/neptune/latest/userguide/get-started.html

        :param cluster: - Identifier for the cluster.
        :param database: - Identifier for the database.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("NeptuneDb", jsii.invoke(self, "onDatabase", [cluster, database, account, region, partition]))

    @jsii.member(jsii_name="toConnect")
    def to_connect(self) -> "NeptuneDb":
        '''(experimental) Connect to database.

        Access Level: Write

        https://docs.aws.amazon.com/neptune/latest/userguide/get-started.html

        :stability: experimental
        '''
        return typing.cast("NeptuneDb", jsii.invoke(self, "toConnect", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class NetworkFirewall(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.NetworkFirewall",
):
    '''(experimental) Statement provider for service `network-firewall <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsnetworkfirewall.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `network-firewall <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsnetworkfirewall.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(NetworkFirewall, self, [sid])

    @jsii.member(jsii_name="onFirewall")
    def on_firewall(
        self,
        name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "NetworkFirewall":
        '''(experimental) Adds a resource of type Firewall to the statement.

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_Firewall.html

        :param name: - Identifier for the name.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "onFirewall", [name, account, region, partition]))

    @jsii.member(jsii_name="onFirewallPolicy")
    def on_firewall_policy(
        self,
        name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "NetworkFirewall":
        '''(experimental) Adds a resource of type FirewallPolicy to the statement.

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_FirewallPolicyResponse.html

        :param name: - Identifier for the name.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "onFirewallPolicy", [name, account, region, partition]))

    @jsii.member(jsii_name="onStatefulRuleGroup")
    def on_stateful_rule_group(
        self,
        name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "NetworkFirewall":
        '''(experimental) Adds a resource of type StatefulRuleGroup to the statement.

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_RuleGroupResponse.html

        :param name: - Identifier for the name.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "onStatefulRuleGroup", [name, account, region, partition]))

    @jsii.member(jsii_name="onStatelessRuleGroup")
    def on_stateless_rule_group(
        self,
        name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "NetworkFirewall":
        '''(experimental) Adds a resource of type StatelessRuleGroup to the statement.

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_RuleGroupResponse.html

        :param name: - Identifier for the name.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "onStatelessRuleGroup", [name, account, region, partition]))

    @jsii.member(jsii_name="toAssociateFirewallPolicy")
    def to_associate_firewall_policy(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to create an association between a firewall policy and a firewall.

        Access Level: Write

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_AssociateFirewallPolicy.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toAssociateFirewallPolicy", []))

    @jsii.member(jsii_name="toAssociateSubnets")
    def to_associate_subnets(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to associate VPC subnets to a firewall.

        Access Level: Write

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_AssociateSubnets.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toAssociateSubnets", []))

    @jsii.member(jsii_name="toCreateFirewall")
    def to_create_firewall(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to create an AWS Network Firewall firewall.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_CreateFirewall.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toCreateFirewall", []))

    @jsii.member(jsii_name="toCreateFirewallPolicy")
    def to_create_firewall_policy(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to create an AWS Network Firewall firewall policy.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_CreateFirewallPolicy.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toCreateFirewallPolicy", []))

    @jsii.member(jsii_name="toCreateRuleGroup")
    def to_create_rule_group(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to create an AWS Network Firewall rule group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_CreateRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toCreateRuleGroup", []))

    @jsii.member(jsii_name="toDeleteFirewall")
    def to_delete_firewall(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to delete a firewall.

        Access Level: Write

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_DeleteFirewall.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toDeleteFirewall", []))

    @jsii.member(jsii_name="toDeleteFirewallPolicy")
    def to_delete_firewall_policy(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to delete a firewall policy.

        Access Level: Write

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_DeleteFirewallPolicy.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toDeleteFirewallPolicy", []))

    @jsii.member(jsii_name="toDeleteResourcePolicy")
    def to_delete_resource_policy(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to delete a resource policy for a firewall policy or rule group.

        Access Level: Write

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_DeleteResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toDeleteResourcePolicy", []))

    @jsii.member(jsii_name="toDeleteRuleGroup")
    def to_delete_rule_group(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to delete a rule group.

        Access Level: Write

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_DeleteRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toDeleteRuleGroup", []))

    @jsii.member(jsii_name="toDescribeFirewall")
    def to_describe_firewall(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to retrieve the data objects that define a firewall.

        Access Level: Read

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_DescribeFirewall.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toDescribeFirewall", []))

    @jsii.member(jsii_name="toDescribeFirewallPolicy")
    def to_describe_firewall_policy(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to retrieve the data objects that define a firewall policy.

        Access Level: Read

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_DescribeFirewallPolicy.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toDescribeFirewallPolicy", []))

    @jsii.member(jsii_name="toDescribeLoggingConfiguration")
    def to_describe_logging_configuration(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to describe the logging configuration of a firewall.

        Access Level: Read

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_DescribeLoggingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toDescribeLoggingConfiguration", []))

    @jsii.member(jsii_name="toDescribeResourcePolicy")
    def to_describe_resource_policy(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to describe a resource policy for a firewall policy or rule group.

        Access Level: Read

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_DescribeResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toDescribeResourcePolicy", []))

    @jsii.member(jsii_name="toDescribeRuleGroup")
    def to_describe_rule_group(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to retrieve the data objects that define a rule group.

        Access Level: Read

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_DescribeRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toDescribeRuleGroup", []))

    @jsii.member(jsii_name="toDisassociateSubnets")
    def to_disassociate_subnets(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to disassociate VPC subnets from a firewall.

        Access Level: Write

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/APIReference/API_DisassociateSubnets.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toDisassociateSubnets", []))

    @jsii.member(jsii_name="toListFirewallPolicies")
    def to_list_firewall_policies(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to retrieve the metadata for firewall policies.

        Access Level: List

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_ListFirewallPolicies.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toListFirewallPolicies", []))

    @jsii.member(jsii_name="toListFirewalls")
    def to_list_firewalls(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to retrieve the metadata for firewalls.

        Access Level: List

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_ListFirewalls.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toListFirewalls", []))

    @jsii.member(jsii_name="toListRuleGroups")
    def to_list_rule_groups(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to retrieve the metadata for rule groups.

        Access Level: List

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_ListRuleGroups.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toListRuleGroups", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to retrieve the tags for a resource.

        Access Level: List

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutResourcePolicy")
    def to_put_resource_policy(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to put a resource policy for a firewall policy or rule group.

        Access Level: Write

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_PutResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toPutResourcePolicy", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to attach tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to remove tags from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateFirewallDeleteProtection")
    def to_update_firewall_delete_protection(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to add or remove delete protection for a firewall.

        Access Level: Write

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_UpdateFirewallDeleteProtection.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toUpdateFirewallDeleteProtection", []))

    @jsii.member(jsii_name="toUpdateFirewallDescription")
    def to_update_firewall_description(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to modify the description for a firewall.

        Access Level: Write

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_UpdateFirewallDescription.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toUpdateFirewallDescription", []))

    @jsii.member(jsii_name="toUpdateFirewallPolicy")
    def to_update_firewall_policy(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to modify a firewall policy.

        Access Level: Write

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_UpdateFirewallPolicy.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toUpdateFirewallPolicy", []))

    @jsii.member(jsii_name="toUpdateFirewallPolicyChangeProtection")
    def to_update_firewall_policy_change_protection(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to add or remove firewall policy change protection for a firewall.

        Access Level: Write

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_UpdateFirewallPolicyChangeProtection.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toUpdateFirewallPolicyChangeProtection", []))

    @jsii.member(jsii_name="toUpdateLoggingConfiguration")
    def to_update_logging_configuration(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to modify the logging configuration of a firewall.

        Access Level: Write

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_UpdateLoggingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toUpdateLoggingConfiguration", []))

    @jsii.member(jsii_name="toUpdateRuleGroup")
    def to_update_rule_group(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to modify a rule group.

        Access Level: Write

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_UpdateRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toUpdateRuleGroup", []))

    @jsii.member(jsii_name="toUpdateSubnetChangeProtection")
    def to_update_subnet_change_protection(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to add or remove subnet change protection for a firewall.

        Access Level: Write

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_UpdateSubnetChangeProtection.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toUpdateSubnetChangeProtection", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Networkmanager(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Networkmanager",
):
    '''(experimental) Statement provider for service `networkmanager <https://docs.aws.amazon.com/service-authorization/latest/reference/list_networkmanager.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `networkmanager <https://docs.aws.amazon.com/service-authorization/latest/reference/list_networkmanager.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Networkmanager, self, [sid])

    @jsii.member(jsii_name="ifCgwArn")
    def if_cgw_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Networkmanager":
        '''(experimental) Controls which customer gateways can be associated or disassociated.

        https://docs.aws.amazon.com/vpc/latest/tgw/nm-security-iam.html

        Applies to actions:

        - .toAssociateCustomerGateway()
        - .toDisassociateCustomerGateway()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "ifCgwArn", [value, operator]))

    @jsii.member(jsii_name="ifTgwArn")
    def if_tgw_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Networkmanager":
        '''(experimental) Controls which transit gateways can be registered or deregistered.

        https://docs.aws.amazon.com/vpc/latest/tgw/nm-security-iam.html

        Applies to actions:

        - .toDeregisterTransitGateway()
        - .toRegisterTransitGateway()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "ifTgwArn", [value, operator]))

    @jsii.member(jsii_name="ifTgwConnectPeerArn")
    def if_tgw_connect_peer_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Networkmanager":
        '''(experimental) Controls which connect peers can be associated or disassociated.

        https://docs.aws.amazon.com/vpc/latest/tgw/nm-security-iam.html

        Applies to actions:

        - .toAssociateTransitGatewayConnectPeer()
        - .toDisassociateTransitGatewayConnectPeer()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "ifTgwConnectPeerArn", [value, operator]))

    @jsii.member(jsii_name="onConnection")
    def on_connection(
        self,
        global_network_id: builtins.str,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Networkmanager":
        '''(experimental) Adds a resource of type connection to the statement.

        https://docs.aws.amazon.com/vpc/latest/tgw/what-is-network-manager.html

        :param global_network_id: - Identifier for the globalNetworkId.
        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "onConnection", [global_network_id, resource_id, account, partition]))

    @jsii.member(jsii_name="onDevice")
    def on_device(
        self,
        global_network_id: builtins.str,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Networkmanager":
        '''(experimental) Adds a resource of type device to the statement.

        https://docs.aws.amazon.com/vpc/latest/tgw/what-is-network-manager.html

        :param global_network_id: - Identifier for the globalNetworkId.
        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "onDevice", [global_network_id, resource_id, account, partition]))

    @jsii.member(jsii_name="onGlobalNetwork")
    def on_global_network(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Networkmanager":
        '''(experimental) Adds a resource of type global-network to the statement.

        https://docs.aws.amazon.com/vpc/latest/tgw/what-is-network-manager.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "onGlobalNetwork", [resource_id, account, partition]))

    @jsii.member(jsii_name="onLink")
    def on_link(
        self,
        global_network_id: builtins.str,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Networkmanager":
        '''(experimental) Adds a resource of type link to the statement.

        https://docs.aws.amazon.com/vpc/latest/tgw/what-is-network-manager.html

        :param global_network_id: - Identifier for the globalNetworkId.
        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "onLink", [global_network_id, resource_id, account, partition]))

    @jsii.member(jsii_name="onSite")
    def on_site(
        self,
        global_network_id: builtins.str,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Networkmanager":
        '''(experimental) Adds a resource of type site to the statement.

        https://docs.aws.amazon.com/vpc/latest/tgw/what-is-network-manager.html

        :param global_network_id: - Identifier for the globalNetworkId.
        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "onSite", [global_network_id, resource_id, account, partition]))

    @jsii.member(jsii_name="toAssociateCustomerGateway")
    def to_associate_customer_gateway(self) -> "Networkmanager":
        '''(experimental) Grants permission to associate a customer gateway to a device.

        Access Level: Write

        Possible conditions:

        - .ifCgwArn()

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_AssociateCustomerGateway.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toAssociateCustomerGateway", []))

    @jsii.member(jsii_name="toAssociateLink")
    def to_associate_link(self) -> "Networkmanager":
        '''(experimental) Grants permission to associate a link to a device.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_AssociateLink.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toAssociateLink", []))

    @jsii.member(jsii_name="toAssociateTransitGatewayConnectPeer")
    def to_associate_transit_gateway_connect_peer(self) -> "Networkmanager":
        '''(experimental) Grants permission to associate a transit gateway connect peer to a device.

        Access Level: Write

        Possible conditions:

        - .ifTgwConnectPeerArn()

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_AssociateTransitGatewayConnectPeer.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toAssociateTransitGatewayConnectPeer", []))

    @jsii.member(jsii_name="toCreateConnection")
    def to_create_connection(self) -> "Networkmanager":
        '''(experimental) Grants permission to create a new connection.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_CreateConnection.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toCreateConnection", []))

    @jsii.member(jsii_name="toCreateDevice")
    def to_create_device(self) -> "Networkmanager":
        '''(experimental) Grants permission to create a new device.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_CreateDevice.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toCreateDevice", []))

    @jsii.member(jsii_name="toCreateGlobalNetwork")
    def to_create_global_network(self) -> "Networkmanager":
        '''(experimental) Grants permission to create a new global network.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_CreateGlobalNetwork.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toCreateGlobalNetwork", []))

    @jsii.member(jsii_name="toCreateLink")
    def to_create_link(self) -> "Networkmanager":
        '''(experimental) Grants permission to create a new link.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_CreateLink.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toCreateLink", []))

    @jsii.member(jsii_name="toCreateSite")
    def to_create_site(self) -> "Networkmanager":
        '''(experimental) Grants permission to create a new site.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_CreateSite.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toCreateSite", []))

    @jsii.member(jsii_name="toDeleteConnection")
    def to_delete_connection(self) -> "Networkmanager":
        '''(experimental) Grants permission to delete a connection.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_DeleteConnection.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toDeleteConnection", []))

    @jsii.member(jsii_name="toDeleteDevice")
    def to_delete_device(self) -> "Networkmanager":
        '''(experimental) Grants permission to delete a device.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_DeleteDevice.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toDeleteDevice", []))

    @jsii.member(jsii_name="toDeleteGlobalNetwork")
    def to_delete_global_network(self) -> "Networkmanager":
        '''(experimental) Grants permission to delete a global network.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_DeleteGlobalNetwork.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toDeleteGlobalNetwork", []))

    @jsii.member(jsii_name="toDeleteLink")
    def to_delete_link(self) -> "Networkmanager":
        '''(experimental) Grants permission to delete a link.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_DeleteLink.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toDeleteLink", []))

    @jsii.member(jsii_name="toDeleteSite")
    def to_delete_site(self) -> "Networkmanager":
        '''(experimental) Grants permission to delete a site.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_DeleteSite.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toDeleteSite", []))

    @jsii.member(jsii_name="toDeregisterTransitGateway")
    def to_deregister_transit_gateway(self) -> "Networkmanager":
        '''(experimental) Grants permission to deregister a transit gateway from a global network.

        Access Level: Write

        Possible conditions:

        - .ifTgwArn()

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_DeregisterTransitGateway.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toDeregisterTransitGateway", []))

    @jsii.member(jsii_name="toDescribeGlobalNetworks")
    def to_describe_global_networks(self) -> "Networkmanager":
        '''(experimental) Grants permission to describe global networks.

        Access Level: List

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_DescribeGlobalNetworks.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toDescribeGlobalNetworks", []))

    @jsii.member(jsii_name="toDisassociateCustomerGateway")
    def to_disassociate_customer_gateway(self) -> "Networkmanager":
        '''(experimental) Grants permission to disassociate a customer gateway from a device.

        Access Level: Write

        Possible conditions:

        - .ifCgwArn()

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_DisassociateCustomerGateway.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toDisassociateCustomerGateway", []))

    @jsii.member(jsii_name="toDisassociateLink")
    def to_disassociate_link(self) -> "Networkmanager":
        '''(experimental) Grants permission to disassociate a link from a device.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_DisassociateLink.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toDisassociateLink", []))

    @jsii.member(jsii_name="toDisassociateTransitGatewayConnectPeer")
    def to_disassociate_transit_gateway_connect_peer(self) -> "Networkmanager":
        '''(experimental) Grants permission to disassociate a transit gateway connect peer from a device.

        Access Level: Write

        Possible conditions:

        - .ifTgwConnectPeerArn()

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_DisassociateTransitGatewayConnectPeer.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toDisassociateTransitGatewayConnectPeer", []))

    @jsii.member(jsii_name="toGetConnections")
    def to_get_connections(self) -> "Networkmanager":
        '''(experimental) Grants permission to describe connections.

        Access Level: List

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_GetConnections.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toGetConnections", []))

    @jsii.member(jsii_name="toGetCustomerGatewayAssociations")
    def to_get_customer_gateway_associations(self) -> "Networkmanager":
        '''(experimental) Grants permission to describe customer gateway associations.

        Access Level: List

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_GetCustomerGatewayAssociations.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toGetCustomerGatewayAssociations", []))

    @jsii.member(jsii_name="toGetDevices")
    def to_get_devices(self) -> "Networkmanager":
        '''(experimental) Grants permission to describe devices.

        Access Level: List

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_GetDevices.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toGetDevices", []))

    @jsii.member(jsii_name="toGetLinkAssociations")
    def to_get_link_associations(self) -> "Networkmanager":
        '''(experimental) Grants permission to describe link associations.

        Access Level: List

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_GetLinkAssociations.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toGetLinkAssociations", []))

    @jsii.member(jsii_name="toGetLinks")
    def to_get_links(self) -> "Networkmanager":
        '''(experimental) Grants permission to describe links.

        Access Level: List

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_GetLinks.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toGetLinks", []))

    @jsii.member(jsii_name="toGetSites")
    def to_get_sites(self) -> "Networkmanager":
        '''(experimental) Grants permission to describe global networks.

        Access Level: List

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_GetSites.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toGetSites", []))

    @jsii.member(jsii_name="toGetTransitGatewayConnectPeerAssociations")
    def to_get_transit_gateway_connect_peer_associations(self) -> "Networkmanager":
        '''(experimental) Grants permission to describe transit gateway connect peer associations.

        Access Level: List

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_GetTransitGatewayConnectPeerAssociations.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toGetTransitGatewayConnectPeerAssociations", []))

    @jsii.member(jsii_name="toGetTransitGatewayRegistrations")
    def to_get_transit_gateway_registrations(self) -> "Networkmanager":
        '''(experimental) Grants permission to describe transit gateway registrations.

        Access Level: List

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_GetTransitGatewayRegistrations.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toGetTransitGatewayRegistrations", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Networkmanager":
        '''(experimental) Grants permission to lists tag for a Network Manager resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toRegisterTransitGateway")
    def to_register_transit_gateway(self) -> "Networkmanager":
        '''(experimental) Grants permission to register a transit gateway to a global network.

        Access Level: Write

        Possible conditions:

        - .ifTgwArn()

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_RegisterTransitGateway.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toRegisterTransitGateway", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Networkmanager":
        '''(experimental) Grants permission to tag a Network Manager resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Networkmanager":
        '''(experimental) Grants permission to untag a Network Manager resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateConnection")
    def to_update_connection(self) -> "Networkmanager":
        '''(experimental) Grants permission to update a connection.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_UpdateConnection.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toUpdateConnection", []))

    @jsii.member(jsii_name="toUpdateDevice")
    def to_update_device(self) -> "Networkmanager":
        '''(experimental) Grants permission to update a device.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_UpdateDevice.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toUpdateDevice", []))

    @jsii.member(jsii_name="toUpdateGlobalNetwork")
    def to_update_global_network(self) -> "Networkmanager":
        '''(experimental) Grants permission to update a global network.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_UpdateGlobalNetwork.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toUpdateGlobalNetwork", []))

    @jsii.member(jsii_name="toUpdateLink")
    def to_update_link(self) -> "Networkmanager":
        '''(experimental) Grants permission to update a link.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_UpdateLink.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toUpdateLink", []))

    @jsii.member(jsii_name="toUpdateSite")
    def to_update_site(self) -> "Networkmanager":
        '''(experimental) Grants permission to update a site.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_UpdateSite.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toUpdateSite", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Opsworks(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Opsworks",
):
    '''(experimental) Statement provider for service `opsworks <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsopsworks.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `opsworks <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsopsworks.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Opsworks, self, [sid])

    @jsii.member(jsii_name="onStack")
    def on_stack(
        self,
        stack_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Opsworks":
        '''(experimental) Adds a resource of type stack to the statement.

        https://docs.aws.amazon.com/opsworks/latest/userguide/workingstacks.html

        :param stack_id: - Identifier for the stackId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "onStack", [stack_id, account, region, partition]))

    @jsii.member(jsii_name="toAssignInstance")
    def to_assign_instance(self) -> "Opsworks":
        '''(experimental) Assign a registered instance to a layer.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_AssignInstance.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toAssignInstance", []))

    @jsii.member(jsii_name="toAssignVolume")
    def to_assign_volume(self) -> "Opsworks":
        '''(experimental) Assigns one of the stack's registered Amazon EBS volumes to a specified instance.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_AssignVolume.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toAssignVolume", []))

    @jsii.member(jsii_name="toAssociateElasticIp")
    def to_associate_elastic_ip(self) -> "Opsworks":
        '''(experimental) Associates one of the stack's registered Elastic IP addresses with a specified instance.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_AssociateElasticIp.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toAssociateElasticIp", []))

    @jsii.member(jsii_name="toAttachElasticLoadBalancer")
    def to_attach_elastic_load_balancer(self) -> "Opsworks":
        '''(experimental) Attaches an Elastic Load Balancing load balancer to a specified layer.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_AttachElasticLoadBalancer.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toAttachElasticLoadBalancer", []))

    @jsii.member(jsii_name="toCloneStack")
    def to_clone_stack(self) -> "Opsworks":
        '''(experimental) Creates a clone of a specified stack.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_CloneStack.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toCloneStack", []))

    @jsii.member(jsii_name="toCreateApp")
    def to_create_app(self) -> "Opsworks":
        '''(experimental) Creates an app for a specified stack.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_CreateApp.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toCreateApp", []))

    @jsii.member(jsii_name="toCreateDeployment")
    def to_create_deployment(self) -> "Opsworks":
        '''(experimental) Runs deployment or stack commands.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_CreateDeployment.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toCreateDeployment", []))

    @jsii.member(jsii_name="toCreateInstance")
    def to_create_instance(self) -> "Opsworks":
        '''(experimental) Creates an instance in a specified stack.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_CreateInstance.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toCreateInstance", []))

    @jsii.member(jsii_name="toCreateLayer")
    def to_create_layer(self) -> "Opsworks":
        '''(experimental) Creates a layer.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_CreateLayer.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toCreateLayer", []))

    @jsii.member(jsii_name="toCreateStack")
    def to_create_stack(self) -> "Opsworks":
        '''(experimental) Creates a new stack.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_CreateStack.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toCreateStack", []))

    @jsii.member(jsii_name="toCreateUserProfile")
    def to_create_user_profile(self) -> "Opsworks":
        '''(experimental) Creates a new user profile.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_CreateUserProfile.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toCreateUserProfile", []))

    @jsii.member(jsii_name="toDeleteApp")
    def to_delete_app(self) -> "Opsworks":
        '''(experimental) Deletes a specified app.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DeleteApp.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDeleteApp", []))

    @jsii.member(jsii_name="toDeleteInstance")
    def to_delete_instance(self) -> "Opsworks":
        '''(experimental) Deletes a specified instance, which terminates the associated Amazon EC2 instance.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DeleteInstance.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDeleteInstance", []))

    @jsii.member(jsii_name="toDeleteLayer")
    def to_delete_layer(self) -> "Opsworks":
        '''(experimental) Deletes a specified layer.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DeleteLayer.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDeleteLayer", []))

    @jsii.member(jsii_name="toDeleteStack")
    def to_delete_stack(self) -> "Opsworks":
        '''(experimental) Deletes a specified stack.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DeleteStack.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDeleteStack", []))

    @jsii.member(jsii_name="toDeleteUserProfile")
    def to_delete_user_profile(self) -> "Opsworks":
        '''(experimental) Deletes a user profile.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DeleteUserProfile.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDeleteUserProfile", []))

    @jsii.member(jsii_name="toDeregisterEcsCluster")
    def to_deregister_ecs_cluster(self) -> "Opsworks":
        '''(experimental) Deletes a user profile.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DeregisterEcsCluster.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDeregisterEcsCluster", []))

    @jsii.member(jsii_name="toDeregisterElasticIp")
    def to_deregister_elastic_ip(self) -> "Opsworks":
        '''(experimental) Deregisters a specified Elastic IP address.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DeregisterElasticIp.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDeregisterElasticIp", []))

    @jsii.member(jsii_name="toDeregisterInstance")
    def to_deregister_instance(self) -> "Opsworks":
        '''(experimental) Deregister a registered Amazon EC2 or on-premises instance.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DeregisterInstance.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDeregisterInstance", []))

    @jsii.member(jsii_name="toDeregisterRdsDbInstance")
    def to_deregister_rds_db_instance(self) -> "Opsworks":
        '''(experimental) Deregisters an Amazon RDS instance.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DeregisterRdsDbInstance.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDeregisterRdsDbInstance", []))

    @jsii.member(jsii_name="toDeregisterVolume")
    def to_deregister_volume(self) -> "Opsworks":
        '''(experimental) Deregisters an Amazon EBS volume.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DeregisterVolume.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDeregisterVolume", []))

    @jsii.member(jsii_name="toDescribeAgentVersions")
    def to_describe_agent_versions(self) -> "Opsworks":
        '''(experimental) Describes the available AWS OpsWorks agent versions.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeAgentVersions.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeAgentVersions", []))

    @jsii.member(jsii_name="toDescribeApps")
    def to_describe_apps(self) -> "Opsworks":
        '''(experimental) Requests a description of a specified set of apps.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeApps.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeApps", []))

    @jsii.member(jsii_name="toDescribeCommands")
    def to_describe_commands(self) -> "Opsworks":
        '''(experimental) Describes the results of specified commands.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeCommands.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeCommands", []))

    @jsii.member(jsii_name="toDescribeDeployments")
    def to_describe_deployments(self) -> "Opsworks":
        '''(experimental) Requests a description of a specified set of deployments.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeDeployments.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeDeployments", []))

    @jsii.member(jsii_name="toDescribeEcsClusters")
    def to_describe_ecs_clusters(self) -> "Opsworks":
        '''(experimental) Describes Amazon ECS clusters that are registered with a stack.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeEcsClusters.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeEcsClusters", []))

    @jsii.member(jsii_name="toDescribeElasticIps")
    def to_describe_elastic_ips(self) -> "Opsworks":
        '''(experimental) Describes Elastic IP addresses.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeElasticIps.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeElasticIps", []))

    @jsii.member(jsii_name="toDescribeElasticLoadBalancers")
    def to_describe_elastic_load_balancers(self) -> "Opsworks":
        '''(experimental) Describes a stack's Elastic Load Balancing instances.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeElasticLoadBalancers.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeElasticLoadBalancers", []))

    @jsii.member(jsii_name="toDescribeInstances")
    def to_describe_instances(self) -> "Opsworks":
        '''(experimental) Requests a description of a set of instances.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeInstances.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeInstances", []))

    @jsii.member(jsii_name="toDescribeLayers")
    def to_describe_layers(self) -> "Opsworks":
        '''(experimental) Requests a description of one or more layers in a specified stack.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeLayers.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeLayers", []))

    @jsii.member(jsii_name="toDescribeLoadBasedAutoScaling")
    def to_describe_load_based_auto_scaling(self) -> "Opsworks":
        '''(experimental) Describes load-based auto scaling configurations for specified layers.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeLoadBasedAutoScaling.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeLoadBasedAutoScaling", []))

    @jsii.member(jsii_name="toDescribeMyUserProfile")
    def to_describe_my_user_profile(self) -> "Opsworks":
        '''(experimental) Describes a user's SSH information.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeMyUserProfile.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeMyUserProfile", []))

    @jsii.member(jsii_name="toDescribePermissions")
    def to_describe_permissions(self) -> "Opsworks":
        '''(experimental) Describes the permissions for a specified stack.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribePermissions.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribePermissions", []))

    @jsii.member(jsii_name="toDescribeRaidArrays")
    def to_describe_raid_arrays(self) -> "Opsworks":
        '''(experimental) Describe an instance's RAID arrays.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeRaidArrays.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeRaidArrays", []))

    @jsii.member(jsii_name="toDescribeRdsDbInstances")
    def to_describe_rds_db_instances(self) -> "Opsworks":
        '''(experimental) Describes Amazon RDS instances.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeRdsDbInstances.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeRdsDbInstances", []))

    @jsii.member(jsii_name="toDescribeServiceErrors")
    def to_describe_service_errors(self) -> "Opsworks":
        '''(experimental) Describes AWS OpsWorks service errors.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeServiceErrors.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeServiceErrors", []))

    @jsii.member(jsii_name="toDescribeStackProvisioningParameters")
    def to_describe_stack_provisioning_parameters(self) -> "Opsworks":
        '''(experimental) Requests a description of a stack's provisioning parameters.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeStackProvisioningParameters.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeStackProvisioningParameters", []))

    @jsii.member(jsii_name="toDescribeStacks")
    def to_describe_stacks(self) -> "Opsworks":
        '''(experimental) Requests a description of one or more stacks.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeStacks.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeStacks", []))

    @jsii.member(jsii_name="toDescribeStackSummary")
    def to_describe_stack_summary(self) -> "Opsworks":
        '''(experimental) Describes the number of layers and apps in a specified stack, and the number of instances in each state, such as running_setup or online.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeStackSummary.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeStackSummary", []))

    @jsii.member(jsii_name="toDescribeTimeBasedAutoScaling")
    def to_describe_time_based_auto_scaling(self) -> "Opsworks":
        '''(experimental) Describes time-based auto scaling configurations for specified instances.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeTimeBasedAutoScaling.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeTimeBasedAutoScaling", []))

    @jsii.member(jsii_name="toDescribeUserProfiles")
    def to_describe_user_profiles(self) -> "Opsworks":
        '''(experimental) Describe specified users.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeUserProfiles.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeUserProfiles", []))

    @jsii.member(jsii_name="toDescribeVolumes")
    def to_describe_volumes(self) -> "Opsworks":
        '''(experimental) Describes an instance's Amazon EBS volumes.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeVolumes.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeVolumes", []))

    @jsii.member(jsii_name="toDetachElasticLoadBalancer")
    def to_detach_elastic_load_balancer(self) -> "Opsworks":
        '''(experimental) Detaches a specified Elastic Load Balancing instance from its layer.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DetachElasticLoadBalancer.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDetachElasticLoadBalancer", []))

    @jsii.member(jsii_name="toDisassociateElasticIp")
    def to_disassociate_elastic_ip(self) -> "Opsworks":
        '''(experimental) Disassociates an Elastic IP address from its instance.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DisassociateElasticIp.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDisassociateElasticIp", []))

    @jsii.member(jsii_name="toGetHostnameSuggestion")
    def to_get_hostname_suggestion(self) -> "Opsworks":
        '''(experimental) Gets a generated host name for the specified layer, based on the current host name theme.

        Access Level: Read

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_GetHostnameSuggestion.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toGetHostnameSuggestion", []))

    @jsii.member(jsii_name="toGrantAccess")
    def to_grant_access(self) -> "Opsworks":
        '''(experimental) Grants RDP access to a Windows instance for a specified time period.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_RebootInstance.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toGrantAccess", []))

    @jsii.member(jsii_name="toListTags")
    def to_list_tags(self) -> "Opsworks":
        '''(experimental) Returns a list of tags that are applied to the specified stack or layer.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_ListTags.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toListTags", []))

    @jsii.member(jsii_name="toRebootInstance")
    def to_reboot_instance(self) -> "Opsworks":
        '''(experimental) Reboots a specified instance.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_RebootInstance.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toRebootInstance", []))

    @jsii.member(jsii_name="toRegisterEcsCluster")
    def to_register_ecs_cluster(self) -> "Opsworks":
        '''(experimental) Registers a specified Amazon ECS cluster with a stack.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_RegisterEcsCluster.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toRegisterEcsCluster", []))

    @jsii.member(jsii_name="toRegisterElasticIp")
    def to_register_elastic_ip(self) -> "Opsworks":
        '''(experimental) Registers an Elastic IP address with a specified stack.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_RegisterElasticIp.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toRegisterElasticIp", []))

    @jsii.member(jsii_name="toRegisterInstance")
    def to_register_instance(self) -> "Opsworks":
        '''(experimental) Registers instances with a specified stack that were created outside of AWS OpsWorks.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_RegisterInstance.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toRegisterInstance", []))

    @jsii.member(jsii_name="toRegisterRdsDbInstance")
    def to_register_rds_db_instance(self) -> "Opsworks":
        '''(experimental) Registers an Amazon RDS instance with a stack.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_RegisterRdsDbInstance.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toRegisterRdsDbInstance", []))

    @jsii.member(jsii_name="toRegisterVolume")
    def to_register_volume(self) -> "Opsworks":
        '''(experimental) Registers an Amazon EBS volume with a specified stack.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_RegisterVolume.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toRegisterVolume", []))

    @jsii.member(jsii_name="toSetLoadBasedAutoScaling")
    def to_set_load_based_auto_scaling(self) -> "Opsworks":
        '''(experimental) Specify the load-based auto scaling configuration for a specified layer.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_SetLoadBasedAutoScaling.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toSetLoadBasedAutoScaling", []))

    @jsii.member(jsii_name="toSetPermission")
    def to_set_permission(self) -> "Opsworks":
        '''(experimental) Specifies a user's permissions.

        Access Level: Permissions management

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_SetPermission.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toSetPermission", []))

    @jsii.member(jsii_name="toSetTimeBasedAutoScaling")
    def to_set_time_based_auto_scaling(self) -> "Opsworks":
        '''(experimental) Specify the time-based auto scaling configuration for a specified instance.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_SetTimeBasedAutoScaling.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toSetTimeBasedAutoScaling", []))

    @jsii.member(jsii_name="toStartInstance")
    def to_start_instance(self) -> "Opsworks":
        '''(experimental) Starts a specified instance.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_StartInstance.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toStartInstance", []))

    @jsii.member(jsii_name="toStartStack")
    def to_start_stack(self) -> "Opsworks":
        '''(experimental) Starts a stack's instances.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_StartStack.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toStartStack", []))

    @jsii.member(jsii_name="toStopInstance")
    def to_stop_instance(self) -> "Opsworks":
        '''(experimental) Stops a specified instance.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_StopInstance.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toStopInstance", []))

    @jsii.member(jsii_name="toStopStack")
    def to_stop_stack(self) -> "Opsworks":
        '''(experimental) Stops a specified stack.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_StopStack.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toStopStack", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Opsworks":
        '''(experimental) Apply tags to a specified stack or layer.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUnassignInstance")
    def to_unassign_instance(self) -> "Opsworks":
        '''(experimental) Unassigns a registered instance from all of it's layers.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_UnassignInstance.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toUnassignInstance", []))

    @jsii.member(jsii_name="toUnassignVolume")
    def to_unassign_volume(self) -> "Opsworks":
        '''(experimental) Unassigns an assigned Amazon EBS volume.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_UnassignVolume.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toUnassignVolume", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Opsworks":
        '''(experimental) Removes tags from a specified stack or layer.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateApp")
    def to_update_app(self) -> "Opsworks":
        '''(experimental) Updates a specified app.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_UpdateApp.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toUpdateApp", []))

    @jsii.member(jsii_name="toUpdateElasticIp")
    def to_update_elastic_ip(self) -> "Opsworks":
        '''(experimental) Updates a registered Elastic IP address's name.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_UpdateElasticIp.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toUpdateElasticIp", []))

    @jsii.member(jsii_name="toUpdateInstance")
    def to_update_instance(self) -> "Opsworks":
        '''(experimental) Updates a specified instance.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_UpdateInstance.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toUpdateInstance", []))

    @jsii.member(jsii_name="toUpdateLayer")
    def to_update_layer(self) -> "Opsworks":
        '''(experimental) Updates a specified layer.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_UpdateLayer.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toUpdateLayer", []))

    @jsii.member(jsii_name="toUpdateMyUserProfile")
    def to_update_my_user_profile(self) -> "Opsworks":
        '''(experimental) Updates a user's SSH public key.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_UpdateMyUserProfile.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toUpdateMyUserProfile", []))

    @jsii.member(jsii_name="toUpdateRdsDbInstance")
    def to_update_rds_db_instance(self) -> "Opsworks":
        '''(experimental) Updates an Amazon RDS instance.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_UpdateRdsDbInstance.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toUpdateRdsDbInstance", []))

    @jsii.member(jsii_name="toUpdateStack")
    def to_update_stack(self) -> "Opsworks":
        '''(experimental) Updates a specified stack.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_UpdateStack.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toUpdateStack", []))

    @jsii.member(jsii_name="toUpdateUserProfile")
    def to_update_user_profile(self) -> "Opsworks":
        '''(experimental) Updates a specified user profile.

        Access Level: Permissions management

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_UpdateUserProfile.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toUpdateUserProfile", []))

    @jsii.member(jsii_name="toUpdateVolume")
    def to_update_volume(self) -> "Opsworks":
        '''(experimental) Updates an Amazon EBS volume's name or mount point.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_UpdateVolume.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toUpdateVolume", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class OpsworksCm(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.OpsworksCm",
):
    '''(experimental) Statement provider for service `opsworks-cm <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsopsworksconfigurationmanagement.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `opsworks-cm <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsopsworksconfigurationmanagement.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(OpsworksCm, self, [sid])

    @jsii.member(jsii_name="toAssociateNode")
    def to_associate_node(self) -> "OpsworksCm":
        '''(experimental) Associate a node to a configuration management server.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_AssociateNode.html

        :stability: experimental
        '''
        return typing.cast("OpsworksCm", jsii.invoke(self, "toAssociateNode", []))

    @jsii.member(jsii_name="toCreateBackup")
    def to_create_backup(self) -> "OpsworksCm":
        '''(experimental) Create a backup for the specified server.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_CreateBackup.html

        :stability: experimental
        '''
        return typing.cast("OpsworksCm", jsii.invoke(self, "toCreateBackup", []))

    @jsii.member(jsii_name="toCreateServer")
    def to_create_server(self) -> "OpsworksCm":
        '''(experimental) Create a new server.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_CreateServer.html

        :stability: experimental
        '''
        return typing.cast("OpsworksCm", jsii.invoke(self, "toCreateServer", []))

    @jsii.member(jsii_name="toDeleteBackup")
    def to_delete_backup(self) -> "OpsworksCm":
        '''(experimental) Delete the specified backup and possibly its S3 bucket.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_DeleteBackup.html

        :stability: experimental
        '''
        return typing.cast("OpsworksCm", jsii.invoke(self, "toDeleteBackup", []))

    @jsii.member(jsii_name="toDeleteServer")
    def to_delete_server(self) -> "OpsworksCm":
        '''(experimental) Deletes the specified server with his corresponding CF stack and possibly the S3 bucket.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_DeleteServer.html

        :stability: experimental
        '''
        return typing.cast("OpsworksCm", jsii.invoke(self, "toDeleteServer", []))

    @jsii.member(jsii_name="toDescribeAccountAttributes")
    def to_describe_account_attributes(self) -> "OpsworksCm":
        '''(experimental) Describe the service limits for the user's account.

        Access Level: List

        https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_DescribeAccountAttributes.html

        :stability: experimental
        '''
        return typing.cast("OpsworksCm", jsii.invoke(self, "toDescribeAccountAttributes", []))

    @jsii.member(jsii_name="toDescribeBackups")
    def to_describe_backups(self) -> "OpsworksCm":
        '''(experimental) Describe a single backup, all backups of a specified server or all backups of the user's account.

        Access Level: List

        https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_DescribeBackups.html

        :stability: experimental
        '''
        return typing.cast("OpsworksCm", jsii.invoke(self, "toDescribeBackups", []))

    @jsii.member(jsii_name="toDescribeEvents")
    def to_describe_events(self) -> "OpsworksCm":
        '''(experimental) Describe all events of the specified server.

        Access Level: List

        https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_DescribeEvents.html

        :stability: experimental
        '''
        return typing.cast("OpsworksCm", jsii.invoke(self, "toDescribeEvents", []))

    @jsii.member(jsii_name="toDescribeNodeAssociationStatus")
    def to_describe_node_association_status(self) -> "OpsworksCm":
        '''(experimental) Describe the association status for the specified node token and the specified server.

        Access Level: List

        https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_DescribeNodeAssociationStatus.html

        :stability: experimental
        '''
        return typing.cast("OpsworksCm", jsii.invoke(self, "toDescribeNodeAssociationStatus", []))

    @jsii.member(jsii_name="toDescribeServers")
    def to_describe_servers(self) -> "OpsworksCm":
        '''(experimental) Describes the specified server or all servers of the user's account.

        Access Level: List

        https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_DescribeServers.html

        :stability: experimental
        '''
        return typing.cast("OpsworksCm", jsii.invoke(self, "toDescribeServers", []))

    @jsii.member(jsii_name="toDisassociateNode")
    def to_disassociate_node(self) -> "OpsworksCm":
        '''(experimental) Disassociates a specified node from a server.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_DisassociateNode.html

        :stability: experimental
        '''
        return typing.cast("OpsworksCm", jsii.invoke(self, "toDisassociateNode", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "OpsworksCm":
        '''(experimental) List the tags that are applied to the specified server or backup.

        Access Level: List

        https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("OpsworksCm", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toRestoreServer")
    def to_restore_server(self) -> "OpsworksCm":
        '''(experimental) Applies a backup to specified server. Possibly swaps out the ec2-instance if specified.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_RestoreServer.html

        :stability: experimental
        '''
        return typing.cast("OpsworksCm", jsii.invoke(self, "toRestoreServer", []))

    @jsii.member(jsii_name="toStartMaintenance")
    def to_start_maintenance(self) -> "OpsworksCm":
        '''(experimental) Start the server maintenance immediately.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_StartMaintenance.html

        :stability: experimental
        '''
        return typing.cast("OpsworksCm", jsii.invoke(self, "toStartMaintenance", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "OpsworksCm":
        '''(experimental) Applies tags to the specified server or backup.

        Access Level: Tagging

        https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("OpsworksCm", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "OpsworksCm":
        '''(experimental) Removes tags from the specified server or backup.

        Access Level: Tagging

        https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("OpsworksCm", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateServer")
    def to_update_server(self) -> "OpsworksCm":
        '''(experimental) Update general server settings.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_UpdateServer.html

        :stability: experimental
        '''
        return typing.cast("OpsworksCm", jsii.invoke(self, "toUpdateServer", []))

    @jsii.member(jsii_name="toUpdateServerEngineAttributes")
    def to_update_server_engine_attributes(self) -> "OpsworksCm":
        '''(experimental) Update server settings specific to the configuration management type.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_UpdateServerEngineAttributes.html

        :stability: experimental
        '''
        return typing.cast("OpsworksCm", jsii.invoke(self, "toUpdateServerEngineAttributes", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Organizations(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Organizations",
):
    '''(experimental) Statement provider for service `organizations <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsorganizations.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `organizations <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsorganizations.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Organizations, self, [sid])

    @jsii.member(jsii_name="ifPolicyType")
    def if_policy_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Organizations":
        '''(experimental) Enables you to filter the request to only the specified policy type names.

        https://docs.aws.amazon.com/organizations/latest/userguide/orgs_permissions_overview.html#orgs_permissions_conditionkeys

        Applies to actions:

        - .toAttachPolicy()
        - .toCreatePolicy()
        - .toDeletePolicy()
        - .toDescribeEffectivePolicy()
        - .toDescribePolicy()
        - .toDetachPolicy()
        - .toDisablePolicyType()
        - .toEnablePolicyType()
        - .toListPolicies()
        - .toListPoliciesForTarget()
        - .toListTargetsForPolicy()
        - .toUpdatePolicy()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "ifPolicyType", [value, operator]))

    @jsii.member(jsii_name="ifServicePrincipal")
    def if_service_principal(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Organizations":
        '''(experimental) Enables you to filter the request to only the specified service principal names.

        https://docs.aws.amazon.com/organizations/latest/userguide/orgs_permissions_overview.html#orgs_permissions_conditionkeys

        Applies to actions:

        - .toDeregisterDelegatedAdministrator()
        - .toDisableAWSServiceAccess()
        - .toEnableAWSServiceAccess()
        - .toListDelegatedAdministrators()
        - .toRegisterDelegatedAdministrator()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "ifServicePrincipal", [value, operator]))

    @jsii.member(jsii_name="onAccount")
    def on_account(
        self,
        master_account_id: builtins.str,
        organization_id: builtins.str,
        account_id: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Organizations":
        '''(experimental) Adds a resource of type account to the statement.

        https://docs.aws.amazon.com/organizations/latest/userguide/orgs_reference_arn-formats.html

        :param master_account_id: - Identifier for the masterAccountId.
        :param organization_id: - Identifier for the organizationId.
        :param account_id: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "onAccount", [master_account_id, organization_id, account_id, partition]))

    @jsii.member(jsii_name="onAwspolicy")
    def on_awspolicy(
        self,
        policy_type: builtins.str,
        policy_id: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Organizations":
        '''(experimental) Adds a resource of type awspolicy to the statement.

        https://docs.aws.amazon.com/organizations/latest/userguide/orgs_reference_arn-formats.html

        :param policy_type: - Identifier for the policyType.
        :param policy_id: - Identifier for the policyId.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "onAwspolicy", [policy_type, policy_id, partition]))

    @jsii.member(jsii_name="onHandshake")
    def on_handshake(
        self,
        master_account_id: builtins.str,
        organization_id: builtins.str,
        handshake_type: builtins.str,
        handshake_id: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Organizations":
        '''(experimental) Adds a resource of type handshake to the statement.

        https://docs.aws.amazon.com/organizations/latest/userguide/orgs_reference_arn-formats.html

        :param master_account_id: - Identifier for the masterAccountId.
        :param organization_id: - Identifier for the organizationId.
        :param handshake_type: - Identifier for the handshakeType.
        :param handshake_id: - Identifier for the handshakeId.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "onHandshake", [master_account_id, organization_id, handshake_type, handshake_id, partition]))

    @jsii.member(jsii_name="onOrganization")
    def on_organization(
        self,
        master_account_id: builtins.str,
        organization_id: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Organizations":
        '''(experimental) Adds a resource of type organization to the statement.

        https://docs.aws.amazon.com/organizations/latest/userguide/orgs_reference_arn-formats.html

        :param master_account_id: - Identifier for the masterAccountId.
        :param organization_id: - Identifier for the organizationId.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "onOrganization", [master_account_id, organization_id, partition]))

    @jsii.member(jsii_name="onOrganizationalunit")
    def on_organizationalunit(
        self,
        master_account_id: builtins.str,
        organization_id: builtins.str,
        organizational_unit_id: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Organizations":
        '''(experimental) Adds a resource of type organizationalunit to the statement.

        https://docs.aws.amazon.com/organizations/latest/userguide/orgs_reference_arn-formats.html

        :param master_account_id: - Identifier for the masterAccountId.
        :param organization_id: - Identifier for the organizationId.
        :param organizational_unit_id: - Identifier for the organizationalUnitId.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "onOrganizationalunit", [master_account_id, organization_id, organizational_unit_id, partition]))

    @jsii.member(jsii_name="onPolicy")
    def on_policy(
        self,
        master_account_id: builtins.str,
        organization_id: builtins.str,
        policy_type: builtins.str,
        policy_id: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Organizations":
        '''(experimental) Adds a resource of type policy to the statement.

        https://docs.aws.amazon.com/organizations/latest/userguide/orgs_reference_arn-formats.html

        :param master_account_id: - Identifier for the masterAccountId.
        :param organization_id: - Identifier for the organizationId.
        :param policy_type: - Identifier for the policyType.
        :param policy_id: - Identifier for the policyId.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "onPolicy", [master_account_id, organization_id, policy_type, policy_id, partition]))

    @jsii.member(jsii_name="onRoot")
    def on_root(
        self,
        master_account_id: builtins.str,
        organization_id: builtins.str,
        root_id: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Organizations":
        '''(experimental) Adds a resource of type root to the statement.

        https://docs.aws.amazon.com/organizations/latest/userguide/orgs_reference_arn-formats.html

        :param master_account_id: - Identifier for the masterAccountId.
        :param organization_id: - Identifier for the organizationId.
        :param root_id: - Identifier for the rootId.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "onRoot", [master_account_id, organization_id, root_id, partition]))

    @jsii.member(jsii_name="toAcceptHandshake")
    def to_accept_handshake(self) -> "Organizations":
        '''(experimental) Grants permission to send a response to the originator of a handshake agreeing to the action proposed by the handshake request.

        Access Level: Write

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_AcceptHandshake.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toAcceptHandshake", []))

    @jsii.member(jsii_name="toAttachPolicy")
    def to_attach_policy(self) -> "Organizations":
        '''(experimental) Grants permission to attach a policy to a root, an organizational unit, or an individual account.

        Access Level: Write

        Possible conditions:

        - .ifPolicyType()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_AttachPolicy.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toAttachPolicy", []))

    @jsii.member(jsii_name="toCancelHandshake")
    def to_cancel_handshake(self) -> "Organizations":
        '''(experimental) Grants permission to cancel a handshake.

        Access Level: Write

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_CancelHandshake.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toCancelHandshake", []))

    @jsii.member(jsii_name="toCreateAccount")
    def to_create_account(self) -> "Organizations":
        '''(experimental) Grants permission to create an AWS account that is automatically a member of the organization with the credentials that made the request.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_CreateAccount.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toCreateAccount", []))

    @jsii.member(jsii_name="toCreateGovCloudAccount")
    def to_create_gov_cloud_account(self) -> "Organizations":
        '''(experimental) Grants permission to create an AWS GovCloud (US) account.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_CreateGovCloudAccount.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toCreateGovCloudAccount", []))

    @jsii.member(jsii_name="toCreateOrganization")
    def to_create_organization(self) -> "Organizations":
        '''(experimental) Grants permission to create an organization.

        The account with the credentials that calls the CreateOrganization operation automatically becomes the master account of the new organization.

        Access Level: Write

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_CreateOrganization.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toCreateOrganization", []))

    @jsii.member(jsii_name="toCreateOrganizationalUnit")
    def to_create_organizational_unit(self) -> "Organizations":
        '''(experimental) Grants permission to create an organizational unit (OU) within a root or parent OU.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_CreateOrganizationalUnit.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toCreateOrganizationalUnit", []))

    @jsii.member(jsii_name="toCreatePolicy")
    def to_create_policy(self) -> "Organizations":
        '''(experimental) Grants permission to create a policy that you can attach to a root, an organizational unit (OU), or an individual AWS account.

        Access Level: Write

        Possible conditions:

        - .ifPolicyType()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_CreatePolicy.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toCreatePolicy", []))

    @jsii.member(jsii_name="toDeclineHandshake")
    def to_decline_handshake(self) -> "Organizations":
        '''(experimental) Grants permission to decline a handshake request. This sets the handshake state to DECLINED and effectively deactivates the request.

        Access Level: Write

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_DeclineHandshake.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toDeclineHandshake", []))

    @jsii.member(jsii_name="toDeleteOrganization")
    def to_delete_organization(self) -> "Organizations":
        '''(experimental) Grants permission to delete the organization.

        Access Level: Write

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_DeleteOrganization.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toDeleteOrganization", []))

    @jsii.member(jsii_name="toDeleteOrganizationalUnit")
    def to_delete_organizational_unit(self) -> "Organizations":
        '''(experimental) Grants permission to delete an organizational unit from a root or another OU.

        Access Level: Write

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_DeleteOrganizationalUnit.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toDeleteOrganizationalUnit", []))

    @jsii.member(jsii_name="toDeletePolicy")
    def to_delete_policy(self) -> "Organizations":
        '''(experimental) Grants permission to delete a policy from your organization.

        Access Level: Write

        Possible conditions:

        - .ifPolicyType()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_DeletePolicy.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toDeletePolicy", []))

    @jsii.member(jsii_name="toDeregisterDelegatedAdministrator")
    def to_deregister_delegated_administrator(self) -> "Organizations":
        '''(experimental) Grants permission to deregister the specified member AWS account as a delegated administrator for the AWS service that is specified by ServicePrincipal.

        Access Level: Write

        Possible conditions:

        - .ifServicePrincipal()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_DeregisterDelegatedAdministrator.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toDeregisterDelegatedAdministrator", []))

    @jsii.member(jsii_name="toDescribeAccount")
    def to_describe_account(self) -> "Organizations":
        '''(experimental) Grants permission to retrieve Organizations-related details about the specified account.

        Access Level: Read

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_DescribeAccount.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toDescribeAccount", []))

    @jsii.member(jsii_name="toDescribeCreateAccountStatus")
    def to_describe_create_account_status(self) -> "Organizations":
        '''(experimental) Grants permission to retrieve the current status of an asynchronous request to create an account.

        Access Level: Read

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_DescribeCreateAccountStatus.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toDescribeCreateAccountStatus", []))

    @jsii.member(jsii_name="toDescribeEffectivePolicy")
    def to_describe_effective_policy(self) -> "Organizations":
        '''(experimental) Grants permission to retrieve the effective policy for an account.

        Access Level: Read

        Possible conditions:

        - .ifPolicyType()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_DescribeEffectivePolicy.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toDescribeEffectivePolicy", []))

    @jsii.member(jsii_name="toDescribeHandshake")
    def to_describe_handshake(self) -> "Organizations":
        '''(experimental) Grants permission to retrieve details about a previously requested handshake.

        Access Level: Read

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_DescribeHandshake.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toDescribeHandshake", []))

    @jsii.member(jsii_name="toDescribeOrganization")
    def to_describe_organization(self) -> "Organizations":
        '''(experimental) Grants permission to retrieves details about the organization that the calling credentials belong to.

        Access Level: Read

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_DescribeOrganization.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toDescribeOrganization", []))

    @jsii.member(jsii_name="toDescribeOrganizationalUnit")
    def to_describe_organizational_unit(self) -> "Organizations":
        '''(experimental) Grants permission to retrieve details about an organizational unit (OU).

        Access Level: Read

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_DescribeOrganizationalUnit.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toDescribeOrganizationalUnit", []))

    @jsii.member(jsii_name="toDescribePolicy")
    def to_describe_policy(self) -> "Organizations":
        '''(experimental) Grants permission to retrieves details about a policy.

        Access Level: Read

        Possible conditions:

        - .ifPolicyType()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_DescribePolicy.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toDescribePolicy", []))

    @jsii.member(jsii_name="toDetachPolicy")
    def to_detach_policy(self) -> "Organizations":
        '''(experimental) Grants permission to detach a policy from a target root, organizational unit, or account.

        Access Level: Write

        Possible conditions:

        - .ifPolicyType()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_DetachPolicy.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toDetachPolicy", []))

    @jsii.member(jsii_name="toDisableAWSServiceAccess")
    def to_disable_aws_service_access(self) -> "Organizations":
        '''(experimental) Grants permission to disable integration of an AWS service (the service that is specified by ServicePrincipal) with AWS Organizations.

        Access Level: Write

        Possible conditions:

        - .ifServicePrincipal()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_DisableAWSServiceAccess.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toDisableAWSServiceAccess", []))

    @jsii.member(jsii_name="toDisablePolicyType")
    def to_disable_policy_type(self) -> "Organizations":
        '''(experimental) Grants permission to disable an organization policy type in a root.

        Access Level: Write

        Possible conditions:

        - .ifPolicyType()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_DisablePolicyType.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toDisablePolicyType", []))

    @jsii.member(jsii_name="toEnableAllFeatures")
    def to_enable_all_features(self) -> "Organizations":
        '''(experimental) Grants permission to start the process to enable all features in an organization, upgrading it from supporting only Consolidated Billing features.

        Access Level: Write

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_EnableAllFeatures.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toEnableAllFeatures", []))

    @jsii.member(jsii_name="toEnableAWSServiceAccess")
    def to_enable_aws_service_access(self) -> "Organizations":
        '''(experimental) Grants permission to enable integration of an AWS service (the service that is specified by ServicePrincipal) with AWS Organizations.

        Access Level: Write

        Possible conditions:

        - .ifServicePrincipal()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_EnableAWSServiceAccess.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toEnableAWSServiceAccess", []))

    @jsii.member(jsii_name="toEnablePolicyType")
    def to_enable_policy_type(self) -> "Organizations":
        '''(experimental) Grants permission to enable a policy type in a root.

        Access Level: Write

        Possible conditions:

        - .ifPolicyType()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_EnablePolicyType.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toEnablePolicyType", []))

    @jsii.member(jsii_name="toInviteAccountToOrganization")
    def to_invite_account_to_organization(self) -> "Organizations":
        '''(experimental) Grants permission to send an invitation to another AWS account, asking it to join your organization as a member account.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_InviteAccountToOrganization.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toInviteAccountToOrganization", []))

    @jsii.member(jsii_name="toLeaveOrganization")
    def to_leave_organization(self) -> "Organizations":
        '''(experimental) Grants permission to remove a member account from its parent organization.

        Access Level: Write

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_LeaveOrganization.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toLeaveOrganization", []))

    @jsii.member(jsii_name="toListAccounts")
    def to_list_accounts(self) -> "Organizations":
        '''(experimental) Grants permission to list all of the the accounts in the organization.

        Access Level: List

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListAccounts.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toListAccounts", []))

    @jsii.member(jsii_name="toListAccountsForParent")
    def to_list_accounts_for_parent(self) -> "Organizations":
        '''(experimental) Grants permission to list the accounts in an organization that are contained by a root or organizational unit (OU).

        Access Level: List

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListAccountsForParent.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toListAccountsForParent", []))

    @jsii.member(jsii_name="toListAWSServiceAccessForOrganization")
    def to_list_aws_service_access_for_organization(self) -> "Organizations":
        '''(experimental) Grants permission to retrieve the list of the AWS services for which you enabled integration with your organization.

        Access Level: List

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListAWSServiceAccessForOrganization.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toListAWSServiceAccessForOrganization", []))

    @jsii.member(jsii_name="toListChildren")
    def to_list_children(self) -> "Organizations":
        '''(experimental) Grants permission to list all of the OUs or accounts that are contained in a parent OU or root.

        Access Level: List

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListChildren.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toListChildren", []))

    @jsii.member(jsii_name="toListCreateAccountStatus")
    def to_list_create_account_status(self) -> "Organizations":
        '''(experimental) Grants permission to list the asynchronous account creation requests that are currently being tracked for the organization.

        Access Level: List

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListCreateAccountStatus.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toListCreateAccountStatus", []))

    @jsii.member(jsii_name="toListDelegatedAdministrators")
    def to_list_delegated_administrators(self) -> "Organizations":
        '''(experimental) Grants permission to list the AWS accounts that are designated as delegated administrators in this organization.

        Access Level: List

        Possible conditions:

        - .ifServicePrincipal()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListDelegatedAdministrators.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toListDelegatedAdministrators", []))

    @jsii.member(jsii_name="toListDelegatedServicesForAccount")
    def to_list_delegated_services_for_account(self) -> "Organizations":
        '''(experimental) Grants permission to list the AWS services for which the specified account is a delegated administrator in this organization.

        Access Level: List

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListDelegatedServicesForAccount.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toListDelegatedServicesForAccount", []))

    @jsii.member(jsii_name="toListHandshakesForAccount")
    def to_list_handshakes_for_account(self) -> "Organizations":
        '''(experimental) Grants permission to list all of the handshakes that are associated with an account.

        Access Level: List

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListHandshakesForAccount.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toListHandshakesForAccount", []))

    @jsii.member(jsii_name="toListHandshakesForOrganization")
    def to_list_handshakes_for_organization(self) -> "Organizations":
        '''(experimental) Grants permission to list the handshakes that are associated with the organization.

        Access Level: List

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListHandshakesForOrganization.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toListHandshakesForOrganization", []))

    @jsii.member(jsii_name="toListOrganizationalUnitsForParent")
    def to_list_organizational_units_for_parent(self) -> "Organizations":
        '''(experimental) Grants permission to lists all of the organizational units (OUs) in a parent organizational unit or root.

        Access Level: List

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListOrganizationalUnitsForParent.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toListOrganizationalUnitsForParent", []))

    @jsii.member(jsii_name="toListParents")
    def to_list_parents(self) -> "Organizations":
        '''(experimental) Grants permission to list the root or organizational units (OUs) that serve as the immediate parent of a child OU or account.

        Access Level: List

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListParents.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toListParents", []))

    @jsii.member(jsii_name="toListPolicies")
    def to_list_policies(self) -> "Organizations":
        '''(experimental) Grants permission to list all of the policies in an organization.

        Access Level: List

        Possible conditions:

        - .ifPolicyType()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListPolicies.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toListPolicies", []))

    @jsii.member(jsii_name="toListPoliciesForTarget")
    def to_list_policies_for_target(self) -> "Organizations":
        '''(experimental) Grants permission to list all of the policies that are directly attached to a root, organizational unit (OU), or account.

        Access Level: List

        Possible conditions:

        - .ifPolicyType()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListPoliciesForTarget.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toListPoliciesForTarget", []))

    @jsii.member(jsii_name="toListRoots")
    def to_list_roots(self) -> "Organizations":
        '''(experimental) Grants permission to list all of the roots that are defined in the organization.

        Access Level: List

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListRoots.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toListRoots", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Organizations":
        '''(experimental) Grants permission to list all tags for the specified resource.

        Access Level: List

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTargetsForPolicy")
    def to_list_targets_for_policy(self) -> "Organizations":
        '''(experimental) Grants permission to list all the roots, OUs, and accounts to which a policy is attached.

        Access Level: List

        Possible conditions:

        - .ifPolicyType()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListTargetsForPolicy.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toListTargetsForPolicy", []))

    @jsii.member(jsii_name="toMoveAccount")
    def to_move_account(self) -> "Organizations":
        '''(experimental) Grants permission to move an account from its current root or OU to another parent root or OU.

        Access Level: Write

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_MoveAccount.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toMoveAccount", []))

    @jsii.member(jsii_name="toRegisterDelegatedAdministrator")
    def to_register_delegated_administrator(self) -> "Organizations":
        '''(experimental) Grants permission to register the specified member account to administer the Organizations features of the AWS service that is specified by ServicePrincipal.

        Access Level: Write

        Possible conditions:

        - .ifServicePrincipal()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_RegisterDelegatedAdministrator.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toRegisterDelegatedAdministrator", []))

    @jsii.member(jsii_name="toRemoveAccountFromOrganization")
    def to_remove_account_from_organization(self) -> "Organizations":
        '''(experimental) Grants permission to removes the specified account from the organization.

        Access Level: Write

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_RemoveAccountFromOrganization.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toRemoveAccountFromOrganization", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Organizations":
        '''(experimental) Grants permission to add one or more tags to the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Organizations":
        '''(experimental) Grants permission to remove one or more tags from the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateOrganizationalUnit")
    def to_update_organizational_unit(self) -> "Organizations":
        '''(experimental) Grants permission to rename an organizational unit (OU).

        Access Level: Write

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_UpdateOrganizationalUnit.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toUpdateOrganizationalUnit", []))

    @jsii.member(jsii_name="toUpdatePolicy")
    def to_update_policy(self) -> "Organizations":
        '''(experimental) Grants permission to update an existing policy with a new name, description, or content.

        Access Level: Write

        Possible conditions:

        - .ifPolicyType()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_UpdatePolicy.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toUpdatePolicy", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Outposts(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Outposts",
):
    '''(experimental) Statement provider for service `outposts <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsoutposts.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `outposts <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsoutposts.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Outposts, self, [sid])

    @jsii.member(jsii_name="toCreateOutpost")
    def to_create_outpost(self) -> "Outposts":
        '''(experimental) Grants permission to create an Outpost.

        Access Level: Write

        https://docs.aws.amazon.com/outposts/latest/APIReference/API_CreateOutpost.html

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toCreateOutpost", []))

    @jsii.member(jsii_name="toDeleteOutpost")
    def to_delete_outpost(self) -> "Outposts":
        '''(experimental) Grants permission to delete an Outpost.

        Access Level: Write

        https://docs.aws.amazon.com/outposts/latest/APIReference/API_DeleteOutpost.html

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toDeleteOutpost", []))

    @jsii.member(jsii_name="toDeleteSite")
    def to_delete_site(self) -> "Outposts":
        '''(experimental) Grants permission to delete an site.

        Access Level: Write

        https://docs.aws.amazon.com/outposts/latest/APIReference/API_DeleteSite.html

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toDeleteSite", []))

    @jsii.member(jsii_name="toGetOutpost")
    def to_get_outpost(self) -> "Outposts":
        '''(experimental) Grants permission to get information about the specified Outpost.

        Access Level: Read

        https://docs.aws.amazon.com/outposts/latest/APIReference/API_GetOutpost.html

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toGetOutpost", []))

    @jsii.member(jsii_name="toGetOutpostInstanceTypes")
    def to_get_outpost_instance_types(self) -> "Outposts":
        '''(experimental) Grants permission to list the instance types for the specified Outpost.

        Access Level: Read

        https://docs.aws.amazon.com/outposts/latest/APIReference/API_GetOutpostInstanceTypes.html

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toGetOutpostInstanceTypes", []))

    @jsii.member(jsii_name="toListOutposts")
    def to_list_outposts(self) -> "Outposts":
        '''(experimental) Grants permission to list the Outposts for your AWS account.

        Access Level: List

        https://docs.aws.amazon.com/outposts/latest/APIReference/API_ListOutposts.html

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toListOutposts", []))

    @jsii.member(jsii_name="toListSites")
    def to_list_sites(self) -> "Outposts":
        '''(experimental) Grants permission to list the sites for your AWS account.

        Access Level: List

        https://docs.aws.amazon.com/outposts/latest/APIReference/API_ListSites.html

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toListSites", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Outposts":
        '''(experimental) Grants permission to list tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/outposts/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Outposts":
        '''(experimental) Grants permission to add tags to a resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/outposts/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Outposts":
        '''(experimental) Grants permission to remove tags from a resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/outposts/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toUntagResource", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Panorama(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Panorama",
):
    '''(experimental) Statement provider for service `panorama <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awspanorama.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `panorama <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awspanorama.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Panorama, self, [sid])

    @jsii.member(jsii_name="onApp")
    def on_app(
        self,
        app_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Panorama":
        '''(experimental) Adds a resource of type app to the statement.

        https://docs.aws.amazon.com/panorama/latest/dev/

        :param app_name: - Identifier for the appName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "onApp", [app_name, account, region, partition]))

    @jsii.member(jsii_name="onAppVersion")
    def on_app_version(
        self,
        app_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Panorama":
        '''(experimental) Adds a resource of type appVersion to the statement.

        https://docs.aws.amazon.com/panorama/latest/dev/

        :param app_name: - Identifier for the appName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "onAppVersion", [app_name, account, region, partition]))

    @jsii.member(jsii_name="onDataSource")
    def on_data_source(
        self,
        device_name: builtins.str,
        data_source_name: builtins.str,
        account_id: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Panorama":
        '''(experimental) Adds a resource of type dataSource to the statement.

        https://docs.aws.amazon.com/panorama/latest/dev/

        :param device_name: - Identifier for the deviceName.
        :param data_source_name: - Identifier for the dataSourceName.
        :param account_id: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "onDataSource", [device_name, data_source_name, account_id, region, partition]))

    @jsii.member(jsii_name="onDevice")
    def on_device(
        self,
        device_name: builtins.str,
        account_id: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Panorama":
        '''(experimental) Adds a resource of type device to the statement.

        https://docs.aws.amazon.com/panorama/latest/dev/

        :param device_name: - Identifier for the deviceName.
        :param account_id: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "onDevice", [device_name, account_id, region, partition]))

    @jsii.member(jsii_name="onModel")
    def on_model(
        self,
        model_name: builtins.str,
        account_id: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Panorama":
        '''(experimental) Adds a resource of type model to the statement.

        https://docs.aws.amazon.com/panorama/latest/dev/

        :param model_name: - Identifier for the modelName.
        :param account_id: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "onModel", [model_name, account_id, region, partition]))

    @jsii.member(jsii_name="toCreateApp")
    def to_create_app(self) -> "Panorama":
        '''(experimental) Grants permission to create an AWS Panorama application.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/panorama/latest/dev/API_CreateApp.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toCreateApp", []))

    @jsii.member(jsii_name="toCreateAppDeployment")
    def to_create_app_deployment(self) -> "Panorama":
        '''(experimental) Grants permission to deploy an AWS Panorama application.

        Access Level: Write

        https://docs.aws.amazon.com/panorama/latest/dev/API_CreateAppDeployment.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toCreateAppDeployment", []))

    @jsii.member(jsii_name="toCreateAppVersion")
    def to_create_app_version(self) -> "Panorama":
        '''(experimental) Grants permission to create a version of an AWS Panorama application.

        Access Level: Write

        https://docs.aws.amazon.com/panorama/latest/dev/API_CreateAppVersion.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toCreateAppVersion", []))

    @jsii.member(jsii_name="toCreateDataSource")
    def to_create_data_source(self) -> "Panorama":
        '''(experimental) Grants permission to create an AWS Panorama datasource.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/panorama/latest/dev/API_CreateDataSource.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toCreateDataSource", []))

    @jsii.member(jsii_name="toCreateDeploymentConfiguration")
    def to_create_deployment_configuration(self) -> "Panorama":
        '''(experimental) Grants permission to configure a deployment for an AWS Panorama application.

        Access Level: Write

        https://docs.aws.amazon.com/panorama/latest/dev/API_CreateDeploymentConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toCreateDeploymentConfiguration", []))

    @jsii.member(jsii_name="toCreateDevice")
    def to_create_device(self) -> "Panorama":
        '''(experimental) Grants permission to register an AWS Panorama Appliance.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/panorama/latest/dev/API_CreateDevice.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toCreateDevice", []))

    @jsii.member(jsii_name="toCreateDeviceUpdate")
    def to_create_device_update(self) -> "Panorama":
        '''(experimental) Grants permission to apply a software update to an AWS Panorama Appliance.

        Access Level: Write

        https://docs.aws.amazon.com/panorama/latest/dev/API_CreateDeviceUpdate.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toCreateDeviceUpdate", []))

    @jsii.member(jsii_name="toCreateInputs")
    def to_create_inputs(self) -> "Panorama":
        '''(experimental) Grants permission to generate a list of cameras on the same network as an AWS Panorama Appliance.

        Access Level: Write

        https://docs.aws.amazon.com/panorama/latest/dev/API_CreateInputList.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toCreateInputs", []))

    @jsii.member(jsii_name="toCreateModel")
    def to_create_model(self) -> "Panorama":
        '''(experimental) Grants permission to import a machine learning model into AWS Panorama.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/panorama/latest/dev/API_CreateModel.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toCreateModel", []))

    @jsii.member(jsii_name="toCreateStreams")
    def to_create_streams(self) -> "Panorama":
        '''(experimental) Grants permission to generate a list of streams available to an AWS Panorama Appliance.

        Access Level: Write

        https://docs.aws.amazon.com/panorama/latest/dev/API_CreateStreamsList.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toCreateStreams", []))

    @jsii.member(jsii_name="toDeleteApp")
    def to_delete_app(self) -> "Panorama":
        '''(experimental) Grants permission to delete an AWS Panorama application.

        Access Level: Write

        https://docs.aws.amazon.com/panorama/latest/dev/API_DeleteApp.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toDeleteApp", []))

    @jsii.member(jsii_name="toDeleteAppVersion")
    def to_delete_app_version(self) -> "Panorama":
        '''(experimental) Grants permission to delete a version of an AWS Panorama application.

        Access Level: Write

        https://docs.aws.amazon.com/panorama/latest/dev/API_DeleteAppVersion.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toDeleteAppVersion", []))

    @jsii.member(jsii_name="toDeleteDataSource")
    def to_delete_data_source(self) -> "Panorama":
        '''(experimental) Grants permission to delete an AWS Panorama datasource.

        Access Level: Write

        https://docs.aws.amazon.com/panorama/latest/dev/API_DeleteDataSource.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toDeleteDataSource", []))

    @jsii.member(jsii_name="toDeleteDevice")
    def to_delete_device(self) -> "Panorama":
        '''(experimental) Grants permission to deregister an AWS Panorama Appliance.

        Access Level: Write

        https://docs.aws.amazon.com/panorama/latest/dev/API_DeleteDevice.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toDeleteDevice", []))

    @jsii.member(jsii_name="toDeleteModel")
    def to_delete_model(self) -> "Panorama":
        '''(experimental) Grants permission to delete a machine learning model from AWS Panorama.

        Access Level: Write

        https://docs.aws.amazon.com/panorama/latest/dev/API_DeleteModel.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toDeleteModel", []))

    @jsii.member(jsii_name="toDescribeApp")
    def to_describe_app(self) -> "Panorama":
        '''(experimental) Grants permission to view details about an AWS Panorama application.

        Access Level: Read

        https://docs.aws.amazon.com/panorama/latest/dev/API_DescribeApp.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toDescribeApp", []))

    @jsii.member(jsii_name="toDescribeAppDeployment")
    def to_describe_app_deployment(self) -> "Panorama":
        '''(experimental) Grants permission to view details about a deployment for an AWS Panorama application.

        Access Level: Read

        https://docs.aws.amazon.com/panorama/latest/dev/API_DescribeAppDeployment.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toDescribeAppDeployment", []))

    @jsii.member(jsii_name="toDescribeAppVersion")
    def to_describe_app_version(self) -> "Panorama":
        '''(experimental) Grants permission to view details about a version of an AWS Panorama application.

        Access Level: Read

        https://docs.aws.amazon.com/panorama/latest/dev/API_DescribeAppVersion.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toDescribeAppVersion", []))

    @jsii.member(jsii_name="toDescribeDataSource")
    def to_describe_data_source(self) -> "Panorama":
        '''(experimental) Grants permission to view details about a datasource in AWS Panorama.

        Access Level: Read

        https://docs.aws.amazon.com/panorama/latest/dev/API_DescribeDataSource.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toDescribeDataSource", []))

    @jsii.member(jsii_name="toDescribeDevice")
    def to_describe_device(self) -> "Panorama":
        '''(experimental) Grants permission to view details about an AWS Panorama Appliance.

        Access Level: Read

        https://docs.aws.amazon.com/panorama/latest/dev/API_DescribeDevice.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toDescribeDevice", []))

    @jsii.member(jsii_name="toDescribeDeviceUpdate")
    def to_describe_device_update(self) -> "Panorama":
        '''(experimental) Grants permission to view details about a software update for an AWS Panorama Appliance.

        Access Level: Read

        https://docs.aws.amazon.com/panorama/latest/dev/API_DescribeDeviceUpdate.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toDescribeDeviceUpdate", []))

    @jsii.member(jsii_name="toDescribeModel")
    def to_describe_model(self) -> "Panorama":
        '''(experimental) Grants permission to view details about a machine learning model in AWS Panorama.

        Access Level: Read

        https://docs.aws.amazon.com/panorama/latest/dev/API_DescribeModel.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toDescribeModel", []))

    @jsii.member(jsii_name="toDescribeSoftware")
    def to_describe_software(self) -> "Panorama":
        '''(experimental) Grants permission to view details about a software version for the AWS Panorama Appliance.

        Access Level: Read

        https://docs.aws.amazon.com/panorama/latest/dev/API_DescribeSoftware.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toDescribeSoftware", []))

    @jsii.member(jsii_name="toGetDeploymentConfiguration")
    def to_get_deployment_configuration(self) -> "Panorama":
        '''(experimental) Grants permission to view details about a deployment configuration for an AWS Panorama application.

        Access Level: Read

        https://docs.aws.amazon.com/panorama/latest/dev/API_GetDeploymentConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toGetDeploymentConfiguration", []))

    @jsii.member(jsii_name="toGetInputs")
    def to_get_inputs(self) -> "Panorama":
        '''(experimental) Grants permission to retrieve a list of cameras generated with CreateInputs.

        Access Level: Read

        https://docs.aws.amazon.com/panorama/latest/dev/API_GetInputList.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toGetInputs", []))

    @jsii.member(jsii_name="toGetStreams")
    def to_get_streams(self) -> "Panorama":
        '''(experimental) Grants permission to retrieve a list of streams generated with CreateStreams.

        Access Level: Read

        https://docs.aws.amazon.com/panorama/latest/dev/API_GetStreamsList.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toGetStreams", []))

    @jsii.member(jsii_name="toGetWebSocketURL")
    def to_get_web_socket_url(self) -> "Panorama":
        '''(experimental) Grants permission to generate a WebSocket endpoint for communication with AWS Panorama.

        Access Level: Read

        https://docs.aws.amazon.com/panorama/latest/dev/API_GetWebSocketURL.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toGetWebSocketURL", []))

    @jsii.member(jsii_name="toListAppDeploymentOperations")
    def to_list_app_deployment_operations(self) -> "Panorama":
        '''(experimental) Grants permission to retrieve a list of deployments for an AWS Panorama application.

        Access Level: List

        https://docs.aws.amazon.com/panorama/latest/dev/API_ListAppDeploymentOperations.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toListAppDeploymentOperations", []))

    @jsii.member(jsii_name="toListApps")
    def to_list_apps(self) -> "Panorama":
        '''(experimental) Grants permission to retrieve a list of applications in AWS Panorama.

        Access Level: List

        https://docs.aws.amazon.com/panorama/latest/dev/API_ListApps.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toListApps", []))

    @jsii.member(jsii_name="toListAppVersions")
    def to_list_app_versions(self) -> "Panorama":
        '''(experimental) Grants permission to retrieve a list of application versions in AWS Panorama.

        Access Level: List

        https://docs.aws.amazon.com/panorama/latest/dev/API_ListAppVersions.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toListAppVersions", []))

    @jsii.member(jsii_name="toListDataSources")
    def to_list_data_sources(self) -> "Panorama":
        '''(experimental) Grants permission to retrieve a list of datasources in AWS Panorama.

        Access Level: List

        https://docs.aws.amazon.com/panorama/latest/dev/API_ListDataSources.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toListDataSources", []))

    @jsii.member(jsii_name="toListDeploymentConfigurations")
    def to_list_deployment_configurations(self) -> "Panorama":
        '''(experimental) Grants permission to retrieve a list of deployment configurations in AWS Panorama.

        Access Level: List

        https://docs.aws.amazon.com/panorama/latest/dev/API_ListDeploymentConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toListDeploymentConfigurations", []))

    @jsii.member(jsii_name="toListDevices")
    def to_list_devices(self) -> "Panorama":
        '''(experimental) Grants permission to retrieve a list of appliances in AWS Panorama.

        Access Level: List

        https://docs.aws.amazon.com/panorama/latest/dev/API_ListDevices.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toListDevices", []))

    @jsii.member(jsii_name="toListDeviceUpdates")
    def to_list_device_updates(self) -> "Panorama":
        '''(experimental) Grants permission to retrieve a list of software updates for an AWS Panorama Appliance.

        Access Level: List

        https://docs.aws.amazon.com/panorama/latest/dev/API_ListDeviceUpdates.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toListDeviceUpdates", []))

    @jsii.member(jsii_name="toListModels")
    def to_list_models(self) -> "Panorama":
        '''(experimental) Grants permission to retrieve a list of models in AWS Panorama.

        Access Level: List

        https://docs.aws.amazon.com/panorama/latest/dev/API_ListModels.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toListModels", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Panorama":
        '''(experimental) Grants permission to retrieve a list of tags for a resource in AWS Panorama.

        Access Level: List

        https://docs.aws.amazon.com/panorama/latest/dev/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Panorama":
        '''(experimental) Grants permission to add tags to a resource in AWS Panorama.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/panorama/latest/dev/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Panorama":
        '''(experimental) Grants permission to remove tags from a resource in AWS Panorama.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/panorama/latest/dev/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateApp")
    def to_update_app(self) -> "Panorama":
        '''(experimental) Grants permission to modify an AWS Panorama application.

        Access Level: Write

        https://docs.aws.amazon.com/panorama/latest/dev/API_UpdateApp.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toUpdateApp", []))

    @jsii.member(jsii_name="toUpdateAppConfiguration")
    def to_update_app_configuration(self) -> "Panorama":
        '''(experimental) Grants permission to modify the version-specific configuration of an AWS Panorama application.

        Access Level: Write

        https://docs.aws.amazon.com/panorama/latest/dev/API_UpdateAppConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toUpdateAppConfiguration", []))

    @jsii.member(jsii_name="toUpdateDataSource")
    def to_update_data_source(self) -> "Panorama":
        '''(experimental) Grants permission to modify an AWS Panorama datasource.

        Access Level: Write

        https://docs.aws.amazon.com/panorama/latest/dev/API_UpdateDataSource.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toUpdateDataSource", []))

    @jsii.member(jsii_name="toUpdateDevice")
    def to_update_device(self) -> "Panorama":
        '''(experimental) Grants permission to modify basic settings for an AWS Panorama Appliance.

        Access Level: Write

        https://docs.aws.amazon.com/panorama/latest/dev/API_UpdateDevice.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toUpdateDevice", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Personalize(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Personalize",
):
    '''(experimental) Statement provider for service `personalize <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonpersonalize.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `personalize <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonpersonalize.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Personalize, self, [sid])

    @jsii.member(jsii_name="onAlgorithm")
    def on_algorithm(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Personalize":
        '''(experimental) Adds a resource of type algorithm to the statement.

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "onAlgorithm", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onBatchInferenceJob")
    def on_batch_inference_job(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Personalize":
        '''(experimental) Adds a resource of type batchInferenceJob to the statement.

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "onBatchInferenceJob", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onCampaign")
    def on_campaign(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Personalize":
        '''(experimental) Adds a resource of type campaign to the statement.

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "onCampaign", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onDataset")
    def on_dataset(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Personalize":
        '''(experimental) Adds a resource of type dataset to the statement.

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "onDataset", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onDatasetGroup")
    def on_dataset_group(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Personalize":
        '''(experimental) Adds a resource of type datasetGroup to the statement.

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "onDatasetGroup", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onDatasetImportJob")
    def on_dataset_import_job(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Personalize":
        '''(experimental) Adds a resource of type datasetImportJob to the statement.

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "onDatasetImportJob", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onEventTracker")
    def on_event_tracker(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Personalize":
        '''(experimental) Adds a resource of type eventTracker to the statement.

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "onEventTracker", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onFeatureTransformation")
    def on_feature_transformation(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Personalize":
        '''(experimental) Adds a resource of type featureTransformation to the statement.

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "onFeatureTransformation", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onFilter")
    def on_filter(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Personalize":
        '''(experimental) Adds a resource of type filter to the statement.

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "onFilter", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onRecipe")
    def on_recipe(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Personalize":
        '''(experimental) Adds a resource of type recipe to the statement.

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "onRecipe", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onSchema")
    def on_schema(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Personalize":
        '''(experimental) Adds a resource of type schema to the statement.

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "onSchema", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onSolution")
    def on_solution(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Personalize":
        '''(experimental) Adds a resource of type solution to the statement.

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "onSolution", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateBatchInferenceJob")
    def to_create_batch_inference_job(self) -> "Personalize":
        '''(experimental) Grants permission to create a batch inference job.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_CreateBatchInferenceJob.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toCreateBatchInferenceJob", []))

    @jsii.member(jsii_name="toCreateCampaign")
    def to_create_campaign(self) -> "Personalize":
        '''(experimental) Grants permission to create a campaign.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_CreateCampaign.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toCreateCampaign", []))

    @jsii.member(jsii_name="toCreateDataset")
    def to_create_dataset(self) -> "Personalize":
        '''(experimental) Grants permission to create a dataset.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_CreateDataset.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toCreateDataset", []))

    @jsii.member(jsii_name="toCreateDatasetGroup")
    def to_create_dataset_group(self) -> "Personalize":
        '''(experimental) Grants permission to create a dataset group.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_CreateDatasetGroup.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toCreateDatasetGroup", []))

    @jsii.member(jsii_name="toCreateDatasetImportJob")
    def to_create_dataset_import_job(self) -> "Personalize":
        '''(experimental) Grants permission to create a dataset import job.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_CreateDatasetImportJob.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toCreateDatasetImportJob", []))

    @jsii.member(jsii_name="toCreateEventTracker")
    def to_create_event_tracker(self) -> "Personalize":
        '''(experimental) Grants permission to create an event tracker.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_CreateEventTracker.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toCreateEventTracker", []))

    @jsii.member(jsii_name="toCreateFilter")
    def to_create_filter(self) -> "Personalize":
        '''(experimental) Grants permission to create a filter.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_CreateFilter.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toCreateFilter", []))

    @jsii.member(jsii_name="toCreateSchema")
    def to_create_schema(self) -> "Personalize":
        '''(experimental) Grants permission to create a schema.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_CreateSchema.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toCreateSchema", []))

    @jsii.member(jsii_name="toCreateSolution")
    def to_create_solution(self) -> "Personalize":
        '''(experimental) Grants permission to create a solution.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_CreateSolution.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toCreateSolution", []))

    @jsii.member(jsii_name="toCreateSolutionVersion")
    def to_create_solution_version(self) -> "Personalize":
        '''(experimental) Grants permission to create a solution version.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_CreateSolutionVersion.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toCreateSolutionVersion", []))

    @jsii.member(jsii_name="toDeleteCampaign")
    def to_delete_campaign(self) -> "Personalize":
        '''(experimental) Grants permission to delete a campaign.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_DeleteCampaign.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDeleteCampaign", []))

    @jsii.member(jsii_name="toDeleteDataset")
    def to_delete_dataset(self) -> "Personalize":
        '''(experimental) Grants permission to delete a dataset.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_DeleteDataset.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDeleteDataset", []))

    @jsii.member(jsii_name="toDeleteDatasetGroup")
    def to_delete_dataset_group(self) -> "Personalize":
        '''(experimental) Grants permission to delete a dataset group.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_DeleteDatasetGroup.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDeleteDatasetGroup", []))

    @jsii.member(jsii_name="toDeleteEventTracker")
    def to_delete_event_tracker(self) -> "Personalize":
        '''(experimental) Grants permission to delete an event tracker.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_DeleteEventTracker.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDeleteEventTracker", []))

    @jsii.member(jsii_name="toDeleteFilter")
    def to_delete_filter(self) -> "Personalize":
        '''(experimental) Grants permission to delete a filter.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_DeleteFilter.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDeleteFilter", []))

    @jsii.member(jsii_name="toDeleteSchema")
    def to_delete_schema(self) -> "Personalize":
        '''(experimental) Grants permission to delete a schema.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_DeleteSchema.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDeleteSchema", []))

    @jsii.member(jsii_name="toDeleteSolution")
    def to_delete_solution(self) -> "Personalize":
        '''(experimental) Grants permission to delete a solution including all versions of the solution.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_DeleteSolution.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDeleteSolution", []))

    @jsii.member(jsii_name="toDescribeAlgorithm")
    def to_describe_algorithm(self) -> "Personalize":
        '''(experimental) Grants permission to describe an algorithm.

        Access Level: Read

        https://docs.aws.amazon.com/personalize/latest/dg/API_DescribeAlgorithm.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDescribeAlgorithm", []))

    @jsii.member(jsii_name="toDescribeBatchInferenceJob")
    def to_describe_batch_inference_job(self) -> "Personalize":
        '''(experimental) Grants permission to describe a batch inference job.

        Access Level: Read

        https://docs.aws.amazon.com/personalize/latest/dg/API_DescribeBatchInferenceJob.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDescribeBatchInferenceJob", []))

    @jsii.member(jsii_name="toDescribeCampaign")
    def to_describe_campaign(self) -> "Personalize":
        '''(experimental) Grants permission to describe a campaign.

        Access Level: Read

        https://docs.aws.amazon.com/personalize/latest/dg/API_DescribeCampaign.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDescribeCampaign", []))

    @jsii.member(jsii_name="toDescribeDataset")
    def to_describe_dataset(self) -> "Personalize":
        '''(experimental) Grants permission to describe a dataset.

        Access Level: Read

        https://docs.aws.amazon.com/personalize/latest/dg/API_DescribeDataset.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDescribeDataset", []))

    @jsii.member(jsii_name="toDescribeDatasetGroup")
    def to_describe_dataset_group(self) -> "Personalize":
        '''(experimental) Grants permission to describe a dataset group.

        Access Level: Read

        https://docs.aws.amazon.com/personalize/latest/dg/API_DescribeDatasetGroup.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDescribeDatasetGroup", []))

    @jsii.member(jsii_name="toDescribeDatasetImportJob")
    def to_describe_dataset_import_job(self) -> "Personalize":
        '''(experimental) Grants permission to describe a dataset import job.

        Access Level: Read

        https://docs.aws.amazon.com/personalize/latest/dg/API_DescribeDatasetImportJob.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDescribeDatasetImportJob", []))

    @jsii.member(jsii_name="toDescribeEventTracker")
    def to_describe_event_tracker(self) -> "Personalize":
        '''(experimental) Grants permission to describe an event tracker.

        Access Level: Read

        https://docs.aws.amazon.com/personalize/latest/dg/API_DescribeEventTracker.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDescribeEventTracker", []))

    @jsii.member(jsii_name="toDescribeFeatureTransformation")
    def to_describe_feature_transformation(self) -> "Personalize":
        '''(experimental) Grants permission to describe a feature transformation.

        Access Level: Read

        https://docs.aws.amazon.com/personalize/latest/dg/API_DescribeFeatureTransformation.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDescribeFeatureTransformation", []))

    @jsii.member(jsii_name="toDescribeFilter")
    def to_describe_filter(self) -> "Personalize":
        '''(experimental) Grants permission to describe a filter.

        Access Level: Read

        https://docs.aws.amazon.com/personalize/latest/dg/API_DescribeFilter.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDescribeFilter", []))

    @jsii.member(jsii_name="toDescribeRecipe")
    def to_describe_recipe(self) -> "Personalize":
        '''(experimental) Grants permission to describe a recipe.

        Access Level: Read

        https://docs.aws.amazon.com/personalize/latest/dg/API_DescribeRecipe.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDescribeRecipe", []))

    @jsii.member(jsii_name="toDescribeSchema")
    def to_describe_schema(self) -> "Personalize":
        '''(experimental) Grants permission to describe a schema.

        Access Level: Read

        https://docs.aws.amazon.com/personalize/latest/dg/API_DescribeSchema.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDescribeSchema", []))

    @jsii.member(jsii_name="toDescribeSolution")
    def to_describe_solution(self) -> "Personalize":
        '''(experimental) Grants permission to describe a solution.

        Access Level: Read

        https://docs.aws.amazon.com/personalize/latest/dg/API_DescribeSolution.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDescribeSolution", []))

    @jsii.member(jsii_name="toDescribeSolutionVersion")
    def to_describe_solution_version(self) -> "Personalize":
        '''(experimental) Grants permission to describe a version of a solution.

        Access Level: Read

        https://docs.aws.amazon.com/personalize/latest/dg/API_DescribeSolutionVersion.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDescribeSolutionVersion", []))

    @jsii.member(jsii_name="toGetPersonalizedRanking")
    def to_get_personalized_ranking(self) -> "Personalize":
        '''(experimental) Grants permission to get a re-ranked list of recommendations.

        Access Level: Read

        https://docs.aws.amazon.com/personalize/latest/dg/API_RS_GetPersonalizedRanking.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toGetPersonalizedRanking", []))

    @jsii.member(jsii_name="toGetRecommendations")
    def to_get_recommendations(self) -> "Personalize":
        '''(experimental) Grants permission to get a list of recommendations from a campaign.

        Access Level: Read

        https://docs.aws.amazon.com/personalize/latest/dg/API_RS_GetRecommendations.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toGetRecommendations", []))

    @jsii.member(jsii_name="toGetSolutionMetrics")
    def to_get_solution_metrics(self) -> "Personalize":
        '''(experimental) Grants permission to get metrics for a solution version.

        Access Level: Read

        https://docs.aws.amazon.com/personalize/latest/dg/API_GetSolutionMetrics.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toGetSolutionMetrics", []))

    @jsii.member(jsii_name="toListBatchInferenceJobs")
    def to_list_batch_inference_jobs(self) -> "Personalize":
        '''(experimental) Grants permission to list batch inference jobs.

        Access Level: List

        https://docs.aws.amazon.com/personalize/latest/dg/API_ListBatchInferenceJobs.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toListBatchInferenceJobs", []))

    @jsii.member(jsii_name="toListCampaigns")
    def to_list_campaigns(self) -> "Personalize":
        '''(experimental) Grants permission to list campaigns.

        Access Level: List

        https://docs.aws.amazon.com/personalize/latest/dg/API_ListCampaigns.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toListCampaigns", []))

    @jsii.member(jsii_name="toListDatasetGroups")
    def to_list_dataset_groups(self) -> "Personalize":
        '''(experimental) Grants permission to list dataset groups.

        Access Level: List

        https://docs.aws.amazon.com/personalize/latest/dg/API_ListDatasetGroups.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toListDatasetGroups", []))

    @jsii.member(jsii_name="toListDatasetImportJobs")
    def to_list_dataset_import_jobs(self) -> "Personalize":
        '''(experimental) Grants permission to list dataset import jobs.

        Access Level: List

        https://docs.aws.amazon.com/personalize/latest/dg/API_ListDatasetImportJobs.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toListDatasetImportJobs", []))

    @jsii.member(jsii_name="toListDatasets")
    def to_list_datasets(self) -> "Personalize":
        '''(experimental) Grants permission to list datasets.

        Access Level: List

        https://docs.aws.amazon.com/personalize/latest/dg/API_ListDatasets.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toListDatasets", []))

    @jsii.member(jsii_name="toListEventTrackers")
    def to_list_event_trackers(self) -> "Personalize":
        '''(experimental) Grants permission to list event trackers.

        Access Level: List

        https://docs.aws.amazon.com/personalize/latest/dg/API_ListEventTrackers.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toListEventTrackers", []))

    @jsii.member(jsii_name="toListFilters")
    def to_list_filters(self) -> "Personalize":
        '''(experimental) Grants permission to list filters.

        Access Level: List

        https://docs.aws.amazon.com/personalize/latest/dg/API_ListFilters.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toListFilters", []))

    @jsii.member(jsii_name="toListRecipes")
    def to_list_recipes(self) -> "Personalize":
        '''(experimental) Grants permission to list recipes.

        Access Level: List

        https://docs.aws.amazon.com/personalize/latest/dg/API_ListRecipes.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toListRecipes", []))

    @jsii.member(jsii_name="toListSchemas")
    def to_list_schemas(self) -> "Personalize":
        '''(experimental) Grants permission to list schemas.

        Access Level: List

        https://docs.aws.amazon.com/personalize/latest/dg/API_ListSchemas.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toListSchemas", []))

    @jsii.member(jsii_name="toListSolutions")
    def to_list_solutions(self) -> "Personalize":
        '''(experimental) Grants permission to list solutions.

        Access Level: List

        https://docs.aws.amazon.com/personalize/latest/dg/API_ListSolutions.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toListSolutions", []))

    @jsii.member(jsii_name="toListSolutionVersions")
    def to_list_solution_versions(self) -> "Personalize":
        '''(experimental) Grants permission to list versions of a solution.

        Access Level: List

        https://docs.aws.amazon.com/personalize/latest/dg/API_ListSolutionVersions.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toListSolutionVersions", []))

    @jsii.member(jsii_name="toPutEvents")
    def to_put_events(self) -> "Personalize":
        '''(experimental) Grants permission to put real time event data.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_UBS_PutEvents.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toPutEvents", []))

    @jsii.member(jsii_name="toPutItems")
    def to_put_items(self) -> "Personalize":
        '''(experimental) Grants permission to ingest Items data.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_UBS_PutItems.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toPutItems", []))

    @jsii.member(jsii_name="toPutUsers")
    def to_put_users(self) -> "Personalize":
        '''(experimental) Grants permission to ingest Users data.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_UBS_PutUsers.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toPutUsers", []))

    @jsii.member(jsii_name="toUpdateCampaign")
    def to_update_campaign(self) -> "Personalize":
        '''(experimental) Grants permission to update a campaign.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_UpdateCampaign.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toUpdateCampaign", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


class Pi(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Pi"):
    '''(experimental) Statement provider for service `pi <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsperformanceinsights.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `pi <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsperformanceinsights.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        jsii.create(Pi, self, [sid])

    @jsii.member(jsii_name="onMetricResource")
    def on_metric_resource(
        self,
        service_type: builtins.str,
        identifier: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Pi":
        '''(experimental) Adds a resource of type metric-resource to the statement.

        :param service_type: - Identifier for the serviceType.
        :param identifier: - Identifier for the identifier.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``.

        :stability: experimental
        '''
        return typing.cast("Pi", jsii.invoke(self, "onMetricResource", [service_type, identifier, account, region, partition]))

    @jsii.member(jsii_name="toDescribeDimensionKeys")
    def to_describe_dimension_keys(self) -> "Pi":
        '''(experimental) For a specific time period, retrieve the top N dimension keys for a metric.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Pi", jsii.invoke(self, "toDescribeDimensionKeys", []))

    @jsii.member(jsii_name="toGetResourceMetrics")
    def to_get_resource_metrics(self) -> "Pi":
        '''(experimental) Retrieve PI metrics for a set of data sources, over a time period.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Pi", jsii.invoke(self, "toGetResourceMetrics", []))

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        jsii.set(self, "accessLevelList", value)

    @builtins.property # type: ignore[misc]
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        jsii.set(self, "servicePrefix", value)


__all__ = [
    "A4b",
    "AccessAnalyzer",
    "AccessLevelList",
    "Account",
    "Acm",
    "AcmPca",
    "Activate",
    "Airflow",
    "All",
    "Amplify",
    "Amplifybackend",
    "Apigateway",
    "ApigatewayV2",
    "AppIntegrations",
    "Appconfig",
    "Appflow",
    "ApplicationAutoscaling",
    "Applicationinsights",
    "Appmesh",
    "AppmeshPreview",
    "Appstream",
    "Appsync",
    "Aps",
    "Arsenal",
    "Artifact",
    "Athena",
    "Auditmanager",
    "Autoscaling",
    "AutoscalingPlans",
    "AwsMarketplace",
    "AwsMarketplaceCatalog",
    "AwsMarketplaceEntitlementService",
    "AwsMarketplaceImageBuildingService",
    "AwsMarketplaceManagement",
    "AwsMarketplaceMeteringService",
    "AwsMarketplacePrivate",
    "AwsMarketplaceProcurementSystemsIntegration",
    "AwsPortal",
    "Awsconnector",
    "Backup",
    "BackupStorage",
    "Batch",
    "Braket",
    "Budgets",
    "Cassandra",
    "Ce",
    "Chatbot",
    "Chime",
    "Cloud9",
    "Clouddirectory",
    "Cloudformation",
    "Cloudfront",
    "Cloudhsm",
    "Cloudsearch",
    "Cloudshell",
    "Cloudtrail",
    "Cloudwatch",
    "Codeartifact",
    "Codebuild",
    "Codecommit",
    "Codedeploy",
    "Codeguru",
    "CodeguruProfiler",
    "CodeguruReviewer",
    "Codepipeline",
    "Codestar",
    "CodestarConnections",
    "CodestarNotifications",
    "CognitoIdentity",
    "CognitoIdp",
    "CognitoSync",
    "Collection",
    "Comprehend",
    "Comprehendmedical",
    "ComputeOptimizer",
    "Conditions",
    "Config",
    "Connect",
    "Cur",
    "Databrew",
    "Dataexchange",
    "Datapipeline",
    "Datasync",
    "Dax",
    "Dbqms",
    "Deepcomposer",
    "Deeplens",
    "Deepracer",
    "Detective",
    "Devicefarm",
    "DevopsGuru",
    "Directconnect",
    "Discovery",
    "Dlm",
    "Dms",
    "Ds",
    "Dynamodb",
    "Ebs",
    "Ec2",
    "Ec2InstanceConnect",
    "Ec2messages",
    "Ecr",
    "EcrPublic",
    "Ecs",
    "Effect",
    "Eks",
    "ElasticInference",
    "Elasticache",
    "Elasticbeanstalk",
    "Elasticfilesystem",
    "Elasticloadbalancing",
    "ElasticloadbalancingV2",
    "Elasticmapreduce",
    "Elastictranscoder",
    "ElementalActivations",
    "ElementalAppliancesSoftware",
    "ElementalSupportCases",
    "ElementalSupportContent",
    "EmrContainers",
    "Es",
    "Events",
    "ExecuteApi",
    "Firehose",
    "Fis",
    "Fms",
    "Forecast",
    "Frauddetector",
    "Freertos",
    "Fsx",
    "Gamelift",
    "Geo",
    "Glacier",
    "Globalaccelerator",
    "Glue",
    "Grafana",
    "Greengrass",
    "GreengrassV2",
    "Groundstation",
    "Groundtruthlabeling",
    "Guardduty",
    "Health",
    "Healthlake",
    "Honeycode",
    "Iam",
    "Identitystore",
    "Imagebuilder",
    "Importexport",
    "Inspector",
    "Iot",
    "Iot1click",
    "IotDeviceTester",
    "Iotanalytics",
    "Iotdeviceadvisor",
    "Iotevents",
    "Iotfleethub",
    "Iotsitewise",
    "Iotthingsgraph",
    "Iotwireless",
    "Iq",
    "IqPermission",
    "Ivs",
    "Kafka",
    "Kendra",
    "Kinesis",
    "Kinesisanalytics",
    "KinesisanalyticsV2",
    "Kinesisvideo",
    "Kms",
    "Lakeformation",
    "Lambda",
    "Launchwizard",
    "Lex",
    "LexV2",
    "LicenseManager",
    "Lightsail",
    "Logs",
    "Lookoutequipment",
    "Lookoutmetrics",
    "Lookoutvision",
    "Machinelearning",
    "Macie",
    "Macie2",
    "Managedblockchain",
    "Marketplacecommerceanalytics",
    "Mechanicalturk",
    "Mediaconnect",
    "Mediaconvert",
    "Medialive",
    "Mediapackage",
    "MediapackageVod",
    "Mediastore",
    "Mediatailor",
    "Mgh",
    "Mgn",
    "Mobileanalytics",
    "Mobilehub",
    "Mobiletargeting",
    "Monitron",
    "Mq",
    "NeptuneDb",
    "NetworkFirewall",
    "Networkmanager",
    "Operator",
    "Opsworks",
    "OpsworksCm",
    "Organizations",
    "Outposts",
    "Panorama",
    "Personalize",
    "Pi",
    "PolicyStatement",
    "PolicyStatementBase",
    "PolicyStatementWithActions",
    "PolicyStatementWithCondition",
    "PolicyStatementWithEffect",
    "PolicyStatementWithPrincipal",
    "PolicyStatementWithResources",
    "Polly",
    "Pricing",
    "Principals",
    "Profile",
    "Proton",
    "PurchaseOrders",
    "Qldb",
    "Quicksight",
    "Ram",
    "Rds",
    "RdsData",
    "RdsDb",
    "Redshift",
    "RedshiftData",
    "Rekognition",
    "ResourceExplorer",
    "ResourceGroups",
    "ResourceTypes",
    "Robomaker",
    "Route53",
    "Route53domains",
    "Route53resolver",
    "S3",
    "S3ObjectLambda",
    "S3Outposts",
    "Sagemaker",
    "Savingsplans",
    "Schemas",
    "Sdb",
    "Secretsmanager",
    "Securityhub",
    "Serverlessrepo",
    "Servicecatalog",
    "Servicediscovery",
    "Servicequotas",
    "Ses",
    "SesPinpoint",
    "SesV2",
    "Shield",
    "Signer",
    "Sms",
    "SmsVoice",
    "Snowball",
    "Sns",
    "Sqs",
    "Ssm",
    "Ssmmessages",
    "Sso",
    "SsoDirectory",
    "States",
    "Storagegateway",
    "Sts",
    "Sumerian",
    "Support",
    "Swf",
    "Synthetics",
    "Tag",
    "Textract",
    "Timestream",
    "Tiros",
    "Transcribe",
    "Transfer",
    "Translate",
    "Trustedadvisor",
    "Waf",
    "WafRegional",
    "Wafv2",
    "Wam",
    "Wellarchitected",
    "Workdocs",
    "Worklink",
    "Workmail",
    "Workmailmessageflow",
    "Workspaces",
    "Xray",
]

publication.publish()
